4 ms·

>The tweet's message that public USB ports have been used by "bad actors" The tweet doesn't say that, it just says that "bad actors" have developed methods of

>The tweet's message that public USB ports have been used by "bad actors" The tweet doesn't say that, it just says that "bad actors" have developed methods of using USB ports for nefarious purposes. Which has been known for over a decade now, but I don't think there's ever been a recorded case of it being done in the wild. It doesn't seem like the kind of attack that would be easy to hide either, unless accompanied by some zero day that bypasses the accept data transfer prompt.

throwaway290 3y ago
Absence of evidence means nothing because the chance someone who can reliably detect this attack would use a public charging port is nil.
- boomboomsubban 3y ago
  That's nonsense. Like half the people in this thread seem willing to use a public charger and would find it odd if it requested data access. I admit that the percentage of people that would do that is low, but even at like .1% that's one in a thousand which a public charge station could see hundreds to thousands of users per week. If these were around they'd be spotted.
  - throwaway290 3y ago
    At best 1% of people in this thread would be capable of noticing a well mounted attack of this sort, and I assure they would not be using a random charging station :) (Or they will do it with device locked or turned off, which mitigates the attack but also means they wouldn't find out about it.) Many devices do not request data access for an input accessory like a mouse-- and if you gain input you can dismiss the popup instantly in your exploit. Also, many people might not pay attention to that popup. Also, 0days exist.
    - boomboomsubban 3y ago
      >and I assure they would not be using a random charging station Have you read the thread? Plenty of people are saying this risk is overblown and not to worry. The top 3 comments all express this sentiment. >and if you gain input you can dismiss the popup instantly in your exploit. Do you think using a mouse on an unlocked phone would go unnoticed? There's also a fair amount of disagreement over whether a mouse will work without input. We've had security researchers notice USB device attacks on computers, the same sort of attack except it will likely only hit one person. This kind of large scale attack where thousands have the chance to notice would be observed.
      - throwaway290 3y ago
        For every argument "it's not an issue" there's 5 correct points why it is > Do you think using a mouse on an unlocked phone would go unnoticed? Certainly, it only takes a millisecond. > There's also a fair amount of disagreement over whether a mouse will work without input. 0days exist. > the same sort of attack except it will likely only hit one person Stuxnet alone is known to infect hundreds of thousands for a start, but as usual keep in mind the successful attacks are generally not found out :)
        boomboomsubban 3y ago
        >It doesn't seem like the kind of attack that would be easy to hide either, unless accompanied by some zero day that bypasses the accept data transfer prompt. If your concern is zero days, nothing you do with your phone is safe. Making a big deal about this one thing seems silly. A similar thing if your concern is nation states, like in the Stuxnet attack.
        throwaway290 3y ago
        > If your concern is zero days, nothing you do with your phone is safe. safeR. There are no absolutes in security. And not using public chargers totally will. > A similar thing if your concern is nation states If you live in the middle of USA you are probably OK but many people live in or near nation states that could totally install juice jackers centrally.

throwaway290 3y ago

Absence of evidence means nothing because the chance someone who can reliably detect this attack would use a public charging port is nil.

boomboomsubban 3y ago
That's nonsense. Like half the people in this thread seem willing to use a public charger and would find it odd if it requested data access. I admit that the percentage of people that would do that is low, but even at like .1% that's one in a thousand which a public charge station could see hundreds to thousands of users per week. If these were around they'd be spotted.
- throwaway290 3y ago
  At best 1% of people in this thread would be capable of noticing a well mounted attack of this sort, and I assure they would not be using a random charging station :) (Or they will do it with device locked or turned off, which mitigates the attack but also means they wouldn't find out about it.) Many devices do not request data access for an input accessory like a mouse-- and if you gain input you can dismiss the popup instantly in your exploit. Also, many people might not pay attention to that popup. Also, 0days exist.
  - boomboomsubban 3y ago
    >and I assure they would not be using a random charging station Have you read the thread? Plenty of people are saying this risk is overblown and not to worry. The top 3 comments all express this sentiment. >and if you gain input you can dismiss the popup instantly in your exploit. Do you think using a mouse on an unlocked phone would go unnoticed? There's also a fair amount of disagreement over whether a mouse will work without input. We've had security researchers notice USB device attacks on computers, the same sort of attack except it will likely only hit one person. This kind of large scale attack where thousands have the chance to notice would be observed.
    - throwaway290 3y ago
      For every argument "it's not an issue" there's 5 correct points why it is > Do you think using a mouse on an unlocked phone would go unnoticed? Certainly, it only takes a millisecond. > There's also a fair amount of disagreement over whether a mouse will work without input. 0days exist. > the same sort of attack except it will likely only hit one person Stuxnet alone is known to infect hundreds of thousands for a start, but as usual keep in mind the successful attacks are generally not found out :)
      - boomboomsubban 3y ago
        >It doesn't seem like the kind of attack that would be easy to hide either, unless accompanied by some zero day that bypasses the accept data transfer prompt. If your concern is zero days, nothing you do with your phone is safe. Making a big deal about this one thing seems silly. A similar thing if your concern is nation states, like in the Stuxnet attack.
        throwaway290 3y ago
        > If your concern is zero days, nothing you do with your phone is safe. safeR. There are no absolutes in security. And not using public chargers totally will. > A similar thing if your concern is nation states If you live in the middle of USA you are probably OK but many people live in or near nation states that could totally install juice jackers centrally.