5 ms·
I don't know how this is done, but not everything USB connected is assumed to be a charger. For example the 2FA hardware tokens aren't assumed to be chargers by
by dataflow 4y ago
I don't know how this is done, but not everything USB connected is assumed to be a charger. For example the 2FA hardware tokens aren't assumed to be chargers by default. So I imagine this might be done by faking a different device.
- wongarsu 4y agoThe malicious charger can pretend to be keyboard, mouse and screen, and just remote control the phone. Or just a keyboard, if you want to an easier implementation. At least Android phones are completely usable this way, with universal keyboard/mouse support and widespread USB-C display support. Without any confirmation steps.
- dataflow 4y agoIf a keyboard is the attack vector, what I don't get is: why not suggest people lock their phones and charge them when they're locked? Or maybe even shut them down and charge them before booting. Is there any reason not to suggest those? It certainly seems more practical than telling people they're out of luck, unless there are other attack vectors - in which case, what are they?
- jerlam 4y agoMost people use public charging ports are the same ones who want to use their phone while charging. Physical security is also a consideration, I wouldn't really suggest that people leave their phones plugged into the wall in a public or semi-public place.
- amelius 4y agoIf this is true, then just use a charging cable with only the two power wires in it.
- pastage 4y agoWhat is in the connector? While the only evil usb connectors I have seen are the big ones. Putting evil in and lighting or usb-c should be more than possible.