5 ms·
If airport USB chargers aren't considered secure, that seems like it's own extremely serious problem that we should be taking drastic actions to remedy immediat
by standardUser 4y ago
If airport USB chargers aren't considered secure, that seems like it's own extremely serious problem that we should be taking drastic actions to remedy immediately. FFS.
- enkid 4y agoWhy would they be considered secure? TSA isn't looking for hacking tools, they're looking for weapons.
- standardUser 4y agoFrom what I understand, a bad actor would need to physically interact with these charging stations. Sounds like a pretty severe breach of security to me that several agencies should be treating like an emergency. We are talking about spaces that are crawling with security and surveillance. If someone can plant a listening device like that, why can't they plant an explosive or biological weapon?
- Bjartr 4y ago> why can't they plant an explosive or biological weapon? Because you can't chemically detect a circuit based on its use case, but those two items have a low false-negative detection rate?
- enkid 4y agoYou're assuming the charging station isn't compromised to start with. A charging station with one of these tools would look basically the same as a normal charging station. One with a bomb or chemical weapon would look different.
- broast 4y agoIt's a little confusing about airports specifically. Usually official airport usb stations are built into the furniture. They would have to take the thing apart to insert a device? I don't see an example in this article of an inconspicuous device for these types of ports
- inconceivable 4y agowhat he's saying is the usb port thing is possibly compromised at the factory it was made in.
- bhk 4y agoIf so, how is carrying your own charger going to help?
- freedomben 4y agoAC power lines don't have data lines, and even if they did the juice goes through a process to become DC 5V. It would be pretty tough to exploit a USB stack through a transformer and rectifier. I've learned never to say never, but ...
- georgyo 4y agoI don't think the concern was the power... If the usb charger outlets being sent to a very federally regulated airports and installed without detection for many years are compromised at the factory, how am I to trust the USB charger I buy at a gas station or Amazon?
- freedomben 4y agoAh indeed, that makes a lot of sense. Thanks!
- FinnKuhn 4y agoI think they meant, how you would know that your own charger is save, when they are malicious from the factory. The answer to that question is to buy from a reputable seller/manufacturer or/and use a cable without data lines (for example Apple MagSafe).
- acchow 4y agoSomeone could also bring in a USB charger and mount it onto a table to make it look like it was installed by the airport.
- libraryatnight 4y agoPeople have been installing skimmers on atms and gaspumps and who knows what else in heavily recorded and busy places for ages. Airports have the benefit of being 24 hours and you can loiter there all you want if you're waiting for another flight. As for the professional shampoo confiscators I wouldn't factor them at all. edit: I like the assertion below, too, that the ports may just be factory compromised and unsafe from the start.
- xattt 4y ago> If someone can plant a listening device like that, why can't they plant an explosive or biological weapon? Because quiet infiltration is of more value than a violent attack.
- aftbit 4y agoA sufficiently malicious, motivated, and suicidal (or misled) actor absolutely could use an explosive or biological weapon to attack an airport, essentially regardless of the on-premises security posture. For explosives, one would simply detonate their bomb IN the security line on a busy day. For biologicals, one would simply infect themselves first, then spend the day at the airport waiting for a plane. I continue to be baffled why we don't hear more of such attacks.
- dehrmann 4y ago> We are talking about spaces that are crawling with security and surveillance For some of these outlets, you need a screwdriver, a compromised replacement outlet, and 30 seconds. Maybe a friend and some luggage to block cameras. I have no knowledge into the internal workings of airport security, but I doubt this is a threat they're worried about or looking for. No amount of cameras help with that.
- rocqua 4y agoExactly. It's not like it would take compromising the vendor, or the service contract. The install can be a simple and quick swap. The infeasiblity mostly seems targeting and monitization. You have no clue who or what will plug in, so it's barely useful for directed attacks. And actually getting value (intel or money) when all you know to expect is "a smartphone will connect" is quite hard.
- dehrmann 4y agoUnlike a skimmer on an ATM.
- kube-system 4y agoThis is like someone’s mother asking why a software developer can’t fix her printer. Because “computers” is more than a single discipline. “Security” is not one big umbrella. The specific people and organizations tasked with protecting air travel are not tasked with protecting the cell phones of the passengers traveling.
- deleted 4y ago[deleted]
- Paul-Craft 4y agoTSA is not known to be great at finding weapons, either.
- tedunangst 4y agoFor real, if I were to somehow conclude I'd been juice jacked at an airport, I would move mountains to go back and get ahold of that charger. I wouldn't wait three years and then drop an offhand HN comment that oh yeah, happened to me one time.
- Johnny555 4y agoHow would you get ahold of a 6 foot tall charging kiosk and what would you do with it or prove to someone at the airport that it was the culprit? Especially since the "juicer" could be s small skimmer overlaid on top of a legit charger that's been removed since you last used it.
- tedunangst 4y agoYeah, it's a real struggle that the evidence always disappears when I go back to look for it. Or maybe I toss an orange maintenance vest in my carryon, put it on past security, and rip the fucker apart on the spot. It's hilarious that just below this is a long thread about the impossibility of stopping somebody from installing a tainted outlet. What's to stop me from uninstalling it?
- Johnny555 4y ago>What's to stop me from uninstalling it Risk vs reward? Even if you find the right charge station and remove the juicer, your only reward for removing it is knowing that you're stopping someone else from getting juiced. But if you get caught, you face getting charged for vandalism or theft - and might even get blamed for installing it since you'll have it in your possession when you're caught. The value of a charging kiosk probably puts you in the realm of felony charges and maybe there's some upgrade of the charges for doing it within an airport secure zone.
- sureglymop 4y agoNothing is secure, an attack of this sophistication (exploiting the "juice" port) isn't even needed. Nowadays everything is wireless and uses Bluetooth LE. You can spoof a mac address of someones headphones and then let your device act as a keyboard and do a BadUSB attack over bluetooth.