3 ms·

...leaving a literal paper trail of package location tracking? Mail fraud is considered serious. Why commit an extra crime?

kevin_thibedeau 4y ago
You can put a padded envelope into a public mailbox.
NoZebra120vClip 4y ago
Less serious than tampering with fixtures in a secure area at an American international airport?
- mywittyname 4y ago
  Exactly, and you'll be on video. You can buy stamps from a vending machine with cash.
  - pnpnp 4y ago
    If, and that’s a big if, the victim was able to trace the infection back to a charging port, then have the time, resources, and capability to debug the chips. That’s all assuming the bad port wouldn’t have been removed, and video might just show regular “maintenance.” Yeah, it’s all above and beyond, but I think it’s in the realm of possibility for a high level target (see: stuxnet et al)
- thomastjeffery 4y ago
  I would imagine that leaving a charger plugged in to a public outlet is not as interesting as you have presented it to be. Sure, you would be leaving evidence, but if your plan works, that evidence won't be sought out anyway. If you sent a mysterious package, it wouldn't be strange or out-of-character for someone to investigate that package intentionally: which presents a significant attack surface for the discovery of your ruse.
  - NoZebra120vClip 4y ago
    Here's what you do without leaving obvious chargers dangling out of outlets. You don't need to even send a guy in a maintenance uniform out to the site, or tamper with installed equipment. You're a decently high-capacity Chinese factory that makes custom USB outlets. You make a "special" line with a zero-day chip or firmware inline with a cable. The cable only needs to be a little fatter to accommodate some unobtrusive electronics. They are slid under the insulation and there is no dedicated PCB that may attract scrutiny. You wait until the order comes in for the site(s) you wish to target, and you ship them off. The countermove to this, of course, is that the installer does a fuzz test of the charging station with a few common devices, trying to tickle the bug, and also a protocol analyzer that will inspect the USB data stream for anything out of the ordinary. My armchair quarterback mind says that the above security testing should be fairly effective if you are dealing with a low-level adversary. A state-sponsored one with sufficiently large enough state would not be hindered by puny countermeasures like that, and would be able to target more accurately. Here's another countermeasure on the consumer level: optocoupling. This is good to mitigate voltage and amperage damage, even accidental or unintentional types. I suppose it would prevent charging too, but there's got to be something useful about it.
dpc050505 4y ago
It's extremely easy to use cash to pay for postage. Slap fake sender information on the package and you'll be very difficult to find.

kevin_thibedeau 4y ago

You can put a padded envelope into a public mailbox.

NoZebra120vClip 4y ago

Less serious than tampering with fixtures in a secure area at an American international airport?

mywittyname 4y ago
Exactly, and you'll be on video. You can buy stamps from a vending machine with cash.
- pnpnp 4y ago
  If, and that’s a big if, the victim was able to trace the infection back to a charging port, then have the time, resources, and capability to debug the chips. That’s all assuming the bad port wouldn’t have been removed, and video might just show regular “maintenance.” Yeah, it’s all above and beyond, but I think it’s in the realm of possibility for a high level target (see: stuxnet et al)
thomastjeffery 4y ago
I would imagine that leaving a charger plugged in to a public outlet is not as interesting as you have presented it to be. Sure, you would be leaving evidence, but if your plan works, that evidence won't be sought out anyway. If you sent a mysterious package, it wouldn't be strange or out-of-character for someone to investigate that package intentionally: which presents a significant attack surface for the discovery of your ruse.
- NoZebra120vClip 4y ago
  Here's what you do without leaving obvious chargers dangling out of outlets. You don't need to even send a guy in a maintenance uniform out to the site, or tamper with installed equipment. You're a decently high-capacity Chinese factory that makes custom USB outlets. You make a "special" line with a zero-day chip or firmware inline with a cable. The cable only needs to be a little fatter to accommodate some unobtrusive electronics. They are slid under the insulation and there is no dedicated PCB that may attract scrutiny. You wait until the order comes in for the site(s) you wish to target, and you ship them off. The countermove to this, of course, is that the installer does a fuzz test of the charging station with a few common devices, trying to tickle the bug, and also a protocol analyzer that will inspect the USB data stream for anything out of the ordinary. My armchair quarterback mind says that the above security testing should be fairly effective if you are dealing with a low-level adversary. A state-sponsored one with sufficiently large enough state would not be hindered by puny countermeasures like that, and would be able to target more accurately. Here's another countermeasure on the consumer level: optocoupling. This is good to mitigate voltage and amperage damage, even accidental or unintentional types. I suppose it would prevent charging too, but there's got to be something useful about it.

dpc050505 4y ago

It's extremely easy to use cash to pay for postage. Slap fake sender information on the package and you'll be very difficult to find.