6 ms·

At some point iOS started asking if I want to trust the device, so I suppose if I use this malicious cable with charger and iOS asks me about computer or access

At some point iOS started asking if I want to trust the device, so I suppose if I use this malicious cable with charger and iOS asks me about computer or accessory, I would know things are fishy, would not I?

lisper 7y ago
Theoretically. Unfortunately, the device trust settings are not reliably remembered. My phone regularly asks me if I want to trust my computer despite the fact that I haven't made any changes to it. So it might be an indication that something is fishy, or (much more likely) it might just be that a trust setting has expired. Also, no device fingerprint is displayed along with the query, so there's no way to know which device the phone is actually asking you to approve.
- mynegation 7y ago
  This is true. If one uses this cable to attach to a computer- there is no way to know, but charger is supposed to be dumb device. I wonder if this thing detects that and does not announce itself.
  - kybernetikos 7y ago
    I saw something about changing the cable's hardware ids to avoid this. I guess you find a piece of hardware that you know is trusted by the target phone and then copy its hardware id onto the cable if you want to evade that warning.
    - gruez 7y ago
      I'm skeptical that would work. If anything it's authenticated with the computer itself, not the cable.
      - earthboundkid 7y ago
        Maybe you first use physical access to connect to the victim’s computer, get the ID, and masquerade as it in the cable? It’s a hassle, but if the laptop is left alone in the house, doable.
- close04 7y ago
  Aren’t you asked every time you reestablish a connection? If I unplug my iPhone (applies to Android too but with slightly different options) and plug it back into the computer I simply get prompted again. I think the trust is ephemeral and is forgotten the moment you disconnect from the USB port. From the phone’s perspective there doesn’t seem to be a trust store where devices are uniquely identified and remembered.
  - lisper 7y ago
    > Aren’t you asked every time you reestablish a connection? No. Sometimes it asks, sometimes it doesn't. There doesn't seem to be any pattern to it that I have been able to discern.
    - noizejoy 7y ago
      > There doesn't seem to be any pattern to it that I have been able to discern. In sufficiently complex software, things can appear to be random (or magic), even when they are neither. — I seldom trust myself to declare something random in computer technology, just because I haven’t figured out the pattern (yet).
      - lisper 7y ago
        In this case it doesn't matter. The indiscernibility of a pattern has the same effect as the absence of a pattern, namely, I can't tell whether or not the decice that my phone is asking me about is actually my computer or malicious hardware embedded in my USB cable.
        noizejoy 7y ago
        I didn’t think the device had any way of telling if the cable was malicious. So even if it wouldn’t ask repeatedly, you wouldn’t know if the cable was evil? So I’m not sure if the question “do you trust the device you just plugged in” does much of anything other than giving you a chance to reconsider? Also, is there a chance that the trust is lost on a weird AI timer? For example, a little while ago, my phone asked, if I wanted an alarm set to a specific time on a specific weekday morning, apparently just because I needed such an alarm for 2 weeks in a row. That made the pattern easy to recognize, but it also told me that the phone AI is trying too hard to learn about me. - I assume you’re always using the same cable? And I also assume you don’t get the trust dialog when plugging into a wall charger directly?
m45t3r 7y ago
Android is kind of the same: by default, no data connection is made unless you explicitly change the USB mode from charging to something else.
- tialaramex 7y ago
  This depends on what the attached device seems to be, which of course a malevolent cable can choose. You're correct that if I plug the phone into my PC the phone defaults to just charging from it, and needs an explicit UI intervention to offer other features - but if I plug it into my USB keyboard it just works as a keyboard, no further UI intervention needed. I guess it's _possible_ that I forgot having one time authorised this for the keyboard, but even if that's true it means a malevolent device just needs to guess what to impersonate to get into any phone that has even once authorised such a device, because there's no cryptographic protection - if I say "I'm a Cheap Ass Generic USB Keyboard serial # 00001" then there's no way to distinguish me from the real "Cheap Ass Generic USB Keyboard serial # 00001". Now, maybe the situation is that phones allow some safer things and not more dangerous ones. Maybe you can pretend to be a USB keyboard or mouse, but it will refuse to offer any of the file transfer type features or networking. I don't know, but my expectation is that people who've built these cables do know and there are plenty of holes.
  - grenoire 7y ago
    Can a USB device posing as a keyboard also supply charging voltage?
    - tialaramex 7y ago
      Is your question: Do real devices do this? None that I'm aware of. Are they allowed to do this? I would be astonished if the USB-C specification has a big list of what is or is not allowed to volunteer power, seems like just an opportunity to fail more than necessary. But anyway, suppose phones are smart enough to refuse to charge from a keyboard. These cable are remote controlled. So you plug in your phone, it charges... and then a minute later when you're distracted it gets told the charger went away... and now here's a keyboard. Attack in progress. I reckon you could work out a procedure e.g. pretend to be power for 90 seconds, supposing experience teaches that's how long people take to forget they plugged the phone in. Then, turn the power off. Watch. An attentive user may notice, unplug their phone and try again thinking the cable may be faulty. Re-enable power when the phone vanishes. If not, after giving them say 30 seconds to notice switch to keyboard mode. Or you could just wing it. A lot of good physical penetration testers "wing it" all the time.
asdff 7y ago
Not necessarily. Those notifications pop up when your cable is starting to fail as well. If your malicious cable had 'amazon basics' printed on the side and looked a little ratty, no one would bat an eye.
- gruez 7y ago
  >Not necessarily. Those notifications pop up when your cable is starting to fail as well I think you're talking about the "this accessory is not supported by this iphone" prompt, not the "trust this computer?" or "allow this device to access your photos and videos" prompts. The first shows up if your cable can't be verified to be mfi compatible (via a special chip in the cable), and the last two only show up when connecting to a computer.
  - davchana 7y ago
    If it is not my pc; & I am just charging the phone, I always select the Charge Only mode. No to Allow this device to access your photos prompt.
saagarjha 7y ago
Interestingly, there is no way to get an iPhone to charge off of a computer port (which will try to send data?) without trusting it. It will just refuse the connection entirely instead of accepting just power.

lisper 7y ago

Theoretically. Unfortunately, the device trust settings are not reliably remembered. My phone regularly asks me if I want to trust my computer despite the fact that I haven't made any changes to it. So it might be an indication that something is fishy, or (much more likely) it might just be that a trust setting has expired. Also, no device fingerprint is displayed along with the query, so there's no way to know which device the phone is actually asking you to approve.

mynegation 7y ago
This is true. If one uses this cable to attach to a computer- there is no way to know, but charger is supposed to be dumb device. I wonder if this thing detects that and does not announce itself.
- kybernetikos 7y ago
  I saw something about changing the cable's hardware ids to avoid this. I guess you find a piece of hardware that you know is trusted by the target phone and then copy its hardware id onto the cable if you want to evade that warning.
  - gruez 7y ago
    I'm skeptical that would work. If anything it's authenticated with the computer itself, not the cable.
    - earthboundkid 7y ago
      Maybe you first use physical access to connect to the victim’s computer, get the ID, and masquerade as it in the cable? It’s a hassle, but if the laptop is left alone in the house, doable.
close04 7y ago
Aren’t you asked every time you reestablish a connection? If I unplug my iPhone (applies to Android too but with slightly different options) and plug it back into the computer I simply get prompted again. I think the trust is ephemeral and is forgotten the moment you disconnect from the USB port. From the phone’s perspective there doesn’t seem to be a trust store where devices are uniquely identified and remembered.
- lisper 7y ago
  > Aren’t you asked every time you reestablish a connection? No. Sometimes it asks, sometimes it doesn't. There doesn't seem to be any pattern to it that I have been able to discern.
  - noizejoy 7y ago
    > There doesn't seem to be any pattern to it that I have been able to discern. In sufficiently complex software, things can appear to be random (or magic), even when they are neither. — I seldom trust myself to declare something random in computer technology, just because I haven’t figured out the pattern (yet).
    - lisper 7y ago
      In this case it doesn't matter. The indiscernibility of a pattern has the same effect as the absence of a pattern, namely, I can't tell whether or not the decice that my phone is asking me about is actually my computer or malicious hardware embedded in my USB cable.
      - noizejoy 7y ago
        I didn’t think the device had any way of telling if the cable was malicious. So even if it wouldn’t ask repeatedly, you wouldn’t know if the cable was evil? So I’m not sure if the question “do you trust the device you just plugged in” does much of anything other than giving you a chance to reconsider? Also, is there a chance that the trust is lost on a weird AI timer? For example, a little while ago, my phone asked, if I wanted an alarm set to a specific time on a specific weekday morning, apparently just because I needed such an alarm for 2 weeks in a row. That made the pattern easy to recognize, but it also told me that the phone AI is trying too hard to learn about me. - I assume you’re always using the same cable? And I also assume you don’t get the trust dialog when plugging into a wall charger directly?

m45t3r 7y ago

Android is kind of the same: by default, no data connection is made unless you explicitly change the USB mode from charging to something else.

tialaramex 7y ago
This depends on what the attached device seems to be, which of course a malevolent cable can choose. You're correct that if I plug the phone into my PC the phone defaults to just charging from it, and needs an explicit UI intervention to offer other features - but if I plug it into my USB keyboard it just works as a keyboard, no further UI intervention needed. I guess it's _possible_ that I forgot having one time authorised this for the keyboard, but even if that's true it means a malevolent device just needs to guess what to impersonate to get into any phone that has even once authorised such a device, because there's no cryptographic protection - if I say "I'm a Cheap Ass Generic USB Keyboard serial # 00001" then there's no way to distinguish me from the real "Cheap Ass Generic USB Keyboard serial # 00001". Now, maybe the situation is that phones allow some safer things and not more dangerous ones. Maybe you can pretend to be a USB keyboard or mouse, but it will refuse to offer any of the file transfer type features or networking. I don't know, but my expectation is that people who've built these cables do know and there are plenty of holes.
- grenoire 7y ago
  Can a USB device posing as a keyboard also supply charging voltage?
  - tialaramex 7y ago
    Is your question: Do real devices do this? None that I'm aware of. Are they allowed to do this? I would be astonished if the USB-C specification has a big list of what is or is not allowed to volunteer power, seems like just an opportunity to fail more than necessary. But anyway, suppose phones are smart enough to refuse to charge from a keyboard. These cable are remote controlled. So you plug in your phone, it charges... and then a minute later when you're distracted it gets told the charger went away... and now here's a keyboard. Attack in progress. I reckon you could work out a procedure e.g. pretend to be power for 90 seconds, supposing experience teaches that's how long people take to forget they plugged the phone in. Then, turn the power off. Watch. An attentive user may notice, unplug their phone and try again thinking the cable may be faulty. Re-enable power when the phone vanishes. If not, after giving them say 30 seconds to notice switch to keyboard mode. Or you could just wing it. A lot of good physical penetration testers "wing it" all the time.

asdff 7y ago

Not necessarily. Those notifications pop up when your cable is starting to fail as well. If your malicious cable had 'amazon basics' printed on the side and looked a little ratty, no one would bat an eye.

gruez 7y ago
>Not necessarily. Those notifications pop up when your cable is starting to fail as well I think you're talking about the "this accessory is not supported by this iphone" prompt, not the "trust this computer?" or "allow this device to access your photos and videos" prompts. The first shows up if your cable can't be verified to be mfi compatible (via a special chip in the cable), and the last two only show up when connecting to a computer.
- davchana 7y ago
  If it is not my pc; & I am just charging the phone, I always select the Charge Only mode. No to Allow this device to access your photos prompt.

saagarjha 7y ago

Interestingly, there is no way to get an iPhone to charge off of a computer port (which will try to send data?) without trusting it. It will just refuse the connection entirely instead of accepting just power.