5 ms·

Beware of Juice-Jacking

32 points by niyazpk 14y ago

gwillen 14y ago
There is one easy way to solve this problem that I can think of: Neuter a USB cable by shorting the data pins on the device end and disconnecting them on the charger end. Just be careful not to plug the resulting cable into a computer -- you are likely to draw more current than permitted by the USB spec, and could potentially cause an issue. (I suppose you could potentially cause an issue with a charging kiosk too, if it's a computer rather than a dumb brick, but it's not really the kiosk I'm worried about.)
- raverbashing 14y ago
  Do you need to short the data end at the device? Probably not It may make sense to not leave them "floating", not sure how chargers do (I mean, not considering the ones that do some electric tricks for the device to recognize their "vendor extensions")
  - gwillen 14y ago
    If you want a standards-compliant 'fast charge', you need to short the data lines to the device. If you merely cut the data lines, I don't know what the device will do. Probably it will draw 100mA, which is the permissible draw for a USB device that hasn't connected to the host yet, and then it will repeatedly try and fail to connect.
- maxjus 14y ago
  I know that some modern iOS devices actually require a specific voltage across the data lines to tell the device what wattage charger it's using. In that situation you would have to add a couple of resistors to the charging cable between the voltage and data pins, which definitely makes it a lot more difficult for most people. You might find the following interesting: http://www.ladyada.net/make/mintyboost/icharge.html http://www.ladyada.net/make/mintyboost/icharge.html
  - gwillen 14y ago
    You're right -- as an Android user, I was thinking about the USB 3.0 charging standard (and the pre-standard behavior which led to it), which Android devices generally follow. If you have an iDevice, you have more work to do.
error54 14y ago
If what he says is true, it's ridiculous that phones do this be default. Some clever hacker could create a virus that would sit dormant until your phone was plugged into your computer upon which it would steal all of your data. You'd think phone manufacturers would include some sort of way to disable auto-data sync as leaving it on is a major security risk given the number of people that charge via their computers.
ChuckMcM 14y ago
Clever hack. It suggests a product, a USB condom, the device has a USB plug and a USB socket, it connects the power lines but not the data lines. With a bit a careful surgery on a USB cable you could manually do this. I don't know if it would then charge though. A surefire way to build it would be to use an "FTDI cable" [1] and pull the power of to a USB socket. [1] https://www.sparkfun.com/products/9718 https://www.sparkfun.com/products/9718
- solox3 14y ago
  > I don't know if it would then charge though An Android device would charge as quickly as if "fast charge" (charging with data lines as well) is turned off permanently. It's a considerable drawback, because now it will take four hours to charge up instead of two.
- sneak 14y ago
  SO MUCH EASIER: Carry a tiny AC->USB adapter and a USB->mini or USB->dock or USB->lightning cable. Plug into mains on these charging stations instead of USB. Done and done. Added bonus: You can charge when you get to the hotel, too.
  - ChuckMcM 14y ago
    I realize you are being funny but what you seem to have missed (or perhaps you haven't experienced it) are public areas with exactly zero power outlets and several "charging stations." Granted airports and what not are slowly coming around but having a 'red' charging cord which not only worked in your AC charger but could also be plugged into a random charging station and "do the right thing without putting you at risk" that would be moderately handy gizmo.
- gwillen 14y ago
  You would want to do something clever with the data lines. If you are making the 'USB condom' for yourself, just short the data lines at the device end to enable fast charging (and be careful never to plug it into a computer.) If you're making it as a product, the thing to do is this: Have the 'USB condom' try to enumerate as a device, and request the maximum power draw possible, then offer the same to the chained USB device. If the 'USB condom' detects shorted data lines (meaning a fast charger), then short the downstream data lines to the device. You could probably sell these for a decent price, once this story gets out. :-)
Dylan16807 14y ago
So did this actually test if the phones were vulnerable? I know my phone doesn't turn on usb mass storage mode without asking; but this article doesn't even mention other methods.
follower 14y ago
If you have a multi-connector charge-only cable it's likely that the data lines aren't connected, so that's an option. (Unless it's a multi-headed cable like: <https://www.sparkfun.com/products/11515>. https://www.sparkfun.com/products/11515>.)
venomsnake 14y ago
My Desire hd presents itself as a dumb brick by default. Until I explicitly say it to be something else it just sucks up juice. So maybe a bit more info like models, brands etc will be good to have.
pixelcort 14y ago
For newer iOS devices, I was under the impression that if a passcode is set and the screen is locked, the USB host can't access the contents of the device until the passcode is entered. However, once the screen is unlocked, iTunes on the host can obtain tokens to automatically unlock the device later on. Do newer Android devices also have something similar to this?
- drivebyacct2 14y ago
  Yeah, not sure when, but it's been the case that the MTP/UMS was unavailable if the lock screen was locked (with a pattern/pin/pw). I'm not sure if that also applies to adb. (If it doesn't, then the protection is useless since adb can pull data).
  - gwillen 14y ago
    I think the theory is supposed to be that you don't enable adb unless you know what you're doing. (As far as I can recall, adb works fine with the screen locked. The fact that I don't know for sure suggests that I do not, in fact, know what I am doing...)
CaptainZapp 14y ago
Wouldn't work on my Nokia N900. If it's just pure juice coming out of the connector it just loads. If there's some process that tries to initiate a data connection you get two buttons, asking:if you want a PC-Suite, or a mass storage connection. That would look pretty fishy when I just try to juice up my phone. That said I think he makes a very valid point and my phone is pretty much an exception nowadays (as, unfortunately are Nokia smart phones in general).
jff 14y ago
Damn, this is actually rather disturbing--my Nexus 4 automatically presents USB storage when I plug it in, and I can't figure out how to disable it! Locked or unlocked, you can access my files by simply plugging in the phone. Edit: Figured it out, it actually only presents storage when plugged in if you unlock the phone. If you unplug the phone, let it lock, then plug it back in again, you're ok.
RenierZA 14y ago
Which phones are unsafe when they are turned off?
f055 14y ago
You can prevent this with a simple and cheap Nokia DC-16 portable charger put between the charging station and your phone.

32 points by niyazpk 14y ago

There is one easy way to solve this problem that I can think of: Neuter a USB cable by shorting the data pins on the device end and disconnecting them on the charger end. Just be careful not to plug the resulting cable into a computer -- you are likely to draw more current than permitted by the USB spec, and could potentially cause an issue. (I suppose you could potentially cause an issue with a charging kiosk too, if it's a computer rather than a dumb brick, but it's not really the kiosk I'm worried about.)

raverbashing 14y ago
Do you need to short the data end at the device? Probably not It may make sense to not leave them "floating", not sure how chargers do (I mean, not considering the ones that do some electric tricks for the device to recognize their "vendor extensions")
- gwillen 14y ago
  If you want a standards-compliant 'fast charge', you need to short the data lines to the device. If you merely cut the data lines, I don't know what the device will do. Probably it will draw 100mA, which is the permissible draw for a USB device that hasn't connected to the host yet, and then it will repeatedly try and fail to connect.
maxjus 14y ago
I know that some modern iOS devices actually require a specific voltage across the data lines to tell the device what wattage charger it's using. In that situation you would have to add a couple of resistors to the charging cable between the voltage and data pins, which definitely makes it a lot more difficult for most people. You might find the following interesting: http://www.ladyada.net/make/mintyboost/icharge.html http://www.ladyada.net/make/mintyboost/icharge.html
- gwillen 14y ago
  You're right -- as an Android user, I was thinking about the USB 3.0 charging standard (and the pre-standard behavior which led to it), which Android devices generally follow. If you have an iDevice, you have more work to do.

error54 14y ago

If what he says is true, it's ridiculous that phones do this be default. Some clever hacker could create a virus that would sit dormant until your phone was plugged into your computer upon which it would steal all of your data. You'd think phone manufacturers would include some sort of way to disable auto-data sync as leaving it on is a major security risk given the number of people that charge via their computers.

ChuckMcM 14y ago

Clever hack. It suggests a product, a USB condom, the device has a USB plug and a USB socket, it connects the power lines but not the data lines. With a bit a careful surgery on a USB cable you could manually do this. I don't know if it would then charge though. A surefire way to build it would be to use an "FTDI cable" [1] and pull the power of to a USB socket. [1] https://www.sparkfun.com/products/9718 https://www.sparkfun.com/products/9718

solox3 14y ago
> I don't know if it would then charge though An Android device would charge as quickly as if "fast charge" (charging with data lines as well) is turned off permanently. It's a considerable drawback, because now it will take four hours to charge up instead of two.
sneak 14y ago
SO MUCH EASIER: Carry a tiny AC->USB adapter and a USB->mini or USB->dock or USB->lightning cable. Plug into mains on these charging stations instead of USB. Done and done. Added bonus: You can charge when you get to the hotel, too.
- ChuckMcM 14y ago
  I realize you are being funny but what you seem to have missed (or perhaps you haven't experienced it) are public areas with exactly zero power outlets and several "charging stations." Granted airports and what not are slowly coming around but having a 'red' charging cord which not only worked in your AC charger but could also be plugged into a random charging station and "do the right thing without putting you at risk" that would be moderately handy gizmo.
gwillen 14y ago
You would want to do something clever with the data lines. If you are making the 'USB condom' for yourself, just short the data lines at the device end to enable fast charging (and be careful never to plug it into a computer.) If you're making it as a product, the thing to do is this: Have the 'USB condom' try to enumerate as a device, and request the maximum power draw possible, then offer the same to the chained USB device. If the 'USB condom' detects shorted data lines (meaning a fast charger), then short the downstream data lines to the device. You could probably sell these for a decent price, once this story gets out. :-)

Dylan16807 14y ago

So did this actually test if the phones were vulnerable? I know my phone doesn't turn on usb mass storage mode without asking; but this article doesn't even mention other methods.

follower 14y ago

If you have a multi-connector charge-only cable it's likely that the data lines aren't connected, so that's an option. (Unless it's a multi-headed cable like: <https://www.sparkfun.com/products/11515>. https://www.sparkfun.com/products/11515>.)

venomsnake 14y ago

My Desire hd presents itself as a dumb brick by default. Until I explicitly say it to be something else it just sucks up juice. So maybe a bit more info like models, brands etc will be good to have.

pixelcort 14y ago

For newer iOS devices, I was under the impression that if a passcode is set and the screen is locked, the USB host can't access the contents of the device until the passcode is entered. However, once the screen is unlocked, iTunes on the host can obtain tokens to automatically unlock the device later on. Do newer Android devices also have something similar to this?

drivebyacct2 14y ago
Yeah, not sure when, but it's been the case that the MTP/UMS was unavailable if the lock screen was locked (with a pattern/pin/pw). I'm not sure if that also applies to adb. (If it doesn't, then the protection is useless since adb can pull data).
- gwillen 14y ago
  I think the theory is supposed to be that you don't enable adb unless you know what you're doing. (As far as I can recall, adb works fine with the screen locked. The fact that I don't know for sure suggests that I do not, in fact, know what I am doing...)

CaptainZapp 14y ago

Wouldn't work on my Nokia N900. If it's just pure juice coming out of the connector it just loads. If there's some process that tries to initiate a data connection you get two buttons, asking:if you want a PC-Suite, or a mass storage connection. That would look pretty fishy when I just try to juice up my phone. That said I think he makes a very valid point and my phone is pretty much an exception nowadays (as, unfortunately are Nokia smart phones in general).

jff 14y ago

Damn, this is actually rather disturbing--my Nexus 4 automatically presents USB storage when I plug it in, and I can't figure out how to disable it! Locked or unlocked, you can access my files by simply plugging in the phone. Edit: Figured it out, it actually only presents storage when plugged in if you unlock the phone. If you unplug the phone, let it lock, then plug it back in again, you're ok.

RenierZA 14y ago

Which phones are unsafe when they are turned off?

f055 14y ago

You can prevent this with a simple and cheap Nokia DC-16 portable charger put between the charging station and your phone.