15 ms·

FBI is warning people against using public phone-charging stations

257 points by mikece 4y ago

dpratt 4y ago
“Dear citizens, please be wary of attacks on your devices designed to compromise your privacy and personal information. It would be unfortunate if we had competition in the game.”
- rtkwe 4y ago
  It's always been a competing priorities inside the government between groups improving security so that commerce and secrets stay secret and safe and other groups who's priorities are more generalized security that would love to snoop into everyone all the time.
chaorace 4y ago
Just FYI: this is referring to USB charging stations, not EV stations. This advice has been standard in cybersecurity training for a long time now and frankly I'm surprised that this is the first time the FBI has felt the need to issue an advisory on the subject.
- LinuxBender 4y ago
  I have been somewhat curious if/when this will occur with EV stations as well. What controls might one gain over a car from the charging port on the assorted makes/models? Even hacking aside I am curious what PII, telemetry and tracking data could be pulled from the charge port.
  - i-am-gizm0 4y ago
    At least on AC Level 1/2 charging (using just a J1772 port) the signalling is pretty rudimentary if I remember correctly. Something along the lines of the car puts out a square wave on one of the signalling pins and based on the resistance it sees it knows whether it's plugged in and how much power it can charge, so there isn't much room (dare I say any) way to interact much with the car through that port. I don't know how DC charging works but I assume there's a little bit more smarts to it. Tesla on the other hand is a completely different story.
    - rtkwe 4y ago
      The really high voltage fast chargers as far as I understand them connect directly to the battery bypassing the cars battery charger to directly charge the battery not sure how much communication there is on those channels though.
      - vegardx 4y ago
        You're probably thinking about the on-board inverter, it's often referred to as a battery charger. The battery management system is entirely within the car, and the car will tell what voltage and amperage to deliver to it. The design of CCS2 is actually quite nice. There are pins for singalling that, if broken, will immediately shut down power delivery. This means that you can just pull the cable out safely, without risking arcing or electrocuting yourself.
        rtkwe 4y ago
        My understanding was it also bypassed the BMS but I may have confused what they were saying it's been a minute.
    - rlpb 4y ago
      When I've done DC rapid charging on my Leaf, I noticed that the charger knew the battery percentage reported by the car. That seems likely to be digital signalling to me, so suddenly there's the risk of buffer overflows and suchlike. I've not seen this on AC, but when I looked into this previously I got the impression that there exists a digital signalling protocol established by modulating something ignored by older cars and chargers that can be optionally supported. If that's the case then there's potentially attack surface there, too.
      - fnordpiglet 4y ago
        That’s why I only buy cars written in rust.
        4y ago
  - Forbo 4y ago
    Even if it's not available via the charger they'll just do this with ALPR or their proprietary apps. Gotta love surveillance capitalism.
  - judge2020 4y ago
    The CCS standard has "HLC - High Level Communication", which is available for both AC and DC charging. While i'm not interested in paying $700 for ISO 15118, I imagine clients [cars] are set up to break the current flow if anything out of the ordinary happens or if the input power doesn't match what the station is saying it's sending in an instant.
  - 13of40 4y ago
    I wonder if dealerships and other auto shops behave like every other company today, and when they plug into your OBD2 port they just hoover up as much data as they can and sell it off.
- causi 4y ago
  Seriously need an edited title then. Original title is wildly misleading.
  - hinata08 4y ago
    I thought it was a wild clickbait and didn't even go to read the article. I read it as "EVs are dangerous according to the FBI, use V12 engines to avoid hackers" but yeah, public charging stations *for phones* are terrible. I used one of them once at a conference, with ADB enabled on my phone. I thought it would just feed me power, as not data collection was specified on the station. but it enabled a data connection. So I used a public station once, and I'll never do it again.
  - dwringer 4y ago
    I agree - the only "public charging stations" I see on any kind of regular basis are EV charging stations. It's been a couple of decades since I remember seeing a USB one, not that I doubt their existence.
    - ghaff 4y ago
      They're ubiquitous at conferences and in many trains, planes, airports, hotels, etc. Maybe you mean something different by public but USB charging stations that you don't control are very common especially in the context of places travelers are in. They're probably pretty common in schools, libraries, conference rooms, etc. as well.
    - TillE 4y ago
      They're in basically every major airport, as well as most modern airplanes.
- mcculley 4y ago
  It is not the first time the FBI has warned about this (see [0] for example, or do a Google search with date filters). This is the Denver field office maximizing Twitter engagement by repeating themselves. (Maybe that is not a fair way to view it, maybe the FBI should repeat advisories often.) [0]: https://www.fbi.gov/contact-us/field-offices/portland/news/press-releases/oregon-fbi-tech-tuesday-building-a-digital-defense-against-juice-jacking https://www.fbi.gov/contact-us/field-offices/portland/news/p...
- giancarlostoro 4y ago
  The moment I first saw one I knew something was wrong.
manishsharan 4y ago
There are USB "condom" cables available which do not have data wire. https://www.zdnet.com/article/protect-your-data-with-a-usb-condom/ https://www.zdnet.com/article/protect-your-data-with-a-usb-c... I don't have those; I just charge my portable battery first and then charge my devices from the battery.
- SketchySeaBeast 4y ago
  But then your phone will have been with every port your battery pack has been with! An alternative is also a power only USB cable, just because I feel like I'm less likely to lose a whole cable than a "condom".
  - hibbelig 4y ago
    > But then your phone will have been with every port your battery pack has been with! It's unclear to me what this means. I thought it works like this: - Connect battery pack to USB port - USB port tries to hack the battery pack, but it's too dumb, so the attempt goes nowhere. The charge flows nicely, though. - Disconnect battery pack from USB port - Connect device to battery pack
    - SketchySeaBeast 4y ago
      Oh, it was strictly a joke that was stretching the condom/STI metaphor.
    - palata 4y ago
      > USB port tries to hack the battery pack, but it's too dumb Are you certain it is?
- LegitShady 4y ago
  I haven't seen many of those data blockers that support quick charge and thats pretty important when using some kind of public charging station. I, like you, charge a portable battery that can refill my phone 2-3x without issue.
hprotagonist 4y ago
badUSB is what, nearly 20 years old now? i distinctly remember making usb condoms a long time ago, anyway, and have never trusted public usb slots anyway.
- ineedtocall 4y ago
  I had to look that age up. You're right, ~19 years ago[1] badUSB made its debut. Another fun toy is the USB Gadget Kernel module. I've been running yolo + mouse/keyboard emulation on a raspberry pi to make horrible aim bots. 1. https://en.wikipedia.org/wiki/BadUSB https://en.wikipedia.org/wiki/BadUSB
RcouF1uZ4gsC 4y ago
This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.
- moritonal 4y ago
  Firstly, I believe the QI scheme includes a process for communication, mostly restricted to "how much power should I send" for now, but it's obvious this will be expanded to more functionality as people basically replicate NFC over it. Second, I'm still waiting to see a QI charger than just pumps 100W of power straight through any piece of metal above it. Don't know what would happen, but I naively imagine forced induction would brick most devices.
  - spacetime_cmplx 4y ago
    >I'm still waiting to see a QI charger than just pumps 100W of power straight through any piece of metal above it A charger so good it's the last time you'll need to charge
  - im3w1l 4y ago
    Hard disagree. If physical proximity was all it took to compromise a phone everyone would immediately protest. USB requires an active action. Blaming the user is still wrong, it really should be safe to charge in a mall or get a file from your friends usb stick. But it's less obvious so here we are.
  - amluto 4y ago
    As I understand it, Qi has a digital communication channel from the phone to the charger but no digital communication from charger to phone. So any exploit over Qi would have to somehow compromise the phone’s charging system with just analog field variations (frequency, field strength, or whatever else the phone measures).
- JustSomeNobody 4y ago
  Only need a 6 hour layover to take full advantage.
fouc 4y ago
I guess we should also avoid plugging our phone into the USB ports on airplane seats?
- hprotagonist 4y ago
  that should go without saying: yes, you should avoid doing that.
- expertentipp 4y ago
  The race of media, ad, and other companies for one's attention and data is brutal. Especially when one is stuck in a seat for hours and only has a back of another seat in front of their face.
  - maerF0x0 4y ago
    I've often wondered about this. Is $AIRLINE selling the traffic data? I wonder how much $NSFW is being consumed on planes?
- kfajdsl 4y ago
  You can use a power only cable.
  - andrei_says_ 4y ago
    Where can I get one and how can I verify it is what it says?
    - computerfriend 4y ago
      For USB-A, the pins are physically different.
    - marcosdumay 4y ago
      > Where can I get one Yeah, people usually have the opposite problem. You just search for power-only cable. > how can I verify Plug it into your phone and your computer. None should see the other, but the phone should charge. And then tag it, because having all kinds of cables exactly alike is the worst decision the USB designers ever made.
dboreham 4y ago
Just in time for the phone vendors having fixed all their USB vulnerabilities?
jve 4y ago
I'v been wondering about the implications of free wifis within airports or such - how much that would be of a worry given you connect only to TLS secured services (and hopefully the phone does it too for every service it connects to in background)
- croutonwagon 4y ago
  Personally...I run a Linode VPN with openvpn on it listening on port 443. Anytime I am on an public wifi or untrusted network (including the occaisonal time at my job with a personal device), i connect to that. Since its 443, its generally not blocked, even through the TLS connection is not "standard" because it uses a 2048 bit PSK to as a pre-cursor to start a connection, then a certificate based auth to establish the tunnel. Its a full tunnel as well so all traffic runs through it. Google/Youtube will sometimes pitch fits and make me do captchas but otherwise its an easier way to shield from stuff like that. All the wifi provider sees in that case is a single connection to my linode. Admittedly this is a pretty technical solution though and requires some configuring. Mullvad would probably be an easier option with plenty of endpoints to jump through. Or you can run Tailscale and use SSH/socks proxies, though things like DNS leakage can still occur there. I will use SSH tunnels and socks proxies for certain browsers that are configured to not store any data locally as well (ie: Firefox). I justify it easily in that I am constantly testing services and sometimes its best to rule out routing, BGP or other low level network issues and using ssh -D 12345 somethign@someplace allows me to do just that in isolated circumstances.
  - aaomidi 4y ago
    OpenVPN is a noisy protocol. Every network operator knows you’re on a VPN. Point is, port 443 isn’t really the best way if you dont want to be blocked. You may want to consider stunnel if this ever becomes a problem for you.
    - croutonwagon 4y ago
      The thing is though, im not trying to hide the fact I am on OpenVPN. Simple inspection of the handshake tells you EXACTLY what it is. But thats generally not the issue. The issue is many will simply block UDP or the default port 1194 or basically anything other than a handful of outbound ports, of which 443 outbound is almost never actually blocked for obvious reasons. In fact I cant think of a single time I havent been able to use that VPN, even when my normal road-warrior profile to my house IS blocked. Either way there are ways are ways to mask the fact that its clearly OpenVPN that if your issue is nation-states or things like the Great Firewall like Obfsproxy, but even then, something like Mullvad would be called for since you are likely going to need an array of endpoints. Im just trying to ensure my traffic is running through a trusted source until the point that its supposed to him the open internet. Things like DNS filtering are getting more pervasive. For me that means I want to know the endpoint until I am ready for it to egress. I have also had this setup for years at this point. Before tailscale or even hearing of things like mullvad. But I work in IT, so its one of those things that makes others that dont work in tech look at me funny if they see it.
shiftpgdn 4y ago
If you have a zero day takeover via usb/lightning why would you waste it on public charging infrastructure? That seems ridiculous.
- aaron695 4y ago
  [dead]
- TedDoesntTalk 4y ago
  What other attack vector would you choose?
  - aaomidi 4y ago
    You’d use it to attack the targets you care about rather than just the general public.
    - pc86 4y ago
      The way you attack a specific target without alerting them (or at least making them suspicious) is to attack them indirectly. The sibling comment above is an excellent example of why you might specifically target public infrastructure if you only really care about one person.
  - londons_explore 4y ago
    You could ship the victim malicious USB cables in the mail with amazon branding on the box. Many people would use them, assuming they were just mis-shipped or ordered by their spouse.
    - opwieurposiu 4y ago
      This would totally work on me. My wife is always buying USB cables from amazon, IDK what we do with them all.
      - 4y ago
bookofjoe 4y ago
https://news.ycombinator.com/item?id=35514479 https://news.ycombinator.com/item?id=35514479
paulryanrogers 4y ago
Or at least use a USB condom with voltage protection
- maerF0x0 4y ago
  I mean, if they fry the device I think that's going to both be an acceptable risk (annoying but not breached), and also likely to be detected rapidly -- "Shit my device is fucked, better tell airport staff"
  - michaelt 4y ago
    > likely to be detected rapidly -- "Shit my device is fucked, better tell airport staff" It's not charging - but maybe it was just a problem with that port on your laptop. Better try the charger in every one of your laptop's USB-C ports, just in case....
trinsic2 4y ago
To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-Charging/dp/B07NRDT29J https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...
- shlant 4y ago
  could you just tape over the middle 2 connectors on a regular USB connector?
- tastyfreeze 4y ago
  A USB cable without data lines works too.
  - yellow_postit 4y ago
    Except you are stuck with slower charging speeds. Usually in the places you most want fast charging but have the least trust (random public charging spots) Most users, most of the time, will trade speed for security.
- layer8 4y ago
  Nice. Alas, that will probably also block fast charging on iPhone 15+: https://9to5mac.com/2023/03/20/usb-c-faster-charging-iphone-15-certified-cables/ https://9to5mac.com/2023/03/20/usb-c-faster-charging-iphone-...
  - HeavyFeather 4y ago
    Idea: use a power bank that allows in/out at the same time. It should charge both at high speed while also acting as a firewall. This is also assuming that your powerbank can’t be hacked. In which case, god save us all.
    - rtkwe 4y ago
      It does add a slight extra layer in that they have to both have a compromise for whatever chip is controlling your bank and a compromise for whatever phone is attached which is more difficult to pack into a small controller chip. Although I'm willing to be a lot of power bank controllers are similar across the market which narrows that difficulty.
jrochkind1 4y ago
I'm surprised Schneier says "I am unconvinced". We know (I think?) attackers can apparently easily introduce MitM skimmers to credit card swipers (I _think_ that's how my CC number keeps getting stolen?), possibly even without cooperation of the proprietor? Why not a little invisible injector on a charging port, that seems if anything easier. Or is the skepticism around something else, I guess? Motivation? Lack of consistency over time of attack vectors around software injection via USB making it hard to commodify the attack? Like, there are only temporary zero days now and then which get patched, so this isn't a "cheap" thing to deploy on a wide scale? [edit no idea why i'm getting downvoted on this, perhaps I didn't write it right but I'm legit just curious to hear people's takes on this, what reasons he might have been thinking of to not worry about this...]
- jjulius 4y ago
  >I'm surprised Schneier says "I am unconvinced". And immediately after he says he's unconvinced this is a concern, he states that he does, in fact, carry a tool with him that would protect him in these circumstances.
  - ghaff 4y ago
    In general, you can be unconvinced that various things are actually a meaningful real-world danger, but you choose to mitigate against them anyway if you can do so easily.
    - yencabulator 4y ago
      I think it's very unlikely my car will catch on fire, but I carry a fire extinguisher.
  - krisoft 4y ago
    He also mentions that he only uses said tool with "charging stations I find suspicious". Which is very curious, because I would assume an attacker who is willing to risk burning such an attack would make sure their charging station is looking the least suspicious and most ordinary. I'm not sure if "find suspicious" is a good heuristic here. Although of course we don't know what he bases his suspicion on.
stronglikedan 4y ago
Isn't that what those charge-only cables that don't do data are for?
- rtkwe 4y ago
  Most people don't have those because USB-C Power Delivery requires data pins to negotiate fast charging. I think it's required to get anything beyond the basic 5V .5A power out of a USB socket these days.
  - stronglikedan 4y ago
    Ah, good to know. TIL, thanks! I'll be avoiding those as well then.
imdoor 4y ago
I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?
- HeavyFeather 4y ago
  If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.
  - epups 4y ago
    I don't get it, even after I reset my phone it's still locked, and by default not sharing data via USB. What am I missing?
    - StrangeATractor 4y ago
      https://en.wikipedia.org/wiki/BadUSB https://en.wikipedia.org/wiki/BadUSB
      - upofadown 4y ago
        BadUSB emulates a keyboard. So one would want to make sure that the phone was locked before hooking it up to a random charging port. Android exploit demo here: * https://github.com/caioau/badUSB-Targeting-Android https://github.com/caioau/badUSB-Targeting-Android
    - retrac 4y ago
      > not sharing data via USB USB is a very intelligent protocol, with a microcontrollor on both ends. The controller has access to at least the driver's state, which is usually in the kernel and potentially has access to system memory. How does your Android phone even know that data is an option to switch into when you plug it into a USB port? It has already negotiated itself to be a device on the USB bus. Your phone will probably show up in lsusb on Linux even in charging mode. (Mine does.) When you switch the phone to data mode, it changes its USB device profile, and becomes a more sophisticated attached device, from the host's perspective. Many (most?) phones made in recent years can be USB hosts, too. This lets you connect a USB mouse and keyboard to a tablet, for example. That would open you up to all kinds of pretty simple but often quite effective attacks, like simulating a virtual keyboard and mouse and just manipulating the UI that way. I don't know if any of these particular attacks are possible with Android right now, but many variations on these themes have been shown over the years on many platforms. USB wasn't really designed with adversarial peripherals in mind.
slicktux 4y ago
I usually drill out the data pins on a USB I plan on using for public charging stations…
- londons_explore 4y ago
  Have fun with most devices only charging at 2.5 watts (ie. 6 hours for a full phone charge)...
  - maerF0x0 4y ago
    plz explain. I have something similar to these https://www.amazon.com/OffGrid-Blocker-Unwanted-Transfer-Protect/dp/B07985WW8C/ https://www.amazon.com/OffGrid-Blocker-Unwanted-Transfer-Pro... And it seems to charge quick enough (albeit never timed it)...
    - tzs 4y ago
      The way USB high power charging works is that unless the charger and the device agree on high power the charger just charges at the older pre-high power USB rate. That's why you can plug ancient devices into a high power charger without worry that they will get fried. The way the charger and the device agree on how much power the charger should supply involves the data lines. Thus, if you simply drill out the data lines leaving just the power lines as the person a few comments up suggested a properly functioning high power charger will see your device as only supporting the original USB power spec. I suspect that those things you linked to are active USB devices. The USB port on the charge side has the data lines connected and uses them to negotiate high power from the charger. The USB port on the device side similarly has the data lines connected and uses them to negotiate high power with the device. It protects the device because the data lines on the charger side are not connected to the data lines on the device side.
      - maerF0x0 4y ago
        > It protects the device because the data lines on the charger side are not connected to the data lines on the device side. or so we hope
chiefalchemist 4y ago
Can't the OS have a setting for public charging such that the software can prevent any hardware based shenanigans?
- hellotomyrars 4y ago
  iOS attempts to do this but if we’re following the assumption of such an attack it would just be seen as a step in the chain of the attack. I think the likelihood of an attack via this method is incredibly low personally. Though I always have a power bank on hand, not for security, but for convenience. Much more preferable to the physical limitations of a wall outlet.
mtillman 4y ago
It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.
- cuttysnark 4y ago
  > common knowledge to never use public chargers Perhaps here on HN. Most people will plug their smartphone into any accepting receptacle. trains, airplanes, NYC SmartLink, or ask the bartender if they can plug it in behind the bar. I still carry a DIY Altoids charger that takes a 9V battery (pulled down to proper volts for iPhone). In a battery emergency, my phone is simply on life support and I don't have to look for outlets that might also include a zero-day.
  - TheNewsIsHere 4y ago
    I try to always travel with a “USB data condom”. The one I have is called a “PortaPow”, and it’s red. It was about $10 on Amazon and it’s a great investment for scenarios where I _reasonably_ trust a power-only USB port not to have been tampered with, like the built in ports on aircraft.
    - beefield 4y ago
      I have thought a power bank would be a good enough condom - for my threat vectors, that is.
    - cuttysnark 4y ago
      > _reasonably_ trust a power-only USB ... like the built in ports on aircraft. I'm with you, this might fall under "safe". Then again, from threads posted here and elsewhere, and through personal investigation...the infotainment systems on airplanes are an absolute disaster with regards to security and software design. They're often part of the same system as the provided USB ports. While the risk is small, there's nothing stopping 1 person from running a script that exploits some flaw in the outdated Linux distro the airline is using to manage their in-flight entertainment. There's also a chance I'm paranoid and spend too much time here, but I'm gonna stick with my Altoids.
mfer 4y ago
When I see this I wonder, is the FBI warning us about something the CIA or NSA are doing?
- mywittyname 4y ago
  The FBI investigates industrial cybercrime. They are more likely reporting on what they see in the wild. And it's probably coincidence if the other TLAs are using the techniques.
CharlesW 4y ago
I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?
- WakoMan12 4y ago
  [dead]
- enguinq123 4y ago
  Anecdotally, I have had a previous iphone infected by using a public charging station at SFO a few years ago.
  - ghostpepper 4y ago
    Can you elaborate on this? What kind of phone? Android or iOS? Fully patched? What kind of infection? How did you discover it? How did you get rid of it?
    - kevviiinn 4y ago
      I bet their iphone was running android
      - Alupis 4y ago
        There have been many jailbreaks available that only required plugging the phone in and running some program on the other end of the cable. There's been jailbreaks where all you needed to do was visit a website... Apple's security isn't as bullet-proof as some make it out to be. So, is it plausible a malicious charging station could gain root and sideload something nefarious on an iPhone? Absolutely. Particularly for non-tech-savvy folks desperate to get a charge before their connecting flight... Has it happened? ...No idea. I guess that's where the anecdotes come in...
rednerrus 4y ago
I carry a tiny USB battery that I can plug into these public phone charging stations.
pluralistic 4y ago
how much data can be transfered using usb cable? real usage per second, per minute, not theoretical can the charging stations resume data transfer if i unplug and replug at random times ? i dunno, when i want to dump gb of data from my phone, it takes hours ... so yeah maybe i should stay at a random charging station for hours to ensure all data transfered :D
- nso 4y ago
  Maybe you would stay connected that lone at say, a business lounge waiting for a plane.
Anechoic 4y ago
Presumably pair-locking still works to mitigate against evil chargers? https://reincubate.com/support/how-to/pair-lock-supervise-iphone/ https://reincubate.com/support/how-to/pair-lock-supervise-ip...
mancerayder 4y ago
Anker batteries come in a zillion sizes, are cheap and are safe to plug into public chargers. With how hungry phones are these days, I don't know how people live without portable batteries.
- brianwawok 4y ago
  It is almost impossible to drain my iPhone to 0 unless I am doing something really unhealthy, like staring at it for 10 hours. I take a charger with me on trips so I can charge over night, but otherwise.. it's literally not possible in my reasonable life to run my phone out of juice. Back when I used android, it was much more common that runaway apps would drain my phone in 2 hours. But now? Doing a anker battery would be lugging around a bunch of dead weight.
  - iLoveOncall 4y ago
    Just go on a trip where you use your GPS a lot and take pictures with your phone and it will last half a day at best.
    - ghaff 4y ago
      Especially if your phone isn't new and doesn't hold quite as much charge any longer. I've definitely ended up plugging my phone into a portable battery when traveling. But usually if I'm out and about and using GPS and camera a lot, I'll have some sort of small bag with me for water, snack, additional clothing, etc. anyway so easy to throw a battery and cable in.
      - jstarfish 4y ago
        Some of them are solar-equipped or have hand-cranks for emergency charging. Usually a built-in flashlight too.
    - jahewson 4y ago
      Why would GPS use more power? It’s only receiving.
qwertox 4y ago
There are small adapters which disconnect the data lines. I use one of those to connect my phone to my car so that it only charges but avoids my car to want to add it as an external storage for the entertainment system.
- jameswryan 4y ago
  That isn't sufficient to protect you on a charger you don't control: https://www.usenix.org/conference/usenixsecurity21/presentation/cronin https://www.usenix.org/conference/usenixsecurity21/presentat...
naattee 4y ago
I was always suspect of those public charging things, especially the ones that you leave you phone unattended or "locked" in a box.
tedunangst 4y ago
Also remember to check your Halloween candy for razor blades.
karmakaze 4y ago
USB-C uses data to negotiate charging. A dumb USB type-A cable with no data wires would be safe against bad data.
- IX-103 4y ago
  USB in general specifies negotiation for charging, regardless of the connector. But most chargers are too lazy to implement the negotiation and instead just always provide their maximum amperage, so something with no data wires should work regardless.
rtkwe 4y ago
Has there been any kind of attack actually detected that goes through this vector? This has been infosec lore for as long as USB charging and smart phones have been a thing but I've never really heard of it actually being used.
- provenance 4y ago
  There is indeed a cheap product that does exactly this: https://o.mg.lol/ https://o.mg.lol/
  - rtkwe 4y ago
    I mean as an actual attack not a product that could execute a similar attack. IE an instance where a public charger has been detected or caught attempting to infect phones.
api 4y ago
I've heard the somewhat-NSFW term "USB glory hole" for these.
toxicpants 4y ago
PortaPow[1] makes a great adapter that will only connect the power pins in the USB connection. [1] http://portablepowersupplies.co.uk/ http://portablepowersupplies.co.uk/
ajsnigrutin 4y ago
But how? Most devices are charge-only by default, most users have USB debugging disabled, and those who know how to enable it, won't allow the adb server to connect to the phone (you have to explicitly give it permission).
- dataflow 4y ago
  I don't know how this is done, but not everything USB connected is assumed to be a charger. For example the 2FA hardware tokens aren't assumed to be chargers by default. So I imagine this might be done by faking a different device.
  - wongarsu 4y ago
    The malicious charger can pretend to be keyboard, mouse and screen, and just remote control the phone. Or just a keyboard, if you want to an easier implementation. At least Android phones are completely usable this way, with universal keyboard/mouse support and widespread USB-C display support. Without any confirmation steps.
    - dataflow 4y ago
      If a keyboard is the attack vector, what I don't get is: why not suggest people lock their phones and charge them when they're locked? Or maybe even shut them down and charge them before booting. Is there any reason not to suggest those? It certainly seems more practical than telling people they're out of luck, unless there are other attack vectors - in which case, what are they?
      - jerlam 4y ago
        Most people use public charging ports are the same ones who want to use their phone while charging. Physical security is also a consideration, I wouldn't really suggest that people leave their phones plugged into the wall in a public or semi-public place.
    - amelius 4y ago
diziet 4y ago
I suggest to get data blockers like this: https://www.amazon.com/PortaPow-NA-USB-C-Data-Blocker/dp/B082WDHS22/ https://www.amazon.com/PortaPow-NA-USB-C-Data-Blocker/dp/B08...
- Tagbert 4y ago
  Yes, I use something similar. I keep one in my travel bag, just in case.
GartzenDeHaes 4y ago
Also, programmable USB HID devices https://shop.hak5.org/products/usb-rubber-ducky https://shop.hak5.org/products/usb-rubber-ducky
tristor 4y ago
I don't use public chargers, and I use USB condoms for charging my devices even with chargers I own, because basically all the charging devices are made in untrustable supply chains. I thought this was common knowledge, and basically what everyone is doing. Wireless charging helps a lot with this, and I now prefer wireless charging whenever possible. The only devices I connect my devices to using USB are computers I control, I don't cross-contaminate between computers (e.g. anything plugged into my work laptop will never be plugged into a personal system, and vice versa). This is just basic hardware op-sec with USB.
- dehrmann 4y ago
  > USB condoms I have one of these. I like that I can look in it and see that it has no data pins > Wireless I know you meant charging, but for data, with some of the spy cables out there with embedded chips and wireless access, it's ironic that wireless is in some ways more secure.
  - marcosdumay 4y ago
    The wireless charging port is an specialized one. That's why it's more secure. The wireless data transfer options vary from "it's broken, forget about it" to actually quite secure, but the charging isn't done through them. When people decided to use USB for everything, well, they had to make USB support every use case.
  - meling 4y ago
    Not all usb condoms show the connections. I got one from a well-known vendor at a conference. Seems like an easier attack vector to create and sell malware infested usb condoms…
- MisterTea 4y ago
  > I thought this was common knowledge, and basically what everyone is doing. No. Not even close.
vlod 4y ago
If I power off my phone, I assume it will be okay?
- adastra22 4y ago
  No.
kerkeslager 4y ago
This is like abstinence-only education. Use a USB condom: https://www.zdnet.com/article/protect-your-data-with-a-usb-condom/ https://www.zdnet.com/article/protect-your-data-with-a-usb-c...
- Kwpolska 4y ago
  The use of public chargers is easy to avoid with some basic planning and awareness of your phone's battery habits.
  - kerkeslager 4y ago
    So? You know what's easier than basic planning and awareness of my phone's battery habits? Not avoiding public chargers.
jFriedensreich 4y ago
pro tip: if absolutely necessary at least only charge your power bank on a public charger and then charge the phone on the power bank but not at the same time.
- pageandrew 4y ago
  Is it even theoretically possible to have data passthrough a power bank? I don’t know much about USB, but I’d imagine that only the power delivery pins are connected to anything, right?
stametseater 4y ago
We badly need a DC electrical plug/jack standard that doesn't play double-duty as a data transmission standard. Innumerable small appliances and devices use DC power, solar panels make DC power, yet if you want to charge such devices you have to go through a DC->AC->DC conversion, or use USB which can evidently pwn your devices. What a sorry state of affairs.
ta1243 4y ago
I stopped paying attention to FBI warnings when they spammed my legal dvds. Meanwhile my downloads came with none of those warnings.
tzs 4y ago
I've come to think that whatever eventually replaces USB should add some separation between power and data. Let's call it MSB (Multiversal Serial Bus). Maybe something like this. MSB would define 2 connectors: a data connector and a power connector. MSB would also specify that if you have both data and power connectors they should be physically laid out in data/power pairs and would define the spacing/positioning (e.g., the power connector should be parallel to the data connector 2 mm apart with the power connector above the data connector). The idea behind the layout specification is that for applications that need both the power and data connectors you could make cables that include both, with the housing at the ends holding the two connectors fixed so they can treated as a unit when it comes to plugging into things. The power port would include data line, but they are just used for power negotiation. The data port would include power, but just a fixed voltage and max current, comparable to pre-high power USB, so for low power peripherals you would just need to use a data port. I.e., for low power peripherals it is pretty much just like USB.
- sacrosancty 4y ago
  That's pretty much USB3-A isn't it? High speed data is separate from power and low speed data. You can have connectors with just one or the other. Anyway, the world will be worse place with just incremental incompatible tweaks to the so-called "universal" connectors so that they're never universal because of churn. Hopefully USB-C is the end of the line forever, whatever its flaws might be.
- i_am_jl 4y ago
  Why not offload this to the device? Why doesn't my device today have an option that allows me to set the USB port to "power only"?
  - mr_mitm 4y ago
    My Android does that. And at least with thunderbolt I can enable thunderbolt security on my laptop, which essentially does that.
  - Tommstein 4y ago
    Because you don't have an Android? I don't remember the last one I had that didn't have that setting, if ever.
bkeating 4y ago
Go, Mike!

257 points by mikece 4y ago

“Dear citizens, please be wary of attacks on your devices designed to compromise your privacy and personal information. It would be unfortunate if we had competition in the game.”

rtkwe 4y ago
It's always been a competing priorities inside the government between groups improving security so that commerce and secrets stay secret and safe and other groups who's priorities are more generalized security that would love to snoop into everyone all the time.

chaorace 4y ago

Just FYI: this is referring to USB charging stations, not EV stations. This advice has been standard in cybersecurity training for a long time now and frankly I'm surprised that this is the first time the FBI has felt the need to issue an advisory on the subject.

LinuxBender 4y ago
I have been somewhat curious if/when this will occur with EV stations as well. What controls might one gain over a car from the charging port on the assorted makes/models? Even hacking aside I am curious what PII, telemetry and tracking data could be pulled from the charge port.
- i-am-gizm0 4y ago
  At least on AC Level 1/2 charging (using just a J1772 port) the signalling is pretty rudimentary if I remember correctly. Something along the lines of the car puts out a square wave on one of the signalling pins and based on the resistance it sees it knows whether it's plugged in and how much power it can charge, so there isn't much room (dare I say any) way to interact much with the car through that port. I don't know how DC charging works but I assume there's a little bit more smarts to it. Tesla on the other hand is a completely different story.
  - rtkwe 4y ago
    The really high voltage fast chargers as far as I understand them connect directly to the battery bypassing the cars battery charger to directly charge the battery not sure how much communication there is on those channels though.
    - vegardx 4y ago
      You're probably thinking about the on-board inverter, it's often referred to as a battery charger. The battery management system is entirely within the car, and the car will tell what voltage and amperage to deliver to it. The design of CCS2 is actually quite nice. There are pins for singalling that, if broken, will immediately shut down power delivery. This means that you can just pull the cable out safely, without risking arcing or electrocuting yourself.
      - rtkwe 4y ago
        My understanding was it also bypassed the BMS but I may have confused what they were saying it's been a minute.
  - rlpb 4y ago
    When I've done DC rapid charging on my Leaf, I noticed that the charger knew the battery percentage reported by the car. That seems likely to be digital signalling to me, so suddenly there's the risk of buffer overflows and suchlike. I've not seen this on AC, but when I looked into this previously I got the impression that there exists a digital signalling protocol established by modulating something ignored by older cars and chargers that can be optionally supported. If that's the case then there's potentially attack surface there, too.
    - fnordpiglet 4y ago
      That’s why I only buy cars written in rust.
      - 4y ago
- Forbo 4y ago
  Even if it's not available via the charger they'll just do this with ALPR or their proprietary apps. Gotta love surveillance capitalism.
- judge2020 4y ago
  The CCS standard has "HLC - High Level Communication", which is available for both AC and DC charging. While i'm not interested in paying $700 for ISO 15118, I imagine clients [cars] are set up to break the current flow if anything out of the ordinary happens or if the input power doesn't match what the station is saying it's sending in an instant.
- 13of40 4y ago
  I wonder if dealerships and other auto shops behave like every other company today, and when they plug into your OBD2 port they just hoover up as much data as they can and sell it off.
causi 4y ago
Seriously need an edited title then. Original title is wildly misleading.
- hinata08 4y ago
  I thought it was a wild clickbait and didn't even go to read the article. I read it as "EVs are dangerous according to the FBI, use V12 engines to avoid hackers" but yeah, public charging stations *for phones* are terrible. I used one of them once at a conference, with ADB enabled on my phone. I thought it would just feed me power, as not data collection was specified on the station. but it enabled a data connection. So I used a public station once, and I'll never do it again.
- dwringer 4y ago
  I agree - the only "public charging stations" I see on any kind of regular basis are EV charging stations. It's been a couple of decades since I remember seeing a USB one, not that I doubt their existence.
  - ghaff 4y ago
    They're ubiquitous at conferences and in many trains, planes, airports, hotels, etc. Maybe you mean something different by public but USB charging stations that you don't control are very common especially in the context of places travelers are in. They're probably pretty common in schools, libraries, conference rooms, etc. as well.
  - TillE 4y ago
    They're in basically every major airport, as well as most modern airplanes.
mcculley 4y ago
It is not the first time the FBI has warned about this (see [0] for example, or do a Google search with date filters). This is the Denver field office maximizing Twitter engagement by repeating themselves. (Maybe that is not a fair way to view it, maybe the FBI should repeat advisories often.) [0]: https://www.fbi.gov/contact-us/field-offices/portland/news/press-releases/oregon-fbi-tech-tuesday-building-a-digital-defense-against-juice-jacking https://www.fbi.gov/contact-us/field-offices/portland/news/p...
giancarlostoro 4y ago
The moment I first saw one I knew something was wrong.

manishsharan 4y ago

There are USB "condom" cables available which do not have data wire. https://www.zdnet.com/article/protect-your-data-with-a-usb-condom/ https://www.zdnet.com/article/protect-your-data-with-a-usb-c... I don't have those; I just charge my portable battery first and then charge my devices from the battery.

SketchySeaBeast 4y ago
But then your phone will have been with every port your battery pack has been with! An alternative is also a power only USB cable, just because I feel like I'm less likely to lose a whole cable than a "condom".
- hibbelig 4y ago
  > But then your phone will have been with every port your battery pack has been with! It's unclear to me what this means. I thought it works like this: - Connect battery pack to USB port - USB port tries to hack the battery pack, but it's too dumb, so the attempt goes nowhere. The charge flows nicely, though. - Disconnect battery pack from USB port - Connect device to battery pack
  - SketchySeaBeast 4y ago
    Oh, it was strictly a joke that was stretching the condom/STI metaphor.
  - palata 4y ago
    > USB port tries to hack the battery pack, but it's too dumb Are you certain it is?
LegitShady 4y ago
I haven't seen many of those data blockers that support quick charge and thats pretty important when using some kind of public charging station. I, like you, charge a portable battery that can refill my phone 2-3x without issue.

hprotagonist 4y ago

badUSB is what, nearly 20 years old now? i distinctly remember making usb condoms a long time ago, anyway, and have never trusted public usb slots anyway.

ineedtocall 4y ago
I had to look that age up. You're right, ~19 years ago[1] badUSB made its debut. Another fun toy is the USB Gadget Kernel module. I've been running yolo + mouse/keyboard emulation on a raspberry pi to make horrible aim bots. 1. https://en.wikipedia.org/wiki/BadUSB https://en.wikipedia.org/wiki/BadUSB

RcouF1uZ4gsC 4y ago

This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.

moritonal 4y ago
Firstly, I believe the QI scheme includes a process for communication, mostly restricted to "how much power should I send" for now, but it's obvious this will be expanded to more functionality as people basically replicate NFC over it. Second, I'm still waiting to see a QI charger than just pumps 100W of power straight through any piece of metal above it. Don't know what would happen, but I naively imagine forced induction would brick most devices.
- spacetime_cmplx 4y ago
  >I'm still waiting to see a QI charger than just pumps 100W of power straight through any piece of metal above it A charger so good it's the last time you'll need to charge
- im3w1l 4y ago
  Hard disagree. If physical proximity was all it took to compromise a phone everyone would immediately protest. USB requires an active action. Blaming the user is still wrong, it really should be safe to charge in a mall or get a file from your friends usb stick. But it's less obvious so here we are.
- amluto 4y ago
  As I understand it, Qi has a digital communication channel from the phone to the charger but no digital communication from charger to phone. So any exploit over Qi would have to somehow compromise the phone’s charging system with just analog field variations (frequency, field strength, or whatever else the phone measures).
JustSomeNobody 4y ago
Only need a 6 hour layover to take full advantage.

fouc 4y ago

I guess we should also avoid plugging our phone into the USB ports on airplane seats?

hprotagonist 4y ago
that should go without saying: yes, you should avoid doing that.
expertentipp 4y ago
The race of media, ad, and other companies for one's attention and data is brutal. Especially when one is stuck in a seat for hours and only has a back of another seat in front of their face.
- maerF0x0 4y ago
  I've often wondered about this. Is $AIRLINE selling the traffic data? I wonder how much $NSFW is being consumed on planes?
kfajdsl 4y ago
You can use a power only cable.
- andrei_says_ 4y ago
  Where can I get one and how can I verify it is what it says?
  - computerfriend 4y ago
    For USB-A, the pins are physically different.
  - marcosdumay 4y ago
    > Where can I get one Yeah, people usually have the opposite problem. You just search for power-only cable. > how can I verify Plug it into your phone and your computer. None should see the other, but the phone should charge. And then tag it, because having all kinds of cables exactly alike is the worst decision the USB designers ever made.

dboreham 4y ago

Just in time for the phone vendors having fixed all their USB vulnerabilities?

jve 4y ago

I'v been wondering about the implications of free wifis within airports or such - how much that would be of a worry given you connect only to TLS secured services (and hopefully the phone does it too for every service it connects to in background)

croutonwagon 4y ago
Personally...I run a Linode VPN with openvpn on it listening on port 443. Anytime I am on an public wifi or untrusted network (including the occaisonal time at my job with a personal device), i connect to that. Since its 443, its generally not blocked, even through the TLS connection is not "standard" because it uses a 2048 bit PSK to as a pre-cursor to start a connection, then a certificate based auth to establish the tunnel. Its a full tunnel as well so all traffic runs through it. Google/Youtube will sometimes pitch fits and make me do captchas but otherwise its an easier way to shield from stuff like that. All the wifi provider sees in that case is a single connection to my linode. Admittedly this is a pretty technical solution though and requires some configuring. Mullvad would probably be an easier option with plenty of endpoints to jump through. Or you can run Tailscale and use SSH/socks proxies, though things like DNS leakage can still occur there. I will use SSH tunnels and socks proxies for certain browsers that are configured to not store any data locally as well (ie: Firefox). I justify it easily in that I am constantly testing services and sometimes its best to rule out routing, BGP or other low level network issues and using ssh -D 12345 somethign@someplace allows me to do just that in isolated circumstances.
- aaomidi 4y ago
  OpenVPN is a noisy protocol. Every network operator knows you’re on a VPN. Point is, port 443 isn’t really the best way if you dont want to be blocked. You may want to consider stunnel if this ever becomes a problem for you.
  - croutonwagon 4y ago
    The thing is though, im not trying to hide the fact I am on OpenVPN. Simple inspection of the handshake tells you EXACTLY what it is. But thats generally not the issue. The issue is many will simply block UDP or the default port 1194 or basically anything other than a handful of outbound ports, of which 443 outbound is almost never actually blocked for obvious reasons. In fact I cant think of a single time I havent been able to use that VPN, even when my normal road-warrior profile to my house IS blocked. Either way there are ways are ways to mask the fact that its clearly OpenVPN that if your issue is nation-states or things like the Great Firewall like Obfsproxy, but even then, something like Mullvad would be called for since you are likely going to need an array of endpoints. Im just trying to ensure my traffic is running through a trusted source until the point that its supposed to him the open internet. Things like DNS filtering are getting more pervasive. For me that means I want to know the endpoint until I am ready for it to egress. I have also had this setup for years at this point. Before tailscale or even hearing of things like mullvad. But I work in IT, so its one of those things that makes others that dont work in tech look at me funny if they see it.

shiftpgdn 4y ago

If you have a zero day takeover via usb/lightning why would you waste it on public charging infrastructure? That seems ridiculous.

aaron695 4y ago
[dead]
TedDoesntTalk 4y ago
What other attack vector would you choose?
- aaomidi 4y ago
  You’d use it to attack the targets you care about rather than just the general public.
  - pc86 4y ago
    The way you attack a specific target without alerting them (or at least making them suspicious) is to attack them indirectly. The sibling comment above is an excellent example of why you might specifically target public infrastructure if you only really care about one person.
- londons_explore 4y ago
  You could ship the victim malicious USB cables in the mail with amazon branding on the box. Many people would use them, assuming they were just mis-shipped or ordered by their spouse.
  - opwieurposiu 4y ago
    This would totally work on me. My wife is always buying USB cables from amazon, IDK what we do with them all.
    - 4y ago

bookofjoe 4y ago

https://news.ycombinator.com/item?id=35514479 https://news.ycombinator.com/item?id=35514479

paulryanrogers 4y ago

Or at least use a USB condom with voltage protection

maerF0x0 4y ago
I mean, if they fry the device I think that's going to both be an acceptable risk (annoying but not breached), and also likely to be detected rapidly -- "Shit my device is fucked, better tell airport staff"
- michaelt 4y ago
  > likely to be detected rapidly -- "Shit my device is fucked, better tell airport staff" It's not charging - but maybe it was just a problem with that port on your laptop. Better try the charger in every one of your laptop's USB-C ports, just in case....

trinsic2 4y ago

To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-Charging/dp/B07NRDT29J https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...

shlant 4y ago
could you just tape over the middle 2 connectors on a regular USB connector?
tastyfreeze 4y ago
A USB cable without data lines works too.
- yellow_postit 4y ago
  Except you are stuck with slower charging speeds. Usually in the places you most want fast charging but have the least trust (random public charging spots) Most users, most of the time, will trade speed for security.
layer8 4y ago
Nice. Alas, that will probably also block fast charging on iPhone 15+: https://9to5mac.com/2023/03/20/usb-c-faster-charging-iphone-15-certified-cables/ https://9to5mac.com/2023/03/20/usb-c-faster-charging-iphone-...
- HeavyFeather 4y ago
  Idea: use a power bank that allows in/out at the same time. It should charge both at high speed while also acting as a firewall. This is also assuming that your powerbank can’t be hacked. In which case, god save us all.
  - rtkwe 4y ago
    It does add a slight extra layer in that they have to both have a compromise for whatever chip is controlling your bank and a compromise for whatever phone is attached which is more difficult to pack into a small controller chip. Although I'm willing to be a lot of power bank controllers are similar across the market which narrows that difficulty.

jrochkind1 4y ago

I'm surprised Schneier says "I am unconvinced". We know (I think?) attackers can apparently easily introduce MitM skimmers to credit card swipers (I _think_ that's how my CC number keeps getting stolen?), possibly even without cooperation of the proprietor? Why not a little invisible injector on a charging port, that seems if anything easier. Or is the skepticism around something else, I guess? Motivation? Lack of consistency over time of attack vectors around software injection via USB making it hard to commodify the attack? Like, there are only temporary zero days now and then which get patched, so this isn't a "cheap" thing to deploy on a wide scale? [edit no idea why i'm getting downvoted on this, perhaps I didn't write it right but I'm legit just curious to hear people's takes on this, what reasons he might have been thinking of to not worry about this...]

jjulius 4y ago
>I'm surprised Schneier says "I am unconvinced". And immediately after he says he's unconvinced this is a concern, he states that he does, in fact, carry a tool with him that would protect him in these circumstances.
- ghaff 4y ago
  In general, you can be unconvinced that various things are actually a meaningful real-world danger, but you choose to mitigate against them anyway if you can do so easily.
  - yencabulator 4y ago
    I think it's very unlikely my car will catch on fire, but I carry a fire extinguisher.
- krisoft 4y ago
  He also mentions that he only uses said tool with "charging stations I find suspicious". Which is very curious, because I would assume an attacker who is willing to risk burning such an attack would make sure their charging station is looking the least suspicious and most ordinary. I'm not sure if "find suspicious" is a good heuristic here. Although of course we don't know what he bases his suspicion on.

stronglikedan 4y ago

Isn't that what those charge-only cables that don't do data are for?

rtkwe 4y ago
Most people don't have those because USB-C Power Delivery requires data pins to negotiate fast charging. I think it's required to get anything beyond the basic 5V .5A power out of a USB socket these days.
- stronglikedan 4y ago
  Ah, good to know. TIL, thanks! I'll be avoiding those as well then.

imdoor 4y ago

I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?

HeavyFeather 4y ago
If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.
- epups 4y ago
  I don't get it, even after I reset my phone it's still locked, and by default not sharing data via USB. What am I missing?
  - StrangeATractor 4y ago
    https://en.wikipedia.org/wiki/BadUSB https://en.wikipedia.org/wiki/BadUSB
    - upofadown 4y ago
      BadUSB emulates a keyboard. So one would want to make sure that the phone was locked before hooking it up to a random charging port. Android exploit demo here: * https://github.com/caioau/badUSB-Targeting-Android https://github.com/caioau/badUSB-Targeting-Android
  - retrac 4y ago
    > not sharing data via USB USB is a very intelligent protocol, with a microcontrollor on both ends. The controller has access to at least the driver's state, which is usually in the kernel and potentially has access to system memory. How does your Android phone even know that data is an option to switch into when you plug it into a USB port? It has already negotiated itself to be a device on the USB bus. Your phone will probably show up in lsusb on Linux even in charging mode. (Mine does.) When you switch the phone to data mode, it changes its USB device profile, and becomes a more sophisticated attached device, from the host's perspective. Many (most?) phones made in recent years can be USB hosts, too. This lets you connect a USB mouse and keyboard to a tablet, for example. That would open you up to all kinds of pretty simple but often quite effective attacks, like simulating a virtual keyboard and mouse and just manipulating the UI that way. I don't know if any of these particular attacks are possible with Android right now, but many variations on these themes have been shown over the years on many platforms. USB wasn't really designed with adversarial peripherals in mind.

slicktux 4y ago

I usually drill out the data pins on a USB I plan on using for public charging stations…

londons_explore 4y ago
Have fun with most devices only charging at 2.5 watts (ie. 6 hours for a full phone charge)...
- maerF0x0 4y ago
  plz explain. I have something similar to these https://www.amazon.com/OffGrid-Blocker-Unwanted-Transfer-Protect/dp/B07985WW8C/ https://www.amazon.com/OffGrid-Blocker-Unwanted-Transfer-Pro... And it seems to charge quick enough (albeit never timed it)...
  - tzs 4y ago
    The way USB high power charging works is that unless the charger and the device agree on high power the charger just charges at the older pre-high power USB rate. That's why you can plug ancient devices into a high power charger without worry that they will get fried. The way the charger and the device agree on how much power the charger should supply involves the data lines. Thus, if you simply drill out the data lines leaving just the power lines as the person a few comments up suggested a properly functioning high power charger will see your device as only supporting the original USB power spec. I suspect that those things you linked to are active USB devices. The USB port on the charge side has the data lines connected and uses them to negotiate high power from the charger. The USB port on the device side similarly has the data lines connected and uses them to negotiate high power with the device. It protects the device because the data lines on the charger side are not connected to the data lines on the device side.
    - maerF0x0 4y ago
      > It protects the device because the data lines on the charger side are not connected to the data lines on the device side. or so we hope

chiefalchemist 4y ago

Can't the OS have a setting for public charging such that the software can prevent any hardware based shenanigans?

hellotomyrars 4y ago
iOS attempts to do this but if we’re following the assumption of such an attack it would just be seen as a step in the chain of the attack. I think the likelihood of an attack via this method is incredibly low personally. Though I always have a power bank on hand, not for security, but for convenience. Much more preferable to the physical limitations of a wall outlet.

mtillman 4y ago

It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.

cuttysnark 4y ago
> common knowledge to never use public chargers Perhaps here on HN. Most people will plug their smartphone into any accepting receptacle. trains, airplanes, NYC SmartLink, or ask the bartender if they can plug it in behind the bar. I still carry a DIY Altoids charger that takes a 9V battery (pulled down to proper volts for iPhone). In a battery emergency, my phone is simply on life support and I don't have to look for outlets that might also include a zero-day.
- TheNewsIsHere 4y ago
  I try to always travel with a “USB data condom”. The one I have is called a “PortaPow”, and it’s red. It was about $10 on Amazon and it’s a great investment for scenarios where I _reasonably_ trust a power-only USB port not to have been tampered with, like the built in ports on aircraft.
  - beefield 4y ago
    I have thought a power bank would be a good enough condom - for my threat vectors, that is.
  - cuttysnark 4y ago
    > _reasonably_ trust a power-only USB ... like the built in ports on aircraft. I'm with you, this might fall under "safe". Then again, from threads posted here and elsewhere, and through personal investigation...the infotainment systems on airplanes are an absolute disaster with regards to security and software design. They're often part of the same system as the provided USB ports. While the risk is small, there's nothing stopping 1 person from running a script that exploits some flaw in the outdated Linux distro the airline is using to manage their in-flight entertainment. There's also a chance I'm paranoid and spend too much time here, but I'm gonna stick with my Altoids.

mfer 4y ago

When I see this I wonder, is the FBI warning us about something the CIA or NSA are doing?

mywittyname 4y ago
The FBI investigates industrial cybercrime. They are more likely reporting on what they see in the wild. And it's probably coincidence if the other TLAs are using the techniques.

CharlesW 4y ago

I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?

WakoMan12 4y ago
[dead]
enguinq123 4y ago
Anecdotally, I have had a previous iphone infected by using a public charging station at SFO a few years ago.
- ghostpepper 4y ago
  Can you elaborate on this? What kind of phone? Android or iOS? Fully patched? What kind of infection? How did you discover it? How did you get rid of it?
  - kevviiinn 4y ago
    I bet their iphone was running android
    - Alupis 4y ago
      There have been many jailbreaks available that only required plugging the phone in and running some program on the other end of the cable. There's been jailbreaks where all you needed to do was visit a website... Apple's security isn't as bullet-proof as some make it out to be. So, is it plausible a malicious charging station could gain root and sideload something nefarious on an iPhone? Absolutely. Particularly for non-tech-savvy folks desperate to get a charge before their connecting flight... Has it happened? ...No idea. I guess that's where the anecdotes come in...

rednerrus 4y ago

I carry a tiny USB battery that I can plug into these public phone charging stations.

pluralistic 4y ago

how much data can be transfered using usb cable? real usage per second, per minute, not theoretical can the charging stations resume data transfer if i unplug and replug at random times ? i dunno, when i want to dump gb of data from my phone, it takes hours ... so yeah maybe i should stay at a random charging station for hours to ensure all data transfered :D

nso 4y ago
Maybe you would stay connected that lone at say, a business lounge waiting for a plane.

Anechoic 4y ago

Presumably pair-locking still works to mitigate against evil chargers? https://reincubate.com/support/how-to/pair-lock-supervise-iphone/ https://reincubate.com/support/how-to/pair-lock-supervise-ip...

mancerayder 4y ago

Anker batteries come in a zillion sizes, are cheap and are safe to plug into public chargers. With how hungry phones are these days, I don't know how people live without portable batteries.

brianwawok 4y ago
It is almost impossible to drain my iPhone to 0 unless I am doing something really unhealthy, like staring at it for 10 hours. I take a charger with me on trips so I can charge over night, but otherwise.. it's literally not possible in my reasonable life to run my phone out of juice. Back when I used android, it was much more common that runaway apps would drain my phone in 2 hours. But now? Doing a anker battery would be lugging around a bunch of dead weight.
- iLoveOncall 4y ago
  Just go on a trip where you use your GPS a lot and take pictures with your phone and it will last half a day at best.
  - ghaff 4y ago
    Especially if your phone isn't new and doesn't hold quite as much charge any longer. I've definitely ended up plugging my phone into a portable battery when traveling. But usually if I'm out and about and using GPS and camera a lot, I'll have some sort of small bag with me for water, snack, additional clothing, etc. anyway so easy to throw a battery and cable in.
    - jstarfish 4y ago
      Some of them are solar-equipped or have hand-cranks for emergency charging. Usually a built-in flashlight too.
  - jahewson 4y ago
    Why would GPS use more power? It’s only receiving.

qwertox 4y ago

There are small adapters which disconnect the data lines. I use one of those to connect my phone to my car so that it only charges but avoids my car to want to add it as an external storage for the entertainment system.

jameswryan 4y ago
That isn't sufficient to protect you on a charger you don't control: https://www.usenix.org/conference/usenixsecurity21/presentation/cronin https://www.usenix.org/conference/usenixsecurity21/presentat...

naattee 4y ago

I was always suspect of those public charging things, especially the ones that you leave you phone unattended or "locked" in a box.

tedunangst 4y ago

Also remember to check your Halloween candy for razor blades.

karmakaze 4y ago

USB-C uses data to negotiate charging. A dumb USB type-A cable with no data wires would be safe against bad data.

IX-103 4y ago
USB in general specifies negotiation for charging, regardless of the connector. But most chargers are too lazy to implement the negotiation and instead just always provide their maximum amperage, so something with no data wires should work regardless.

rtkwe 4y ago

Has there been any kind of attack actually detected that goes through this vector? This has been infosec lore for as long as USB charging and smart phones have been a thing but I've never really heard of it actually being used.

provenance 4y ago
There is indeed a cheap product that does exactly this: https://o.mg.lol/ https://o.mg.lol/
- rtkwe 4y ago
  I mean as an actual attack not a product that could execute a similar attack. IE an instance where a public charger has been detected or caught attempting to infect phones.

api 4y ago

I've heard the somewhat-NSFW term "USB glory hole" for these.

toxicpants 4y ago

PortaPow[1] makes a great adapter that will only connect the power pins in the USB connection. [1] http://portablepowersupplies.co.uk/ http://portablepowersupplies.co.uk/

ajsnigrutin 4y ago

But how? Most devices are charge-only by default, most users have USB debugging disabled, and those who know how to enable it, won't allow the adb server to connect to the phone (you have to explicitly give it permission).

dataflow 4y ago
I don't know how this is done, but not everything USB connected is assumed to be a charger. For example the 2FA hardware tokens aren't assumed to be chargers by default. So I imagine this might be done by faking a different device.
- wongarsu 4y ago
  The malicious charger can pretend to be keyboard, mouse and screen, and just remote control the phone. Or just a keyboard, if you want to an easier implementation. At least Android phones are completely usable this way, with universal keyboard/mouse support and widespread USB-C display support. Without any confirmation steps.
  - dataflow 4y ago
    If a keyboard is the attack vector, what I don't get is: why not suggest people lock their phones and charge them when they're locked? Or maybe even shut them down and charge them before booting. Is there any reason not to suggest those? It certainly seems more practical than telling people they're out of luck, unless there are other attack vectors - in which case, what are they?
    - jerlam 4y ago
      Most people use public charging ports are the same ones who want to use their phone while charging. Physical security is also a consideration, I wouldn't really suggest that people leave their phones plugged into the wall in a public or semi-public place.
  - amelius 4y ago

diziet 4y ago

I suggest to get data blockers like this: https://www.amazon.com/PortaPow-NA-USB-C-Data-Blocker/dp/B082WDHS22/ https://www.amazon.com/PortaPow-NA-USB-C-Data-Blocker/dp/B08...

Tagbert 4y ago
Yes, I use something similar. I keep one in my travel bag, just in case.

GartzenDeHaes 4y ago

Also, programmable USB HID devices https://shop.hak5.org/products/usb-rubber-ducky https://shop.hak5.org/products/usb-rubber-ducky

tristor 4y ago

I don't use public chargers, and I use USB condoms for charging my devices even with chargers I own, because basically all the charging devices are made in untrustable supply chains. I thought this was common knowledge, and basically what everyone is doing. Wireless charging helps a lot with this, and I now prefer wireless charging whenever possible. The only devices I connect my devices to using USB are computers I control, I don't cross-contaminate between computers (e.g. anything plugged into my work laptop will never be plugged into a personal system, and vice versa). This is just basic hardware op-sec with USB.

dehrmann 4y ago
> USB condoms I have one of these. I like that I can look in it and see that it has no data pins > Wireless I know you meant charging, but for data, with some of the spy cables out there with embedded chips and wireless access, it's ironic that wireless is in some ways more secure.
- marcosdumay 4y ago
  The wireless charging port is an specialized one. That's why it's more secure. The wireless data transfer options vary from "it's broken, forget about it" to actually quite secure, but the charging isn't done through them. When people decided to use USB for everything, well, they had to make USB support every use case.
- meling 4y ago
  Not all usb condoms show the connections. I got one from a well-known vendor at a conference. Seems like an easier attack vector to create and sell malware infested usb condoms…
MisterTea 4y ago
> I thought this was common knowledge, and basically what everyone is doing. No. Not even close.

vlod 4y ago

If I power off my phone, I assume it will be okay?

adastra22 4y ago
No.

kerkeslager 4y ago

This is like abstinence-only education. Use a USB condom: https://www.zdnet.com/article/protect-your-data-with-a-usb-condom/ https://www.zdnet.com/article/protect-your-data-with-a-usb-c...

Kwpolska 4y ago
The use of public chargers is easy to avoid with some basic planning and awareness of your phone's battery habits.
- kerkeslager 4y ago
  So? You know what's easier than basic planning and awareness of my phone's battery habits? Not avoiding public chargers.

jFriedensreich 4y ago

pro tip: if absolutely necessary at least only charge your power bank on a public charger and then charge the phone on the power bank but not at the same time.

pageandrew 4y ago
Is it even theoretically possible to have data passthrough a power bank? I don’t know much about USB, but I’d imagine that only the power delivery pins are connected to anything, right?

stametseater 4y ago

We badly need a DC electrical plug/jack standard that doesn't play double-duty as a data transmission standard. Innumerable small appliances and devices use DC power, solar panels make DC power, yet if you want to charge such devices you have to go through a DC->AC->DC conversion, or use USB which can evidently pwn your devices. What a sorry state of affairs.

ta1243 4y ago

I stopped paying attention to FBI warnings when they spammed my legal dvds. Meanwhile my downloads came with none of those warnings.

tzs 4y ago

I've come to think that whatever eventually replaces USB should add some separation between power and data. Let's call it MSB (Multiversal Serial Bus). Maybe something like this. MSB would define 2 connectors: a data connector and a power connector. MSB would also specify that if you have both data and power connectors they should be physically laid out in data/power pairs and would define the spacing/positioning (e.g., the power connector should be parallel to the data connector 2 mm apart with the power connector above the data connector). The idea behind the layout specification is that for applications that need both the power and data connectors you could make cables that include both, with the housing at the ends holding the two connectors fixed so they can treated as a unit when it comes to plugging into things. The power port would include data line, but they are just used for power negotiation. The data port would include power, but just a fixed voltage and max current, comparable to pre-high power USB, so for low power peripherals you would just need to use a data port. I.e., for low power peripherals it is pretty much just like USB.

sacrosancty 4y ago
That's pretty much USB3-A isn't it? High speed data is separate from power and low speed data. You can have connectors with just one or the other. Anyway, the world will be worse place with just incremental incompatible tweaks to the so-called "universal" connectors so that they're never universal because of churn. Hopefully USB-C is the end of the line forever, whatever its flaws might be.
i_am_jl 4y ago
Why not offload this to the device? Why doesn't my device today have an option that allows me to set the USB port to "power only"?
- mr_mitm 4y ago
  My Android does that. And at least with thunderbolt I can enable thunderbolt security on my laptop, which essentially does that.
- Tommstein 4y ago
  Because you don't have an Android? I don't remember the last one I had that didn't have that setting, if ever.

bkeating 4y ago

Go, Mike!