6 ms·
This nonsense comes up every now and then. The facts are: * The risk on any modern phone is close to nonexistent. By default they only charge. You'd need a zer
by hannob 3y ago
This nonsense comes up every now and then. The facts are:
* The risk on any modern phone is close to nonexistent. By default they only charge. You'd need a zero day exploit in the charging function.
* There are no reports of such attacks ever having happened in the wild.
Stop worrying about fake security threats. There are enough real ones.
- wannacboatmovie 3y agoThis sounds like something guys who setup a fake charging kiosk at DEFCON would say.
- DANmode 3y agoYes, because you haven't come across an attack doesn't make it fake.
- spookie 3y agoCorrect me if I'm wrong, but O.MG Cables do allow to circumvent these phone defaults, don't they?
- plagiarist 3y agoThis one is easy to mitigate, so I'll continue being paranoid about it, thanks.
- junofan 3y agoLots of faith that certain manufacturers aren’t using USB-PD vendor-defined messages to allow factory devices to talk to the bootloader.
- worthless-trash 3y agoJust to be clear, Are you saying that there are no unfixed exploits in the USB stack ?
- misnome 3y agoThat would be the possibility of zero-day they explicitly mentioned.
- worthless-trash 3y agoNo, OP refers to the charging function. I'm calling out the USB stack these are different things. Maybe this discussion is too nuanced for HN. Best we just tow the line, and agree that phishing and websploits is the biggest problem and other issues are not worth addressing even when we can.
- cvccvroomvroom 3y agoUSB is just the tip of the iceberg at the bottom of the stack. It's possible to restore and synchronize contents to and from Apple and Android phones to a computer over USB. The attack surface is therefore the OS and applications as well as the hardware including firmware of chips.
- iancmceachern 3y agoThe important news here is that someone at the FBI thought it was a real threat and worth telling us all about it. What's going over there I wonder? It's like this guy I used to work for. Anytime someone would ask him to make a pdf copy of a document he would print it out, scan it on the copier and email it to himself. There has to be some of those types over there. This came from their desk.
- midasuni 3y agoThat’s a solid way of avoiding data loss through hidden information. What you scan is what you get (potentially some information about the scanner too)
- quitit 3y ago> Anytime someone would ask him to make a pdf copy of a document he would print it out, scan it on the copier and email it to himself. That's a pragmatic strategy to ensure that sensitive information isn't leaked. Other than potentially including useful vector formats of artwork such as seals, logos and signatures, the visibility and/or mask settings can easily hide sensitive information that is trivial to extract later with standard vector editing software. The print+scan method ensures that the person sharing the file is fully aware of exactly what is being handed over. It also deals with redactions which were not implemented properly.
- bornfreddy 3y agoA paranoid person would point out that information can be encoded in a way that is not lost when printing / scanning too, just with more effort. Of course I'm not such a person. ;)
- quitit 3y agoCertainly, but that's now on a new level. The problem of oversharing with PDF is pretty common. To use a high-profile example: >Failed redaction reveals Paul Manafort's 'lies to FBI' https://www.bbc.com/news/world-us-canada-46804127 https://www.bbc.com/news/world-us-canada-46804127 Moving deeper into just redaction failures: The American Bar Association even has a topic dedicated to redaction failures, where they list numerous examples of it (including the one above): https://www.americanbar.org/groups/judicial/publications/judges_journal/2019/spring/embarrassing-redaction-failures/ https://www.americanbar.org/groups/judicial/publications/jud... Yet redaction failures are just one of many ways that a PDF can overshare, simply printing and scanning it solves a great many problems. I think it's a good approach for people who aren't tech savvy, especially with longer documents.
- cvccvroomvroom 3y agoYou're completely wrong and offering bad advice. Every smartphone I know of still supports USB data, from all Apple and all Samsung phones.
- hsbauauvhabzb 3y agoDon’t they require approval before that happens?
- acka 3y agoMany (most?) mobile devices still support connecting HID devices such as keyboards and sometimes also mice without confirmation. Emulate one of those, navigate through settings and change things to your liking, then optionally initiate a disconnect/reattach as another device type of your choice, and boom.
- hsbauauvhabzb 3y agoSo the phone needs to be unlocked and the user not noticing somebody controlling the phone, while unlocked. God it.
- bell-cot 3y agoEven when they do, humans are not particularly reliable in that regard. Many carbon-based computers have been conditioned to answer "Yes/Approve/Allow/etc." to all the annoying little pop-up questions that modern silicon-based computer crap force-feeds them.
- krab 3y agoCan't the charger emulate a mouse/keyboard? It can also add a mass storage and confirm its usage with mouse. It's a bus after all. Edit: just checked - it's indeed possible with Android 14. Connecting a mouse doesn't require any confirmation. As long as the phone is unlocked, you can adjust the USB settings with that mouse.
- matsemann 3y agoCould use a power-only cable? Or are they no longer a thing with usb-c and PD handshakes?
- mr_mitm 3y agoYou can. There are even special adapters that block data, even for USB C. They call it "USB condom": https://www.zdnet.com/article/flying-this-weekend-this-6-usb-condom-will-protect-your-data-from-suspicious-outlets/ https://www.zdnet.com/article/flying-this-weekend-this-6-usb...
- reaperman 3y agoId imagine this would prevent charging using voltages over 5V?
- Kirby64 3y agoThe standard usb data pins are not used to negotiate the power profiles. The pins used for negotiating power profiles should be much safer, with fewer venues for exploit. Maybe not impossible in all cases, but it’s trivial to design a system that could not be exploited via the power negotiation pins.
- deleted 3y ago[deleted]
- mjevans 3y agoSo charge while locked only, or use an adapter. It's probably safe enough to recharge your battery pack and charge the phone off that, even at the same time if supported.
- pera 3y ago> By default they only charge. My Fairphone 4 with vanilla Android 11 when connected to a USB C monitor will immediately mirror the screen without any sort of notification, so an evil charging port could at least record everything I do, no zero days required.
- FirmwareBurner 3y agoI doubt attackers are installing USB-DP capture cards to watch you scroll on HN and others on Instagram.
- gruez 3y agoIsn't the bigger issue that you're in a space that the attacker controls, and therefore can install hidden cameras to shoulder surf you?
- Beijinger 3y agoYour never know... https://futurism.com/journalist-usb-drive-bomb https://futurism.com/journalist-usb-drive-bomb
- austinheap 3y agoWe always used these in red teams…scatter them around the client’s office. Haven’t seen malicious thumb drives fail once bc there’s always someone thirsty enough to plug one in.
- Beijinger 3y agoThe explosives are a little but too much. BUt how about this one? https://www.deccanchronicle.com/technology/in-other-news/120916/usb-killer-a-device-that-can-destroy-a-pc-in-seconds.html https://www.deccanchronicle.com/technology/in-other-news/120...
- jeffalyanak 3y agoThe O.MG cable proves that there are widespread vulnerabilities to exploit. The fact that this hasn't been exploited in the wild much is good, but doesn't mean that the advice is wrong. Unless the vulnerabilities themselves are all patched it _will_ be exploited in the wild eventually.
- hilbert42 3y agoI tend to agree with the first poster re risks but perhaps there's an easy vulnerability we're unaware of. I don't use an O.MG cable but I do use OTG regularly. On some phones it times out and the USB reverts to charging, on others it doesn't which poses a potential risk (but OTG-always-on is more convenient so I tend to leave it configured on phones that allow it). Infection is now potentially higher due to increased OTG usage given the removal of MicroSD by many manufacturers. (The removal of the MicroSD has been a damn inconvenience irrespective of the OTG matter.)
- jeffalyanak 3y agoThe O.MG cable is designed specifically for covert USB exploits against mobile devices: https://shop.hak5.org/products/omg-cable https://shop.hak5.org/products/omg-cable
- nojito 3y agoYou grossly underestimate the amount of individuals who plug in a usb and click yes to allow access to device.
- crepple 3y ago> There are no reports of such attacks ever having happened in the wild. The FBI disagree: > Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices. Carry your own charger and USB cord and use an electrical outlet instead. I'd rather take advice from them than a random commenter here who has no insight into what's actually happening within the criminal world.
- boomboomsubban 3y ago>The FBI disagree No it doesn't. The line you quoted says such an attack is theoretically possible, it doesn't say it has ever happened. And as another comment mentions, the tweet wasn't some update on things happening, they were parroting an old general practices guide.
- LinuxBender 3y agoEither 0-day or JTAG and those are popping up more now as more people are reverse engineering phones to do forensics. Search YT for videos. Either way for the paranoid USB condoms are cheap. One can get a pack of them for under $9. Some of them can protect from over-voltage. Flaky hanky janky power supplies technical term would be more of my concern. I personally just prefer to charge a cheap USB battery so that I can use it for anything that needs a charge. Many of them now also have a flashlight like the phone.