5 ms·

But how? Most devices are charge-only by default, most users have USB debugging disabled, and those who know how to enable it, won't allow the adb server to co

But how? Most devices are charge-only by default, most users have USB debugging disabled, and those who know how to enable it, won't allow the adb server to connect to the phone (you have to explicitly give it permission).

dataflow 4y ago
I don't know how this is done, but not everything USB connected is assumed to be a charger. For example the 2FA hardware tokens aren't assumed to be chargers by default. So I imagine this might be done by faking a different device.
- wongarsu 4y ago
  The malicious charger can pretend to be keyboard, mouse and screen, and just remote control the phone. Or just a keyboard, if you want to an easier implementation. At least Android phones are completely usable this way, with universal keyboard/mouse support and widespread USB-C display support. Without any confirmation steps.
  - dataflow 4y ago
    If a keyboard is the attack vector, what I don't get is: why not suggest people lock their phones and charge them when they're locked? Or maybe even shut them down and charge them before booting. Is there any reason not to suggest those? It certainly seems more practical than telling people they're out of luck, unless there are other attack vectors - in which case, what are they?
    - jerlam 4y ago
      Most people use public charging ports are the same ones who want to use their phone while charging. Physical security is also a consideration, I wouldn't really suggest that people leave their phones plugged into the wall in a public or semi-public place.
  - amelius 4y ago
    If this is true, then just use a charging cable with only the two power wires in it.
    - pastage 4y ago
      What is in the connector? While the only evil usb connectors I have seen are the big ones. Putting evil in and lighting or usb-c should be more than possible.
adastra22 4y ago
Baseband exploits.
retrocryptid 4y ago
I believe the assertion is "just because you don't know ow how to do it doesn't mean it can't be done." It turns out several generations of USB controllers did "undefined" things when presented with "undefined" behavior on the data pins. Sometimes "undefined" was "just doesn't work", sometimes it was "put data in physical memory, bypassing the MMU and it's data protection features." I've never seen it myself, but I worry someone out there has figured out how to do the same thing over the power lines.
- tshaddox 4y ago
  > I believe the assertion is "just because you don't know ow how to do it doesn't mean it can't be done." Okay, but tell me how it can be done if you want me to take the threat seriously. You could also say “always store your phone in a sound-isolating container because attackers can hack your phone with ultrasonics.”
  - stametseater 4y ago
    > Okay, but tell me how it can be done if you want me to take the threat seriously. That is not a precautionary attitude. I don't know how a candle left unattended in the middle of my granite counter island could light anything on fire, there aren't any drapes near it, but I'm not going to leave it unattended so I can find out.
    - tshaddox 4y ago
      Indeed, I’m explicitly rejecting the precautionary principle.
      - retrocryptid 4y ago
        Oh. So you're a bitcoin exchange CEO?
cookiengineer 4y ago
> But how? Ask that your average parent using an Android 6 from a decade ago, not being able to update because the manufacturer decided to not support their devices anymore after a year. There is no such thing as an updateable Android, because something will always be outdated. Even lineageOS builds are using decades old kernels and kernel mods that have never been backported or upstreamed. Android has a huge update problem. I'd probably bet that stagefright or, say, the pegasus zeroday for whatsapp works still on a large percentage of devices even though it was leaked more than 5 years ago.
- blacksmith_tb 4y ago
  Hmm, if someone is using a phone from a decade ago, they will certainly be vulnerable to evil charging stations, as their battery will almost certainly be extremely tired (then again, phones that old were a lot easier to replace batteries in, so maybe there's some hope).
pid-1 4y ago
I can picture a malicious actor convincing less tech savvy folks into enabling USB debugging to "unlock wifi speed" or some similar BS.
- jstarfish 4y ago
  Heh. Reminds me of the warez days. "Can't install this shady pirated software you got from a malware-adjacent site? Try disabling your antivirus!"
kotaKat 4y ago
Lightning does more than just USB depending on how you signal the pins, including factory debug and diagnostics connections. See also: the Bonobo JTAG/SWD debugging cable over Lightning. https://shop.lambdaconcept.com/home/37-bonobo-debug-cable.html https://shop.lambdaconcept.com/home/37-bonobo-debug-cable.ht... (While this 'technically' requires extra device flags, it's still the fact that Lightning has lots of hidden modes underneath its multiplexer.)

dataflow 4y ago

I don't know how this is done, but not everything USB connected is assumed to be a charger. For example the 2FA hardware tokens aren't assumed to be chargers by default. So I imagine this might be done by faking a different device.

wongarsu 4y ago
The malicious charger can pretend to be keyboard, mouse and screen, and just remote control the phone. Or just a keyboard, if you want to an easier implementation. At least Android phones are completely usable this way, with universal keyboard/mouse support and widespread USB-C display support. Without any confirmation steps.
- dataflow 4y ago
  If a keyboard is the attack vector, what I don't get is: why not suggest people lock their phones and charge them when they're locked? Or maybe even shut them down and charge them before booting. Is there any reason not to suggest those? It certainly seems more practical than telling people they're out of luck, unless there are other attack vectors - in which case, what are they?
  - jerlam 4y ago
    Most people use public charging ports are the same ones who want to use their phone while charging. Physical security is also a consideration, I wouldn't really suggest that people leave their phones plugged into the wall in a public or semi-public place.
- amelius 4y ago
  If this is true, then just use a charging cable with only the two power wires in it.
  - pastage 4y ago
    What is in the connector? While the only evil usb connectors I have seen are the big ones. Putting evil in and lighting or usb-c should be more than possible.

adastra22 4y ago

Baseband exploits.

retrocryptid 4y ago

I believe the assertion is "just because you don't know ow how to do it doesn't mean it can't be done." It turns out several generations of USB controllers did "undefined" things when presented with "undefined" behavior on the data pins. Sometimes "undefined" was "just doesn't work", sometimes it was "put data in physical memory, bypassing the MMU and it's data protection features." I've never seen it myself, but I worry someone out there has figured out how to do the same thing over the power lines.

tshaddox 4y ago
> I believe the assertion is "just because you don't know ow how to do it doesn't mean it can't be done." Okay, but tell me how it can be done if you want me to take the threat seriously. You could also say “always store your phone in a sound-isolating container because attackers can hack your phone with ultrasonics.”
- stametseater 4y ago
  > Okay, but tell me how it can be done if you want me to take the threat seriously. That is not a precautionary attitude. I don't know how a candle left unattended in the middle of my granite counter island could light anything on fire, there aren't any drapes near it, but I'm not going to leave it unattended so I can find out.
  - tshaddox 4y ago
    Indeed, I’m explicitly rejecting the precautionary principle.
    - retrocryptid 4y ago
      Oh. So you're a bitcoin exchange CEO?

cookiengineer 4y ago

> But how? Ask that your average parent using an Android 6 from a decade ago, not being able to update because the manufacturer decided to not support their devices anymore after a year. There is no such thing as an updateable Android, because something will always be outdated. Even lineageOS builds are using decades old kernels and kernel mods that have never been backported or upstreamed. Android has a huge update problem. I'd probably bet that stagefright or, say, the pegasus zeroday for whatsapp works still on a large percentage of devices even though it was leaked more than 5 years ago.

blacksmith_tb 4y ago
Hmm, if someone is using a phone from a decade ago, they will certainly be vulnerable to evil charging stations, as their battery will almost certainly be extremely tired (then again, phones that old were a lot easier to replace batteries in, so maybe there's some hope).

pid-1 4y ago

I can picture a malicious actor convincing less tech savvy folks into enabling USB debugging to "unlock wifi speed" or some similar BS.

jstarfish 4y ago
Heh. Reminds me of the warez days. "Can't install this shady pirated software you got from a malware-adjacent site? Try disabling your antivirus!"

kotaKat 4y ago

Lightning does more than just USB depending on how you signal the pins, including factory debug and diagnostics connections. See also: the Bonobo JTAG/SWD debugging cable over Lightning. https://shop.lambdaconcept.com/home/37-bonobo-debug-cable.html https://shop.lambdaconcept.com/home/37-bonobo-debug-cable.ht... (While this 'technically' requires extra device flags, it's still the fact that Lightning has lots of hidden modes underneath its multiplexer.)