7 ms·
FBI warns against using public USB charging ports
- instaheat 3y agoUSB dead drop's have come a long way?
- super_linear 3y agoHave been using around "USB condoms" to protect against this: https://www.amazon.com/gp/product/B00T0DW3F8 https://www.amazon.com/gp/product/B00T0DW3F8
- cushpush 3y agoNice just don't use any freely obtained ones! Haha
- askvictor 3y agoThe porta-power ones you can see the physical USB data connections are absent, so probably safe even if free. But for anything else with those connections still there, free or paid, I'd be suspicious, unless I cut the data wires myself.
- postmodest 3y agoNice, but as we move to USB-PD, can you even have data-free USB PD?
- upon_drumhead 3y agoNo, but a ubc-usb adapter and a usb-usbc adapter breaks the data path and fails back to 5v charging, which is slow, but will charge a phone.
- neilv 3y agoI've been carrying an earlier version of those in each bag many years. They also make guaranteed data-blocking cables cables, but getting the blocker as a dongle means I can carry it plus a data cable for my phone, and not have to carry 2 cables. (When I do find an unmarked USB cable that appears to be charging-only, like that came with a used phone and a firestarter wallwart, I destroy it.)
- makeworld 3y agoThe main problem with this is it doesn't allow for fast charging.
- RockRobotRock 3y agodumb question: could you cut the data line after a second or so, or does it require constant communication?
- anilakar 3y agoIs there a modern USB type C equivalent to this? As far as I know, a type C outlet does the power delivery handshake over the CC pin, not D+/D-.
- makeworld 3y agoOh, that's news to me. That would be nice to have.
- iancmceachern 3y agoI think it's funny that this company is able to sell these, they're effectively just usb cables with 2 of the wires cut. No need to buy these, just take any usb cable and snip the correct 2 wires
- qwertox 3y agoI bought one for the car because I wanted to use a very short USB cable with a 90° plug which didn't exist as a charging-only cable. I think it's funny how one thinks that damaging the cable sheath just to cut two cables makes one end up with a proper charging-only cable which one would actually like to carry around. I've seen enough Apple Lightning cables which are damaged near the connector where I always think: what kind of people are these who are okay with this? I do cut USB cables, but it's for tinkering and not for normal use.
- deleted 3y ago[deleted]
- Animats 3y agoOK, so the FBI is on this. Are they doing something about the problem? Like finding these things, tearing them down, and finding what they're doing and where the data is going. Or are they just issuing press releases? If someone managed to install something like this in a wall plate in an airport, they could be doing far worse things to the airport infrastructure. Homeland Security should be looking for these things, with people plugging testers into USB power outlets. If they talk on the data lines at all, there's something funny going on.
- uoaei 3y agoThey install them in cars, airplanes, and airports already. I'd bet in the future we'll hear from some whistleblower about how three-letter agencies are using data available through those connections for surveillance purposes.
- jmgrosen 3y agoare there any documented cases of this actually happening in the wild?
- uoaei 3y agoPower-only USB cables exist if you're still charging a device with a charge port other than USB-C. It does seem that part of the push for USB-C is to ensure that data connectivity is always available for in-/exfiltration.
- Moru 3y agoI had to search my storage for quite a while to find a USB-C cable that did data transfer when I needed it last time.
- boomboomsubban 3y ago>The tweet's message that public USB ports have been used by "bad actors" The tweet doesn't say that, it just says that "bad actors" have developed methods of using USB ports for nefarious purposes. Which has been known for over a decade now, but I don't think there's ever been a recorded case of it being done in the wild. It doesn't seem like the kind of attack that would be easy to hide either, unless accompanied by some zero day that bypasses the accept data transfer prompt.
- throwaway290 3y agoAbsence of evidence means nothing because the chance someone who can reliably detect this attack would use a public charging port is nil.
- boomboomsubban 3y agoThat's nonsense. Like half the people in this thread seem willing to use a public charger and would find it odd if it requested data access. I admit that the percentage of people that would do that is low, but even at like .1% that's one in a thousand which a public charge station could see hundreds to thousands of users per week. If these were around they'd be spotted.
- throwaway290 3y agoAt best 1% of people in this thread would be capable of noticing a well mounted attack of this sort, and I assure they would not be using a random charging station :) (Or they will do it with device locked or turned off, which mitigates the attack but also means they wouldn't find out about it.) Many devices do not request data access for an input accessory like a mouse-- and if you gain input you can dismiss the popup instantly in your exploit. Also, many people might not pay attention to that popup. Also, 0days exist.
- boomboomsubban 3y ago>and I assure they would not be using a random charging station Have you read the thread? Plenty of people are saying this risk is overblown and not to worry. The top 3 comments all express this sentiment. >and if you gain input you can dismiss the popup instantly in your exploit. Do you think using a mouse on an unlocked phone would go unnoticed? There's also a fair amount of disagreement over whether a mouse will work without input. We've had security researchers notice USB device attacks on computers, the same sort of attack except it will likely only hit one person. This kind of large scale attack where thousands have the chance to notice would be observed.
- notatoad 3y agois there any reason to believe that this is a problem, at all, with modern phones? or is the FBI just warning us about a problem that existed a decade ago and has now been solved. as far as i know, any somewhat recent version of either android or iOS connect in a charge-only mode to any untrusted USB port. if you want to connect in a way that allows data to flow over the connection, you have to accept a prompt in the phone. should i be worried that this system has been compromised?
- fbdab103 3y agoI suppose there could be some elaborate set of exploits which nullifies the protected pathway, but it seems a stretch that it would be used in a generic fashion to grab randoms at the airport. Personally, I never use public usb ports because I think it is more likely that some jerk has wired up the port to 120V. Circumventing the OS protection to grab my data feels seems less likely than chaotic destruction.
- Smoosh 3y agoYou could use one of those small usb voltage meter devices to check the port before plugging in your phone. Depending upon the model it may also nullify the data pins.
- bornfreddy 3y agoThat sounds like it could lead to an interesting conversation with airport security later when trying to board the plane. "That? Oh, that is just for checking charging ports..."
- toast0 3y agoYou'll get more hassle from bringing baked goods through than from bringing a usb dodad.
- notatoad 3y agoyou'd think that, but i've never had a problem flying with homemade electronics. security has their list of banned things, and if it's not specifically on the list they don't care. or at least, that's been my experience as an average looking white guy. it's probably not true for everyone.
- stodor89 3y ago[flagged]
- btgeekboy 3y agoBetween the advances in modern phone battery life over the years, and the relative affordability (cost, size, weight) of USB batteries, I can't recall the last time I actually used public ports. Why be tethered to a port on a wall when you can walk anywhere with an external battery temporarily in your back pocket or backpack? Get a battery that supports fast charging, and you'll be able to recharge a lot faster than most of those public ports anyway.
- userbinator 3y agoOr if you have a removable battery, a 30-second swap.
- viraptor 3y agoDepends on what you mean by a "public port". For example if I'm sitting on a train / plane / airport, I'm going to charge from there rather than using my own battery, even if I have it.
- hannob 3y agoThis nonsense comes up every now and then. The facts are: * The risk on any modern phone is close to nonexistent. By default they only charge. You'd need a zero day exploit in the charging function. * There are no reports of such attacks ever having happened in the wild. Stop worrying about fake security threats. There are enough real ones.
- wannacboatmovie 3y agoThis sounds like something guys who setup a fake charging kiosk at DEFCON would say.
- DANmode 3y agoYes, because you haven't come across an attack doesn't make it fake.
- spookie 3y agoCorrect me if I'm wrong, but O.MG Cables do allow to circumvent these phone defaults, don't they?
- plagiarist 3y agoThis one is easy to mitigate, so I'll continue being paranoid about it, thanks.
- junofan 3y agoLots of faith that certain manufacturers aren’t using USB-PD vendor-defined messages to allow factory devices to talk to the bootloader.
- worthless-trash 3y agoJust to be clear, Are you saying that there are no unfixed exploits in the USB stack ?
- misnome 3y agoThat would be the possibility of zero-day they explicitly mentioned.
- jdblair 3y agoI generally avoid public USB chargers, not because of security risk, but because they are typically 5V and less than 2A. If there is mains power then I can use an adapter and charge at a reasonable rate.
- Khartoum 3y agoI avoid that potential problem altogether by charging my USB battery pack from the public chargers, and simultaneously using a different port on the battery pack to charge my phone.
- adr1an 3y agoReminds me of the USB condoms we used to solder at a workshop (it's just USB without connecting the data pins). They didn't work, probably coz it was our first soldering ever heh
- Out_of_Characte 3y agoThis threat is far less dangerous than the threat of automatically connecting to certain free wifi ssid's that could be harmfull to one of the thousands of possibly compromised apps.
- knocte 3y agoIt's the other way around mate. So long as you use https (and have already accessed the website in the past) you're fine using free wifi hotspots.
- sschueller 3y agoIt is more likely to have your finger and hand prints stolen using a Dyson hand dryer in a public bathroom than a public USB charging port doing anything. Like the Dyson hand drying instructions say, move your hands spread out slowly up and down...
- __jf__ 3y agoTom Uren and grugq did a podcast on this recently in Risky Business News [0] I think the main point was that these attacks are physical, don't scale very well, and are untargeted because they depend on luck, so an adversary probably would use more efficient techniques. Unless of course these USB charging points happen to magically cluster around important secret carrying government buildings or other points of interest. [0] https://risky.biz/BTN46/ https://risky.biz/BTN46/
- chmod775 3y agoCharging stations are ubiquitous in China, widely used, and they're internet connected - to facilitate payment. Every mall, hotel, and many other businesses have these placed strategically (in front of restrooms, in the gym, etc.) Not quite a physical attack anymore if you pwn these remotely. Granted if the situation in the US is still the same as Europe's rather than China's, it's a nonissue. Last I checked few people there ever used these.
- CapitalistCartr 3y agoI use a power-only adapter. It's an easy solution.
- eunos 3y agoYou jest, I charged my powerbank instead of my phone.
- wkat4242 3y agoA bit late. A decade ago this was indeed a bit of a thing. These days it's not. Just keep your phone configured to charge only.
- teknico 3y agoGet one of these and you'll be safe, not only from unwanted data access, but also from over-voltage: https://www.crowdsupply.com/karoly-simon/usbsafe2 https://www.crowdsupply.com/karoly-simon/usbsafe2