3 ms·

That's nonsense. Like half the people in this thread seem willing to use a public charger and would find it odd if it requested data access. I admit that the p

That's nonsense. Like half the people in this thread seem willing to use a public charger and would find it odd if it requested data access. I admit that the percentage of people that would do that is low, but even at like .1% that's one in a thousand which a public charge station could see hundreds to thousands of users per week. If these were around they'd be spotted.

throwaway290 3y ago
At best 1% of people in this thread would be capable of noticing a well mounted attack of this sort, and I assure they would not be using a random charging station :) (Or they will do it with device locked or turned off, which mitigates the attack but also means they wouldn't find out about it.) Many devices do not request data access for an input accessory like a mouse-- and if you gain input you can dismiss the popup instantly in your exploit. Also, many people might not pay attention to that popup. Also, 0days exist.
- boomboomsubban 3y ago
  >and I assure they would not be using a random charging station Have you read the thread? Plenty of people are saying this risk is overblown and not to worry. The top 3 comments all express this sentiment. >and if you gain input you can dismiss the popup instantly in your exploit. Do you think using a mouse on an unlocked phone would go unnoticed? There's also a fair amount of disagreement over whether a mouse will work without input. We've had security researchers notice USB device attacks on computers, the same sort of attack except it will likely only hit one person. This kind of large scale attack where thousands have the chance to notice would be observed.
  - throwaway290 3y ago
    For every argument "it's not an issue" there's 5 correct points why it is > Do you think using a mouse on an unlocked phone would go unnoticed? Certainly, it only takes a millisecond. > There's also a fair amount of disagreement over whether a mouse will work without input. 0days exist. > the same sort of attack except it will likely only hit one person Stuxnet alone is known to infect hundreds of thousands for a start, but as usual keep in mind the successful attacks are generally not found out :)
    - boomboomsubban 3y ago
      >It doesn't seem like the kind of attack that would be easy to hide either, unless accompanied by some zero day that bypasses the accept data transfer prompt. If your concern is zero days, nothing you do with your phone is safe. Making a big deal about this one thing seems silly. A similar thing if your concern is nation states, like in the Stuxnet attack.
      - throwaway290 3y ago
        > If your concern is zero days, nothing you do with your phone is safe. safeR. There are no absolutes in security. And not using public chargers totally will. > A similar thing if your concern is nation states If you live in the middle of USA you are probably OK but many people live in or near nation states that could totally install juice jackers centrally.
        boomboomsubban 3y ago
        >safeR You're also safer if you leave your phone in airplane mode, or better yet off. Juice jacking is possible, but there's no evidence it's been deployed. A zeroclick attack seems like a much bigger threat, and I can't do much against that. >If you live in the middle of USA you are probably OK but many people live in or near nation states that could totally install juice jackers centrally. You're missing the point. If your adversary is a nation state, you're already screwed. They have better methods of attack than hoping you need to battery is low in some specific location. edit let's assume I run a criminal organization and want to effectively use juice jacking. My first step would be to purchase several expensive zero days, and then develop some kind of software to launch it and to assure only phones susceptible to them get targeted, otherwise people will quickly notice something's wrong. Then I need to get access to real estate in a high traffic area, where I'll need to buy electricity and run some kind of data server. Then I'll need to get people to sift through the resulting data, and the "payoff" is what, banking details or credit cards? Attacking an ATM seems way easier.
        throwaway290 3y ago

throwaway290 3y ago

At best 1% of people in this thread would be capable of noticing a well mounted attack of this sort, and I assure they would not be using a random charging station :) (Or they will do it with device locked or turned off, which mitigates the attack but also means they wouldn't find out about it.) Many devices do not request data access for an input accessory like a mouse-- and if you gain input you can dismiss the popup instantly in your exploit. Also, many people might not pay attention to that popup. Also, 0days exist.

boomboomsubban 3y ago
>and I assure they would not be using a random charging station Have you read the thread? Plenty of people are saying this risk is overblown and not to worry. The top 3 comments all express this sentiment. >and if you gain input you can dismiss the popup instantly in your exploit. Do you think using a mouse on an unlocked phone would go unnoticed? There's also a fair amount of disagreement over whether a mouse will work without input. We've had security researchers notice USB device attacks on computers, the same sort of attack except it will likely only hit one person. This kind of large scale attack where thousands have the chance to notice would be observed.
- throwaway290 3y ago
  For every argument "it's not an issue" there's 5 correct points why it is > Do you think using a mouse on an unlocked phone would go unnoticed? Certainly, it only takes a millisecond. > There's also a fair amount of disagreement over whether a mouse will work without input. 0days exist. > the same sort of attack except it will likely only hit one person Stuxnet alone is known to infect hundreds of thousands for a start, but as usual keep in mind the successful attacks are generally not found out :)
  - boomboomsubban 3y ago
    >It doesn't seem like the kind of attack that would be easy to hide either, unless accompanied by some zero day that bypasses the accept data transfer prompt. If your concern is zero days, nothing you do with your phone is safe. Making a big deal about this one thing seems silly. A similar thing if your concern is nation states, like in the Stuxnet attack.
    - throwaway290 3y ago
      > If your concern is zero days, nothing you do with your phone is safe. safeR. There are no absolutes in security. And not using public chargers totally will. > A similar thing if your concern is nation states If you live in the middle of USA you are probably OK but many people live in or near nation states that could totally install juice jackers centrally.
      - boomboomsubban 3y ago
        >safeR You're also safer if you leave your phone in airplane mode, or better yet off. Juice jacking is possible, but there's no evidence it's been deployed. A zeroclick attack seems like a much bigger threat, and I can't do much against that. >If you live in the middle of USA you are probably OK but many people live in or near nation states that could totally install juice jackers centrally. You're missing the point. If your adversary is a nation state, you're already screwed. They have better methods of attack than hoping you need to battery is low in some specific location. edit let's assume I run a criminal organization and want to effectively use juice jacking. My first step would be to purchase several expensive zero days, and then develop some kind of software to launch it and to assure only phones susceptible to them get targeted, otherwise people will quickly notice something's wrong. Then I need to get access to real estate in a high traffic area, where I'll need to buy electricity and run some kind of data server. Then I'll need to get people to sift through the resulting data, and the "payoff" is what, banking details or credit cards? Attacking an ATM seems way easier.
        throwaway290 3y ago