8 ms·
It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything a
by mtillman 4y ago
It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.
- cuttysnark 4y ago> common knowledge to never use public chargers Perhaps here on HN. Most people will plug their smartphone into any accepting receptacle. trains, airplanes, NYC SmartLink, or ask the bartender if they can plug it in behind the bar. I still carry a DIY Altoids charger that takes a 9V battery (pulled down to proper volts for iPhone). In a battery emergency, my phone is simply on life support and I don't have to look for outlets that might also include a zero-day.
- TheNewsIsHere 4y agoI try to always travel with a “USB data condom”. The one I have is called a “PortaPow”, and it’s red. It was about $10 on Amazon and it’s a great investment for scenarios where I _reasonably_ trust a power-only USB port not to have been tampered with, like the built in ports on aircraft.
- beefield 4y agoI have thought a power bank would be a good enough condom - for my threat vectors, that is.
- cuttysnark 4y ago> _reasonably_ trust a power-only USB ... like the built in ports on aircraft. I'm with you, this might fall under "safe". Then again, from threads posted here and elsewhere, and through personal investigation...the infotainment systems on airplanes are an absolute disaster with regards to security and software design. They're often part of the same system as the provided USB ports. While the risk is small, there's nothing stopping 1 person from running a script that exploits some flaw in the outdated Linux distro the airline is using to manage their in-flight entertainment. There's also a chance I'm paranoid and spend too much time here, but I'm gonna stick with my Altoids.
- rsync 4y agoI have long used usb condoms - even on my own, trusted ports. Sometimes I just want to charge my phone from my laptop without triggering all kinds of finder and iTunes and photos interactions. Same with a car - just power, please.
- detrites 4y agoBuild condoms into the devices themselves via a next USB spec requiring a hardware switch to choose power-only / power+data and these kind of issues could disappear. Apple might hate it though. Then again, capacitive hardware switches could be ok.
- fortuna86 4y agoCan you be reasonably certain they work?
- TheNewsIsHere 4y agoThe one I have is designed to allow you to visually inspect the connector terminals. So at least regarding my (USB-A) ones, I can confirm only the power lanes exist.
- ghaff 4y agoMany people, including many people on this site (and, yes, including myself) wouldn't think twice about plugging into an available port if they need a charge. Maybe I don't plug into an unlabeled port in some random location where it doesn't look like it belongs, but honestly I wouldn't think twice about charging at a designated area at a conference. (Though, yeah, I'd avoid a lot of "normal" activities if I ever attended BlackHat.)
- wongarsu 4y agoI've had booths on cyber security trade fairs hand out USB flash drives as prizes for spinning a wheel, with no awareness how that might seem odd. I guess people would be reluctant to accept them at BlackHat, but everywhere else people are very trusting towards USB stuff.
- lanstin 4y agoI once worked at a place where the security team had a USB stick delivered to all the desktops with some digital brochure about not trusting strangers or some such. Not the cyber security team, but still.
- justsomehnguy 4y ago[autorun] open=you_didnt_read_the_brochure_right.exe icon=setup.exe,0 label=My install CD
- jstarfish 4y agoWe send staged phishing emails internally to see who takes the bait. Leaving USB sticks lying around with some sort of callback to see who plugs them in is a really clever idea. We could probably catch the serial number range in Defender ATP.
- vGPU 4y agoI take free USB drives any day. I always test them on the pc that belongs to the coworker that nobody likes first though ;) In all seriousness though - 128gb usb 3.0 drives can be picked up for $10 on sale all day long. Absolutely no reason to trust some $0.25 random 4gb that a stranger gave you aside from running R-studio on it for fun or something.
- tshaddox 4y agoI probably would have guessed that software vulnerabilities were rare for just plugging your smartphone into a USB port (without some additional user approval on the device). Obviously a port could probably be easily configured to just fry your jack/device but that’s not a big part of my threat model anyway.
- adastra22 4y agoYou would have guessed wrong. Most devices, especially multi-vendor android devices, have exploitable subsystems which never touch the UI visible OS layer.
- alpaca128 4y agoTo be fair I also didn't know for a long time that HDMI is not a trustworthy port and can be used to spread malware [0]. And I'm usually not thinking about that when plugging my laptop to a projector. Maybe with USB you could get away by using a cable without data pins, but I'm not sure whether that may influence charging speed given USB-C is pretty flexible. [0] https://news.ycombinator.com/item?id=31828193 https://news.ycombinator.com/item?id=31828193
- kube-system 4y agoUSB defaults to 5v if there is no negotiation, and it is said that many devices will draw 1a under these circumstances (even though technically the spec says they should expect less) -- it's the standard low speed charging that you'd get plugging your device into a dollar store charger.
- ok123456 4y agoGetting a phone with a large enough battery (>5000mAh) is good opsec. I have a 10000 mAh battery in my phone, and I only need to charge about twice a week.
- computerfriend 4y agoWhat kind of phone do you have?
- Waterluvian 4y agoEveryone wants everyone to be more informed about their subject matter area, but there just isn’t enough cognitive load for it all. I’d like to just rely on my device to protect me by asking if I want to trust the device.
- pl90087 4y agoI lately had trouble convincing some non-tech acquaintances that IoT "cloud-enabled" cameras all over their house (including bedroom) as anti-break-in measure are a bad idea as those devices or the storage in some chinese cloud could be hacked. They ridiculed this as "far fetched". I'll never be able to bring up this risk with USB to those guys. Edit: IoC typo -> IoT
- IggleSniggle 4y agoI know IoC as “Indicators of Compromise.” While that’s kinda true here, that’s not how you used it. What is IoC short for in your parlance?
- Accacin 4y agoWhy do you feel the need to mention "chinese"? Any cloud storage is liable to be hacked.
- mikrotikker 4y agoBecause they're the dodgiest, lowest cost, cheapest option. And they like to spy/ddos.