3 ms·

is there any reason to believe that this is a problem, at all, with modern phones? or is the FBI just warning us about a problem that existed a decade ago and h

is there any reason to believe that this is a problem, at all, with modern phones? or is the FBI just warning us about a problem that existed a decade ago and has now been solved. as far as i know, any somewhat recent version of either android or iOS connect in a charge-only mode to any untrusted USB port. if you want to connect in a way that allows data to flow over the connection, you have to accept a prompt in the phone. should i be worried that this system has been compromised?

fbdab103 3y ago
I suppose there could be some elaborate set of exploits which nullifies the protected pathway, but it seems a stretch that it would be used in a generic fashion to grab randoms at the airport. Personally, I never use public usb ports because I think it is more likely that some jerk has wired up the port to 120V. Circumventing the OS protection to grab my data feels seems less likely than chaotic destruction.
- Smoosh 3y ago
  You could use one of those small usb voltage meter devices to check the port before plugging in your phone. Depending upon the model it may also nullify the data pins.
  - bornfreddy 3y ago
    That sounds like it could lead to an interesting conversation with airport security later when trying to board the plane. "That? Oh, that is just for checking charging ports..."
    - toast0 3y ago
      You'll get more hassle from bringing baked goods through than from bringing a usb dodad.
    - notatoad 3y ago
      you'd think that, but i've never had a problem flying with homemade electronics. security has their list of banned things, and if it's not specifically on the list they don't care. or at least, that's been my experience as an average looking white guy. it's probably not true for everyone.
- TeMPOraL 3y ago
  > Personally, I never use public usb ports because I think it is more likely that some jerk has wired up the port to 120V. I don't, because while that's unlikely, what is almost certain is that the port only does charging at the lowest default voltage/amperage, which for at least 5 years now is not enough to charge a smartphone on standby.
userbinator 3y ago
The "charge only" option has been there for over a decade. The fact that, at least on my generic Android it causes the USB host to not even see a device being connected, almost as if the USB controller is completely disconnected, suggests that it's unlikely to be attackable via software means. As the sibling comment mentions, physical damage is still possible by overvolting or similar.
- masklinn 3y ago
  > The "charge only" option has been there for over a decade. Are you sure it block HID as well?
klabetron 3y ago
I suppose a charitable understanding of this “warning” is that less savvy users (e.g., my parents) may blindly accept the iPhone prompt to allow a connection to do non-charging (nefarious) things?
str3wer 3y ago
the usb port can still very very easily spoof itself as a keyboard/mouse and automatically accept any prompt

fbdab103 3y ago

I suppose there could be some elaborate set of exploits which nullifies the protected pathway, but it seems a stretch that it would be used in a generic fashion to grab randoms at the airport. Personally, I never use public usb ports because I think it is more likely that some jerk has wired up the port to 120V. Circumventing the OS protection to grab my data feels seems less likely than chaotic destruction.

Smoosh 3y ago
You could use one of those small usb voltage meter devices to check the port before plugging in your phone. Depending upon the model it may also nullify the data pins.
- bornfreddy 3y ago
  That sounds like it could lead to an interesting conversation with airport security later when trying to board the plane. "That? Oh, that is just for checking charging ports..."
  - toast0 3y ago
    You'll get more hassle from bringing baked goods through than from bringing a usb dodad.
  - notatoad 3y ago
    you'd think that, but i've never had a problem flying with homemade electronics. security has their list of banned things, and if it's not specifically on the list they don't care. or at least, that's been my experience as an average looking white guy. it's probably not true for everyone.
TeMPOraL 3y ago
> Personally, I never use public usb ports because I think it is more likely that some jerk has wired up the port to 120V. I don't, because while that's unlikely, what is almost certain is that the port only does charging at the lowest default voltage/amperage, which for at least 5 years now is not enough to charge a smartphone on standby.

userbinator 3y ago

The "charge only" option has been there for over a decade. The fact that, at least on my generic Android it causes the USB host to not even see a device being connected, almost as if the USB controller is completely disconnected, suggests that it's unlikely to be attackable via software means. As the sibling comment mentions, physical damage is still possible by overvolting or similar.

masklinn 3y ago
> The "charge only" option has been there for over a decade. Are you sure it block HID as well?

klabetron 3y ago

I suppose a charitable understanding of this “warning” is that less savvy users (e.g., my parents) may blindly accept the iPhone prompt to allow a connection to do non-charging (nefarious) things?

str3wer 3y ago

the usb port can still very very easily spoof itself as a keyboard/mouse and automatically accept any prompt