7 ms·
It's going to be interesting, from a security standpoint. One of the original cracks on the PS3 was via the USB stack. I'd not go plugging my computers or phone
by kabdib 13y ago
It's going to be interesting, from a security standpoint. One of the original cracks on the PS3 was via the USB stack. I'd not go plugging my computers or phones into jacks that I don't necessarily control.
I can see a market for buffering devices that allow power through, and perhaps do power negotiation for you, but that do not allow data traffic. I believe these devices already exist. though I don't know how sophisticated they are.
- x0x0 13y ago(I'm not an engineer). I a similar article; iirc android phones could be owned by plugging them into a hostile usb connection. I wonder, though, if you couldn't produce a simple adapter that just drops some of the pins? Maybe I don't know enough about usb.
- mattstreet 13y agoYep they make charging only cables and I THINK adapters as well, I quit looking after the first find: http://www.amazon.com/Retractable-Micro-Charging-Cables-FUNCTION/dp/B004A8OMLQ http://www.amazon.com/Retractable-Micro-Charging-Cables-FUNC...
- sliverstorm 13y agoYou can make a power-pin-only USB connector, but I believe that precludes requesting high-current mode (i.e. you are stuck in 100mA mode)
- nickff 13y agoMost hosts will provide at least 500mA without any signal from a device. Hosts and chargers vary in their current capability; those capable of providing more than standard USB spec vary in their implementation. In general, high current hosts always provide their full capability, and the devices are the ones which require some signal to indicate maximum current available. Other devices increase their current draw until the host's voltage drops, and hold at that level (or less).
- sliverstorm 13y agoOk, so maybe I had it backwards which way the communication goes.
- nickff 13y agoI wouldn't say you got it backwards, the communication is bilateral, but the device is the unit which controls current flow; the effect is the same.
- nickff 13y agoSpeaking as someone who writes embedded software using USB stacks for a living, there are a number of solutions to this. Your solution is possible, and is how many iPhone USB charging cables are designed. If limited communication is required, the device being charged can also contain a separate processor for the interface. The ideal solution is for the device to contain some security measures, to prevent these issues; this solution is also the least versatile or most costly depending on implementation, and may not be achievable.
- jdietrich 13y agoYou can buy just such an adapter from the link below; Version 2 is in the works, which will include a microprocessor to allow for full-power charging. http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms
- x0x0 13y agothank you jdietrich
- em3rgent0rdr 13y agosurely this could be a software fix: tell usb driver to use special mode that is only allowed to use data line to negotiate power levels, before you plug into an untrusted power source.
- nine_k 13y agoThat special mode code and negotiation code is what malware authors will target. For hostile / high security environments, I'd rather have it in a special charging-only hub (good luck pwning such a device) that physically lacks the data wires on the output socket.
- nickff 13y agoI believe that this is what Apple implemented with their "do you trust this computer" dialog in the newest versions of iOS.
- kabdib 13y agoNow you have to trust the driver. And depend on there not being "test modes" in the hardware that can be turned on (USB 3.0 is a pretty complex beastie; frankly, if I were a spook agency I'd want to have doors in via seldom-examined ports like USB).
- sigvef 13y agoThere are USB condoms http://www.usbcondoms.com/ http://www.usbcondoms.com/
- mjn 13y agoHN discussion: https://news.ycombinator.com/item?id=6379272 https://news.ycombinator.com/item?id=6379272
- jakobe 13y agoEven worse than USB is Firewire, which, if I am not mistaken, gives direct memory access to whatever device is connected. However, manufacturers are already realising that blindly trusting every USB host is a bad idea. For example, iPhones now ask if you want to trust if you connect to a previously unknown computer via USB. If you chose not to, your iPhone will take power, but won't allow data access. Therefore it's no longer possible to create a device that looks like a charger but that actually downloads all the photos from your phone.
- nwh 13y ago> Even worse than USB is Firewire, which, if I am not mistaken, gives direct memory access to whatever device is connected. Both FireWire and Thunderbolt offer DMA. There's publicly available tools that allow you to extract passwords, remove lock screens and find keys in the memory of running devices using either type of port.
- phaer 13y agoPlus PCMCIA and ExpressCard, so most laptops are vulnerable out of the box[1], but there are some ways to mitigate those attacks. See https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack [1]...if you plug untrusted devices into your expansion slots or leave your laptop unattended.
- sp332 13y agoMy favorite FireWire hack was when a guy took a friend's laptop, which did not even have FireWire. He plugged in a FW card at the boot prompt. The computer auto-installed the driver, and the attack proceeded...
- jakobe 13y agoHere's a good article on vulnerabilities in Thunderbolt: http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbolt-dma-land-hacking-macs-through-the-thunderbolt-interface/ http://www.breaknenter.org/2012/02/adventures-with-daisy-in-... Turns out OS X 10.7 and later at least disable DMA access while the computer is locked (unless fast user switching is turned on).
- xlayn 13y agoor you can just cut the two data cables or put a piece of tape on the two data connectors on a usb2 cable.... pleaaaase and it's almost free...