6 ms·
> ”It comes with one USB-C to USB-C charging cable - not sure if it is a data cable, also.” All USB-C cables must support USB 2.0 480 Mbps data transfer, at mi
by Reason077 3y ago
> ”It comes with one USB-C to USB-C charging cable - not sure if it is a data cable, also.”
All USB-C cables must support USB 2.0 480 Mbps data transfer, at minimum. There’s no such thing as a USB-C cable that doesn’t support data.
- c0pium 3y agoOf course there are, they’re sold as “privacy” or sometimes “security” cables. To be clear, “juice jacking” is not a thing anymore, but people are still foolishly worried about it so there’s a market. https://www.amazon.com/PortaPow-NA-USB-C-Data-Blocker/dp/B082WDHS22/ https://www.amazon.com/PortaPow-NA-USB-C-Data-Blocker/dp/B08...
- lukasb 3y agoWhy is it foolish? Are drivers really well hardened now?
- lucideer 3y agoNo, and juice jacking is entirely possible right now. It's just more difficult to do than many other types of hw attack & too costly to deploy in random indiscriminate public ports, making it less than viable for most cases outside of nation-state targeted attacks. Generally speaking any documented cases of juice jacking happening are just red teams doing PoCs.
- c0pium 3y agoStop repeating unsubstantiated rumors as facts. PoC||GTFO
- lucideer 3y agoBadUSB-C[0] builds upon the original 2014 BadUSB's HID emulation approach but takes advantage of USB 3.x DisplayPort to process video stream to make decisions & validate the success of the HID emulation steps. It's too esoteric & expensive to be viable at any scale, but it's definitely functional. [0] https://ieeexplore.ieee.org/document/9474274 https://ieeexplore.ieee.org/document/9474274
- c0pium 3y agoIf you bother to read more than the abstract, you’d realize this isn’t an attack. It’s a framework for possibly creating new attacks, which after extensive research yielded precisely zero code execution bugs. Gotta print something after wasting a whole semester I suppose. When I say unsubstantiated rumor, this is what I’m talking about.
- lucideer 3y ago> this isn’t an attack I'm aware. As I said above: > any documented cases of juice jacking happening are [...] PoCs
- c0pium 3y agoThen you should learn what a PoC is. This is not a PoC. It’s a “we tried this and failed”. It’s a disproof(by exhaustion)-of-concept.
- lucideer 3y agoI'm curious about what you think they "tried and failed", and what exactly success looks like for you. You mentioned "code execution bugs" - what is that exactly to you? I presume you don't count HID emulation, so I'd be interested in what exactly does count.
- c0pium 3y agoCode refers to computer code, sometimes called “shell code”. Execution refers to getting that code to run. They didn’t get anything unexpected to happen on the device. You really should read the paper, it’s a masterclass in making nothing sound like something.
- c0pium 3y agoIn a word, yes. The code execution CVEs, especially for iOS which is the subject here, all start with <=2014. There has been a huge amount of work since then (accelerated by the research device program). It’s a favorite boogeyman of the “nation state actors are under your bed” crowd. Which is stupid because they all recommend avoiding public charging and would they be doing that if they were siting on high-quality exploits? There’s a reason NSO doesn’t target USB, and it’s not because they enjoy creating VMs in the image decoder.
- lucideer 3y agoJuice jacking tends to use HID emulation - that's feature abuse, not CVE exploitation. The point is it isn't viable at any scale - nation states advise avoiding public charging because employees of companies they subcontract have been individually targetted. They're not going to be doing any indiscriminate mass exploitation of the general public with it though.
- c0pium 3y agoThat’s absurd, no it doesn’t. It refers to a combination of the 2011 defcon demo of eliciting a device to sync data by default and a fever-dream of getting code execution by abusing the USB stack. You’re thinking of BadUSB or OMGCable. 1) which is a totally different attack 2) not especially applicable to smartphones 3) very much a thing that happens in real life (I have responded to incidents where one was used) Lastly, there are plenty of CVEs issued for “feature abuse”, that’s a meaningless distinction.
- deleted 3y ago[deleted]
- lxgr 3y agoIs that even possible with USB-C, though? I believe at least the CC connection needs to be intact for a conformant power adapter or device to even output any voltage for charging for a C-to-C cable. It might be possible to omit the D+ and D- wires, but that disqualifies many legacy charging protocols as well.
- c0pium 3y agoYes.
- deleted 3y ago[deleted]
- xen2xen1 3y agoOh my, lots of cheap cables don't support data. Buy a $15 set of wirlesss Earbuds and check them.
- BHSPitMonkey 3y agoGP's point is that those are not, by definition, USB Type-C cables (even though a bootleg can still function like one for some use cases), and Apple is not likely to sell USB non-conforming cables.
- coffeebeqn 3y agoYeah wouldn’t it be less copper to only put in the voltage connectors? I don’t see why low end wouldn’t skimp out on those
- zlsa 3y agoIf a USB-C to USB-C cable only had wires for VCC and GND, here's what wouldn't work: * Data (this one is fairly obvious) * Power (since the CC wire in the cable is missing, and a compliant USB-C power source will refuse to output power unless the CC wire is terminated on the other end which signals what type of device it is) You'd need at _least_ the CC wire as well.
- hedora 3y agoCan’t the cable terminate it instead? That would save a lot of wire, and consumer expectations for USB-C reliability are just above “might catch fire” and below “I’d be surprised if the cable was incompatible or failed so quickly”.
- duskwuff 3y agoYou'd end up with a cable that only worked for "slow charging" (5V / 500 mA), and even then only in one direction (because the cable could only pretend to be Rp+Ra or Ra+Rd for one side). It's easier to do the right thing.
- josephcsible 3y agoThe standard can say cables "must" support things all day long, but that doesn't mean they will. Remember when Benson Leung's laptop got fried by a standard-violating SURJTECH brand cable from Amazon? https://web.archive.org/web/20160206010526/https://www.amazon.com/review/R2XDBFUD9CTN2R/ https://web.archive.org/web/20160206010526/https://www.amazo...
- 38 3y agothis is Apple. this is not some random seller on Amazon.
- fps-hero 3y agoThe USB-C cable supplied with my MacBook does not function as a data cable, charging only.
- axman6 3y agoThat sounds highly unlikely, the one that came with my MBP supports everything up to Thunderbolt. But USB is ridiculously complicated, and sometimes better cables fail on shitty devices; I've seen it a few times with camera equipment where I really needed the cable that came with it because higher specced ones just didn't work.
- cjcampbell 3y agoTrue if they are referring to the MagSafe cable. If referring to USB C to C, they’re mistaken. The charging cable for all MacBooks does support USB 2 data rates.
- Reason077 3y agoThe charging cables included with MacBooks do not support Thunderbolt. Just USB 2.0 data. I do have an Apple Thunderbolt cable which supports charging (of course), but it was a separate purchase. The Thunderbolt cable looks similar but is a bit thicker, and has the Thunderbolt logo printed on the connectors at each end.
- rjzzleep 3y agoI'm always puzzled when people say that. When you buy small electric gadgets that come with USB-C, almost all of those bundled cables come without data transfer support.
- MilaM 3y agoI think this is only true for charging cables that are USB-A to USB-C. I have some of those lying around, also from cheap gadgets. But I would not recommend using them for data transfers anyway.