11 ms·
Don't Plug Your Phone into a Charger You Don't Own
- uptown 13y agoI've always wondered how safe those dirt-cheap USB hubs on eBay are. Seems like a potential attack vector for unsuspecting buyers where you also likely know the name and address of the victim from shipping it to them.
- DavidWanjiru 13y agoInstead of carrying a power pack or USB condom and what not, isn't it just easier to carry the charger you trust? After all, it's the untrusted charger you want to avoid, no?
- batemanesque 13y agoon the subject: http://www.macobserver.com/tmo/article/apple-fixes-threat-from-fake-iphone-chargers-in-ios-7 http://www.macobserver.com/tmo/article/apple-fixes-threat-fr...
- jgrahamc 13y agoI was on a BA Boeing 777 the other day and the seat back entertainment system had a USB socket on it for me to plug in my own device. All I could think was (a) why would I do that? and (b) that looks like a security vulnerability.
- kalleboo 13y ago> (a) why would I do that? To charge your phone? Also, some of these IFE systems can play back MP4 files stored on USB mass storage devices. The Singapore Airlines IFE system even has Star Office so you can edit office documents without a computer. http://www.flickr.com/photos/82365211@N00/2473197320/in/photolist-4LxMp7 http://www.flickr.com/photos/82365211@N00/2473197320/in/phot...
- senorprogrammer 13y agoMost IFE systems are air-gapped from flight control systems, if that's what you're worrying about.
- Robin_Message 13y agoMost? Now I am worried.
- arjunnarayan 13y agoThe new 787 isn't, ostensibly to save weight. And now I'm on some watchlist somewhere.
- stevenrace 13y agoPaper: https://media.blackhat.com/us-13/US-13-Lau-Mactans-Injecting-Malware-into-iOS-Devices-via-Malicious-Chargers-WP.pdf https://media.blackhat.com/us-13/US-13-Lau-Mactans-Injecting... Slides: https://media.blackhat.com/us-13/US-13-Lau-Mactans-Injecting-Malware-into-iOS-Devices-via-Malicious-Chargers-Slides.pdf https://media.blackhat.com/us-13/US-13-Lau-Mactans-Injecting...
- nwh 13y agoYou could alternatively use a USB condom; just a cable with the data lines completely removed. (Well, for an iPhone they'd need to be tied together with a resistor in the other end, but the idea is still the same.)
- rainforest 13y agoThe attack relies on the phone being unlocked for it to give up its UDID (and allow them to push the signed malware to it). If your phone is locked (with passcode) it won't be able to attack it as reliably. You can observe the same effect sometimes with iTunes (it complains the phone can't be read until it's unlocked). They did mention a fix is coming in iOS 7 (explicit approval prompt on the device), but until then your "USB condom" is probably as good a stopgap as any.
- threeseed 13y agoIt has been introduced in the latest iOS 7 beta 4 and asks if you want to trust each computer it is connected to.
- nwh 13y agoIt's fairly standard for me to use my iPhone while it is plugged in though. I wouldn't rely on the lockscreen presenting any real security in the face of unknown attacks.
- prof_hobart 13y agoAt least it's providing security against a known attack.
- voltagex_ 13y agoIsn't that closer to a USB vasectomy? (not a sentence I thought I'd ever write)
- StavrosK 13y agoIt... actually is pretty much that.
- cjrp 13y agoA few of these plugged in at airport boarding areas with a "For your convenience" sign would be very successful.
- msy 13y agoI'd pay decent money for a small, neat little power-only USB passthrough/condom for peace of mind. Hotel clocks, planes, there's all sorts of places I'd like to charge my phone and every time it feels like a risk.
- pinko 13y agoFrom the last time this came up, I found a few: https://news.ycombinator.com/item?id=5814193 https://news.ycombinator.com/item?id=5814193
- MattJ100 13y agohttp://www.indiegogo.com/projects/portpilot-charge-with-speed-and-security http://www.indiegogo.com/projects/portpilot-charge-with-spee... :) (not affiliated)
- voltagex_ 13y agoI'd pay decent money for a small, USB adapter with the ability to swap the pins (for international travel) and a guarantee that it would reach at least 1.8A and 5V.
- nwh 13y agoYou pretty much just described the Apple charger. 10W, with multiple duckheads, will take any voltage and has the option to plug any standard figure 8 cable in if you have one lying around.
- Someone 13y agoWhy only those you don't own? For all I know, the north Koreans/Mossad/NSA/Chinese government/... (Pick whoever you want as the villain) could have planted this functionality in every USB adapter Apple/brand X (pick whoever you feel could fall for this) sells.
- biafra 13y agoIIRC the adapter would need internet access to add your devices UDID to the certificate. Unless they use an enterprise signing certificate.
- 616c 13y agoIt is interesting because there was concern about rooted phones, especially for people like me, because I left ADB debug mode on. For the uninitiated, this USB bridge is like a serial connection that can, among a lot of things, open a terminal on the device. The newest versions of ADB mode in Android have settings to address this. But at the time this was a big deal in the Android community (or I should say XDA), one recognized dev developed an app for it. https://play.google.com/store/apps/details?id=com.stericson.adbSecure&hl=en https://play.google.com/store/apps/details?id=com.stericson.... I am glad all phone platforms are getting wise to these things.
- sheraz 13y agoWow -- this hadn't even crossed my mind. Regarding Android devices (mine included): Could I just hide a tiny linux OS inside a charger? Then when someone plugs in the device just auto-mounts the SD card and copies away? Is it that simple?
- _quasimodo 13y agoDoes android ask you for permission to be mounted or at least notify you? Im still using an old n900 which asks you if you want it to just load its battery, be a modem or be a mass storage device.
- hfsktr 13y agoI'm not sure if this is what you meant but mine always has a prompt of some kind (varied between phones) for connecting to pc. I'm not sure if there is a way to disable that or if it was phone specific.
- sheraz 13y agoNo. My Sony xperia does not ask. It automatically mounts in osx
- dlhavema 13y agoicons popped up in the notification bar that show its being mounted through USB for all the android devices i have ever owned: droid, htc thunderbolt, galaxy s3, xoom...
- npsimons 13y agoSince you've got an N900, you can do even better than that: - Different filesystems (unlikely this would work with anything but FAT based). - Encrypted filesystems. - Simply disabling the capability (I can't remember the last time I used USB data transfer on mine). Of course, it's easy to do the above on a phone you actually have control over. Sorry, iPhone users.
- fnayr 13y agoI don't understand the threat. All it does is install a provisioning profile on the device to allow it to install any app it wants, that can make private API calls that would normally be rejected by Apple if they tried to submit the app. So essentially, it allows them to install apps that have the exact same restrictions as apps for jailbroken devices. Or do I have it wrong?
- jbrechtel 13y agoWell, then it installs an app. And yes, it's the same restrictions as apps for jailbroken devices....and they can take over your phone pretty easily (as described in the article). Sounds like you have the specifics right but may not understand the implications?
- fnayr 13y agoOkay. I just find the originality of the vulnerability exaggerated (e.g. giving the process some special name (mactans) when all it is is a dev account installing an app on a device).
- dllthomas 13y agoThe interesting part is that it can be done invisibly when you thought you were just plugging in to charge.
- danielhughes 13y agoIt would be nice if phone manufacturers would simply separate the power and data ports into two. Designers probably cringe at that suggestion because it would interrupt the sleek form factor but isn't it the best possible solution to this security risk?
- oftenwrong 13y agoMost consumers don't think about security beyond enabling a lock screen. Average people do not think twice about promiscuously plugging their devices into any ports they find. This attack vector is entirely off their radar. On the other hand, gadget purchasers care deeply about sleekness. Based on reactions I have witnessed, I suspect some people may even be sexually aroused by gadget sleekness. Therefore, at this point there is little incentive for a company to sacrifice their product's sleekness for a security enhancement. Until typical customers start caring I do not see a split-port solution happening.
- chadgeidel 13y agoPersonally, I don't want to carry around a bunch of USB cables and a bunch of power cables. USB provides enough power to charge my phone. I'm glad I can charge with a "standard cable" (as long as I take a few simple precautions).
- joshuahedlund 13y ago> It turns out that any device you connect with an iOS via the USB port can obtain your device's Universal Device ID (UDID), as long as the device isn't passcode-locked > The only defense is a very simple rule: don't plug your phone into a charger you don't own These statements seem contradictory to me, unless I'm missing something. Shouldn't it be, "don't unlock your phone while it's plugged into a charger you don't own"? Or are they saying there are still vulnerabilities without the charger getting access to the UDID?
- deleted 13y ago[deleted]
- vinhboy 13y agoThis part also makes this a bit confusing: "As a final (and alarming) demonstration, they showed a Mactans-pwned phone turn itself on, swipe open, enter the passcode, and call another phone." So can they attack a passcode protected phone or not? Also, shouldn't this be one of those bugs they let apple fix first BEFORE they talk about it?
- deveac 13y agoI understood it that the initial attack vector required the target device to be unlocked. Once the malicious code was installed, the attacker could then gain complete control, including passcode unlock.
- xsmasher 13y agoIt sounds like "use a passcode on your phone and NEVER unlock (enter the passcode) while the phone is plugged into this charger" is also a defense. Unlock to check your email while plugged in? Compromised.
- schtev 13y agoJust use a wall socket adapter. Problem solved.
- nly 13y agoWell... we have Ethernet over power line, so why not USB? ;)
- tszming 13y agoIf you can order from Taobao (China) directly, here is the device I bought last week: http://detail.tmall.com/item.htm?spm=a230r.1.14.27.Op5P4y&id=21996816947 http://detail.tmall.com/item.htm?spm=a230r.1.14.27.Op5P4y&id... (not affiliated, around $0.8 USD). Another added advantage in using the device is it can double the current output from my Macbook Air USB port, i.e. from 500ma to 1000ma, so now I can fully charge my Samsung S4 within 4 hrs (as compared to 7-8 hrs previously).
- xedarius 13y agoI knew there was a good reason XCode kept telling me it couldn't launch my app as the device was locked. So unless I missed something, if the device is locked this hack doesn't work.
- yannyu 13y agoAs laid out in the article: It turns out that any device you connect with an iOS via the USB port can obtain your device's Universal Device ID (UDID), as long as the device isn't passcode-locked. It just takes a second, so if you plug in your device while it's unlocked, or unlock it while plugged in, or just don't have a passcode, Mactans can attack.
- molbioguy 13y agoI thought developer accounts were limited to 100 test devices per year. Does this get around that limit?
- elif 13y agoThis title is a bit misleading. It should be 'don't plug your iphone into a charger you don't own' the other 90% of us are unaffected by this hack.
- valleyer 13y agoYour implicit comment that the link only points out an iOS vulnerability is correct, but don't you think it's good advice generally?