10 ms·

USBCondom

247 points by lelf 12y ago

readerrrr 12y ago
Looks like this is equivalent to a dedicated usb charger. There should be an option to enable data transfer, currently you have to physically remove it. I would love to have something like this, if it enabled my devices to be read only; some usb flash drives have a physical button to enable that.
- almost 12y ago
  Enabling for read-only in the general case simply wouldn't be possible. The device would have to know every USB protocol that could possibly be spoken and which commands are for reading and which for writing (and what to do with commands that do both). You could maybe make now that only worked for USB storage devices and only allowed reading, but it would likely be complex and have other downsides (lack of performance and compatability issues probably) that would make it not worth it.
  - xg15 12y ago
    This would basically be a packet-inspecting firewall for USB instead of IP. I agree that this would pose a number of technical challanges as a lot of the tools and optimizations we have in IP stacks don't exist for USB, but I don't see how that would be principally impossible. In fact, as there is a lot more standardization in USB profiles than in IP protocols, it might even be easier. I.e. if you just inspected messages of the mass storage profile and blocked everything else, you might already get pretty far. I agree that the performance problem would stay though.
    - almost 12y ago
      I don't think you could make a IP firewall that enforced read-only either, at least not in a general case.
      - btgeekboy 12y ago
        You'd have to have knowledge of what protocol was being spoken. Otherwise, you don't know of if a packet going back the "wrong" direction is a control mechanism (request for data, flow control, etc) or data itself. In terms of ethernet, you could possibly do UDP, but you lose any sort of error handling or flow control.
petercooper 12y ago
Electronics people: why are there any components in this at all? If it's just about disconnecting certain pins, couldn't it just pass the power lines through and be half the size without a PCB at all? For example, it could easily be a cable missing two wires, right? (Note: I'm an idiot when it comes to electronics, so I'm genuinely interested.)
- xg15 12y ago
  According to the USB spec, a device must complete a protocol handshake and declare a desired voltage level before the host is allowed to supply anything more than a minimum voltage. In case of the USB condom, this handshake would have to be executed by the condom. I'm not sure how widely implemented this behavior is for "dumb" USB chargers though, as opposed to actual hosts though. But it might be that they want to preserve compatibility with actual hosts, in case that you i.e. want to charge on a public PC. Or they want to make sure that even if your charger is actually a disguised malicious device, you can still use it as a charger, which would be kinda ironic.
  - lockedusb 12y ago
    That's correct. LockedUSB adapter disconnect the data lines however it have an internal controller that still negotiate and complete the USB handshakes so the device can charger faster while being safe. http://www.lockedusb.com http://www.lockedusb.com
- maaaats 12y ago
  Maybe some devices don't charge at max rate when they sense something "wrong" with the cable. Or the other way around, a computer may not deliver power if it doesn't sense anything actually connected to the power. Just speculation.
- mbell 12y ago
  The USB spec identifies different types of charging ports based on the resistance / voltage connected to the data pins. Here's a chart with the USB spec (on the ends) and a couple manufacturer variants: http://i.stack.imgur.com/gWODO.jpg http://i.stack.imgur.com/gWODO.jpg
lucb1e 12y ago
Or you just cut two wires in a normal USB cable. No need to buy condoms! I think the board is because some power sources might go "hey I'm leaking, there is no device but I draw power!" and cut it off, but I only ever heard about it and never encountered it. My USB ports nicely power fans without ever having a data connection to anything.
- LeoPanthera 12y ago
  Cutting the wires will cause iDevices to charge at 500mA only.
  - lucb1e 12y ago
    Okay that explains then: Apple needs to be a bitch about things again.
    - joosters 12y ago
      USB charging ports use the data pins to signal a request for more than 500mA. If you disconnect the data pins, how can any device (apple or anyone else) get more?
      - serf 12y ago
        The charge pins on a battery charging input could be used as a makeshift i2c to communicate with a smart battery chipset, thus communicating the same intentions ("hay! give me more!") without any additional wiring or need for access to the USB subsystem, while making use of the USB form-factor that's so ubiquitous today. if lithium batteries weren't so problematic when overcharged you could float-charge everything pretty efficiently, then you wouldn't even need a management system. Our current way of doing things is probably here to stay, though.
        joosters 12y ago
        Since the whole concept of this 'usb condom' is to physically disconnect the data communication, re-designing the protocol to use the remaining pins as a data channel would defeat the whole point.
deleted 12y ago
[deleted]
nly 12y ago
What are the fundamental flaws in the USB protocol that make it insecure? I know firewire allows for DMA, but I didn't think USB, besides being a complex serial protocol, had any intrinsically unsafe features?
- joosters 12y ago
  It's not the protocol but the fact that USB devices are just too trusting. Plug your phone into a USB socket and you've little protection against it communicating with whoever is on the other end of the USB connection.
  - collyw 12y ago
    Is this not why my phone asks me what I want to do when I plug it into the computer? USB debugging mode, charge only, and another option or two that I can't remember right now. If I select "charge only" will I be secure in the same way?
    - prutschman 12y ago
      Unfortunately, this isn't universal.
    - ZoFreX 12y ago
      This really varies from phone to phone, sadly. When I plug mine in I am only given a choice of which protocol to use to give the host computer access to all my files (and it connects using the default one as soon as you plug it in).
- almost 12y ago
  It's the fact that you're using the same cable to charge and for data (which is also one of the things that makes USB really useful), now add that the devices tend to not to be hugely secure and to just trust whatever they've plugged into (or at least trust after popping up an easy to miss dialog) and you have a (potential) problem.
- rasz_pl 12y ago
srslack 12y ago
Be sure to check out http://int3.cc/ http://int3.cc/ Ridley's community project, and watch his talks if you haven't seen those.
flavor8 12y ago
The board looks a little fragile. A tool like this (which is going to be used on the road) needs to be as solid as possible. For $10/unit it seems like they could afford to at least give it an epoxy surround.
- skrebbel 12y ago
  I think it's on purpose. Looks cooler, gets attention of your fellow coffeeshop nerds.
  - serf 12y ago
    yeah, but it's also suspicious looking to a laymen at an airport whose inspecting your luggage. i've been hassled for a cubieboard. (a single board ARM computer). They seem to hate exposed PCBs. You'd think they would have seen quite a few...
  - IshKebab 12y ago
    I doubt it - it's because it's pretty trivial to make a PCB like that with components - one could design the PCB in maybe an hour and then manufacture is really easy and cheap - probably about $1 each for those boards even in low numbers (check OSHPark.com). In contrast, making a case is much much harder. There really aren't any good low-volume case making methods. Injection moulding is out. Machining from aluminium is an option here, but it's very expensive. There's resin casting, but that's difficult and I don't know if it's really suited to manufacture. Honestly, making the case is 10-100 times harder than the PCB (for such a simple one like this anyway).
    - serf 12y ago
      3d printing is an OK solution to low-volume cases. tinkercad.com to create an stl file, and shapeways.com to print it out. (simple) PCB design and production is super quick and easy though, you're absolutely right.
      - IshKebab 12y ago
yoran 12y ago
$10 is expensive for such simple electronics! I understand that the price of the first piece is the highest, but if this gets mass-produced I think the price can easily drop to something like $1.
- rythie 12y ago
  That assumes a massive number of people want this. As it is only geeks understand the risk and even fewer want/need to protect from it.
mayuro 12y ago
Did no one else get that it's a joke?
- daledavies 12y ago
  Is it a joke? IMO the name is bad and would put me off using it in professional/business situations, but everything else about the project seems serious to me.
ulfw 12y ago
Or you could buy one of the charge-only USB cables I saw all over Asia. They are a bit cheaper than the normal data-carrying ones as they have fewer wires.
- kken 12y ago
  This! I got lot's of these things from portable usb batteries.
ColinWright 12y ago
See also the extensive discussion from a year ago: https://news.ycombinator.com/item?id=6379272 https://news.ycombinator.com/item?id=6379272
lazerwalker 12y ago
It's worth noting that this is unnecessary for iOS devices, where plugging your device into an unknown USB port prompts you to either "trust" or "not trust" the computer in question (with "not trust" disabling data transfer).
- TeMPOraL 12y ago
  Do you trust your "trust" and "not trust" settings? Are you sure that there are no backdoors in there, or bugs that could still lead to device getting hacked?
  - lttlrck 12y ago
    Do you trust your (USB) condom?
    - TeMPOraL 12y ago
      Honestly? No. There's a bit too much electronics in that one for my taste. I'd happily trust the one designs of which I audited, and board I soldered myself. But until I get over to doing this, I'll be stuck with just cutting data wires. EDIT: I retract that. From what I can tell, it's just three SMT resistors on that board. So it seems fine to me.
- bsamuels 12y ago
  knowing how well apple does embedded security, there's probably a vulnerability that'll allow bypass of that feature - it's just a matter of how long you want to invest in finding it.
  - aroman 12y ago
    what embedded security screwups has Apple had? (Not asking because I don't believe you, rather because I can't think of any)
    - gurkendoktor 12y ago
shimon 12y ago
Seems like you can already get similar stuff elsewhere for cheaper and with a little plastic around the PCB: http://smile.amazon.com/PortaPow-Fast-Charge-Blackberry-Charging/dp/B00GC4AJOU/ref=sr_1_2?ie=UTF8&qid=1408799798&sr=8-2&keywords=usb+condom http://smile.amazon.com/PortaPow-Fast-Charge-Blackberry-Char...
- Thiz 12y ago
  Exactly, and for just $6.99 Not adding the plastic is being lazy.
cnvogel 12y ago
Or in software (Linux): # cd /sys/bus/usb/devices # for n in usb* ; do echo 0 >$n/authorized_default ; done ...so that no drivers or userspace programs are allowed to communicate with any newly connected devices. https://www.kernel.org/doc/Documentation/usb/authorization.txt https://www.kernel.org/doc/Documentation/usb/authorization.t... Of course this only prevents the USB host, you'd have to disable all USB-gadget daemons on your android phone to not have the charger tinker with the phones's data. NOTE/added: I just realized that the main purpose this is marketed is to protect the phone's data. I'd me more worried about the computer if someone asks me to lend some juice...
- mindstab 12y ago
  yeah but then there is badusb http://www.wired.com/2014/07/usb-security/ http://www.wired.com/2014/07/usb-security/ which attacks the usb firmware on devices. ANY data communication and your usb device/port itself can get hacked the usb condom might actually prevent that,
  - Dylan16807 12y ago
    Are you sure? As far as I could tell that thing was about messing with the firmware after you've already gotten control through normal communication.
classicsnoot 12y ago
In terms of a protective cover/case, maybe there is a cheap, everyday item or container it would fit into nicely. I put pen springs around all of my cable heads.
mindslight 12y ago
Mobile USB charging ports (as found in airports etc) are more of a gimmick than anything else. A shoddy one will easily damage your device, and if you're constantly plugging into different ones, that seems like just a matter of time. Plus, an unknown one will most likely just put out 500mA (slower charging), and USB A connectors aren't made for high insertion cycles so expect flaky connections. Plus you still have to carry the bulkiest part (the cable) so you still need kit. I personally just carry a three way AC power splitter cube while traveling, which gives me enough ports for laptop+phone+whomever I ask to share with.
fencepost 12y ago
There are multiple projects/products out there for this, some of which are linked here and some of which are not. Not all are currently available. There was a fair amount of discussion and useful information in a Brian Krebs article: http://krebsonsecurity.com/2014/06/gear-to-block-juice-jacking-on-your-mobile/ http://krebsonsecurity.com/2014/06/gear-to-block-juice-jacki... USB Condom: ~$10, available. Tends towards either a bare board with USB connectors or that board with plastic shrink tubing on it. (https://www.crowdsupply.com/xipiter/usbcondom https://www.crowdsupply.com/xipiter/usbcondom) (http://www.usbcondoms.com/ http://www.usbcondoms.com/) (probably an earlier version but the same person: http://int3.cc/collections/frontpage/products/usbcondoms http://int3.cc/collections/frontpage/products/usbcondoms) UmbrellaUSB: ~$12, available soon? More polished/finished looking than the USBCondom, got their information on voltages from the USBCondom folks (see comments in the Krebs article above). Working on fulfillment of their Kickstarter (funded July 3). (http://www.umbrellausb.com/ http://www.umbrellausb.com/) ChargeDefense: ~$??, a "coming soon" page, a picture of a prototype, and maybe more in September. (http://www.chargedefense.com/ http://www.chargedefense.com/) LockedUSB: ~$20, available. More technical details available, more expensive and very blocky looking - expect it to block any adjacent ports. Technical information indicates that the single unit should work with both Apple and non-Apple devices (https://lockedusb.com/product/lockedusb-adapter-charger-firewall-power-optimizer/ https://lockedusb.com/product/lockedusb-adapter-charger-fire...) Practical Meter: ~$20, available. Protects ONLY when used with their optimized 3-in-1 charging cables otherwise passes data through. Provides a 5-bar indicator of current. (http://www.powerpractical.com/product/practical-meter http://www.powerpractical.com/product/practical-meter) more details in their kickstarter (https://www.kickstarter.com/projects/david-toledo/the-practical-meter-know-your-power https://www.kickstarter.com/projects/david-toledo/the-practi...) PortPilot: ~$60, not yet available. Much more expensive, MUCH more informative, switchable between data/no data. Includes a display showing possible and actual power draw, etc. Almost a development/diagnostic device. (https://hakshop.myshopify.com/products/portpilot https://hakshop.myshopify.com/products/portpilot) At least 3 listed below via Amazon (2 in UK): PortaPow $7 (2 versions, www.amazon.com/gp/product/B00GC4AJOU, looks like a "beat you to market" device), and Pisen ~$1.70 (http://www.amazon.co.uk/dp/B00E8ALIYU http://www.amazon.co.uk/dp/B00E8ALIYU and http://www.amazon.co.uk/dp/B00E8AJ41E http://www.amazon.co.uk/dp/B00E8AJ41E).
- 12y ago
geuis 12y ago
Honestly the Wired quote is a much better summary and gets right to the point. "Many public locations now offer USB charging stations, but it's a trivial task to modify one of these to allow an attacker to access your data. Int3.cc's device cuts off access to the data transfer pins on the USB port, while still permitting access to the power supply." Way too many words on that page before just getting to the damned point.
Sephr 12y ago
I'd pay more for something like a "smart usb condom" which does allow data but only just for power negotiation, so that my devices can still negotiate for higher power when available.
sbierwagen 12y ago
We resell something similar, from DFRobot: http://www.robotmesh.com/usb-power-detector http://www.robotmesh.com/usb-power-detector One of the ports has the data lines connected, the other port doesn't, so it could be used as a USB condom.
tomphoolery 12y ago
Oh...I thought this was a...um... Never mind.
- ihsanyounes90 12y ago
  :0 ok it's another sht
MAGZine 12y ago
I can't help but wonder if we'll see USB condoms that help to protect against spying through EM/power draw changes, i.e. to spy on decryption activities.
ufo 12y ago
I wonder if it would be possible to use a similar system to make a usb hard disk read-only. This would make it easy to avoid malicious computers transferring pesky autoexec.inf files and things like that.
nyar 12y ago
If I can get a flash drive for $10 I should be able to get this for <$5. I'll wait until the novelty wears off and get it for $1 from china, on Ebay.
dbbolton 12y ago
Couldn't a person just cut the green and white wires in their charging cable if they were concerned about this?
Springtime 12y ago
Had hoped from the title the product would be a way to switch a USB drive from read/write to enforced read-only mode to protect from malware on unknown hosts. Would be a nice product in itself.
uaygsfdbzf 12y ago
10$ for the piece is ridiculous! someone is ..
sirwolfgang 12y ago
I feel someone should point out that the iPhone charger uses the data lines to basically ask for the available amperage, and charger faster if the charger is "iPhone compatible". So something like this will still work for iPhone but it will force it to charge much slower then it would otherwise. > https://learn.adafruit.com/minty-boost/icharging https://learn.adafruit.com/minty-boost/icharging
guelo 12y ago
If you're going to carry this around why not just carry a wall charger instead?
djrogers 12y ago
I use a $10 usb 'lipstick' battery for the same thing - it charges itself and the phone, no data. Plus I get a free battery to charge my phone when there isn't an outlet available...
chargedefense 12y ago
ChargeDefense's website is live and we are taking pre-orders. We have our Juice-Jack Defender (500mA) for $12 and our Juice-Jack Defender Turbo (1A) for $15. We have volume prices and can do customized case with your company colors and company logos. ChargeDefense also had a array of other products, wall charges, battery pack, and cables. We will start shipping orders out this month. Please visit our website for more information.

247 points by lelf 12y ago

Looks like this is equivalent to a dedicated usb charger. There should be an option to enable data transfer, currently you have to physically remove it. I would love to have something like this, if it enabled my devices to be read only; some usb flash drives have a physical button to enable that.

almost 12y ago
Enabling for read-only in the general case simply wouldn't be possible. The device would have to know every USB protocol that could possibly be spoken and which commands are for reading and which for writing (and what to do with commands that do both). You could maybe make now that only worked for USB storage devices and only allowed reading, but it would likely be complex and have other downsides (lack of performance and compatability issues probably) that would make it not worth it.
- xg15 12y ago
  This would basically be a packet-inspecting firewall for USB instead of IP. I agree that this would pose a number of technical challanges as a lot of the tools and optimizations we have in IP stacks don't exist for USB, but I don't see how that would be principally impossible. In fact, as there is a lot more standardization in USB profiles than in IP protocols, it might even be easier. I.e. if you just inspected messages of the mass storage profile and blocked everything else, you might already get pretty far. I agree that the performance problem would stay though.
  - almost 12y ago
    I don't think you could make a IP firewall that enforced read-only either, at least not in a general case.
    - btgeekboy 12y ago
      You'd have to have knowledge of what protocol was being spoken. Otherwise, you don't know of if a packet going back the "wrong" direction is a control mechanism (request for data, flow control, etc) or data itself. In terms of ethernet, you could possibly do UDP, but you lose any sort of error handling or flow control.

petercooper 12y ago

Electronics people: why are there any components in this at all? If it's just about disconnecting certain pins, couldn't it just pass the power lines through and be half the size without a PCB at all? For example, it could easily be a cable missing two wires, right? (Note: I'm an idiot when it comes to electronics, so I'm genuinely interested.)

xg15 12y ago
According to the USB spec, a device must complete a protocol handshake and declare a desired voltage level before the host is allowed to supply anything more than a minimum voltage. In case of the USB condom, this handshake would have to be executed by the condom. I'm not sure how widely implemented this behavior is for "dumb" USB chargers though, as opposed to actual hosts though. But it might be that they want to preserve compatibility with actual hosts, in case that you i.e. want to charge on a public PC. Or they want to make sure that even if your charger is actually a disguised malicious device, you can still use it as a charger, which would be kinda ironic.
- lockedusb 12y ago
  That's correct. LockedUSB adapter disconnect the data lines however it have an internal controller that still negotiate and complete the USB handshakes so the device can charger faster while being safe. http://www.lockedusb.com http://www.lockedusb.com
maaaats 12y ago
Maybe some devices don't charge at max rate when they sense something "wrong" with the cable. Or the other way around, a computer may not deliver power if it doesn't sense anything actually connected to the power. Just speculation.
mbell 12y ago
The USB spec identifies different types of charging ports based on the resistance / voltage connected to the data pins. Here's a chart with the USB spec (on the ends) and a couple manufacturer variants: http://i.stack.imgur.com/gWODO.jpg http://i.stack.imgur.com/gWODO.jpg

lucb1e 12y ago

Or you just cut two wires in a normal USB cable. No need to buy condoms! I think the board is because some power sources might go "hey I'm leaking, there is no device but I draw power!" and cut it off, but I only ever heard about it and never encountered it. My USB ports nicely power fans without ever having a data connection to anything.

LeoPanthera 12y ago
Cutting the wires will cause iDevices to charge at 500mA only.
- lucb1e 12y ago
  Okay that explains then: Apple needs to be a bitch about things again.
  - joosters 12y ago
    USB charging ports use the data pins to signal a request for more than 500mA. If you disconnect the data pins, how can any device (apple or anyone else) get more?
    - serf 12y ago
      The charge pins on a battery charging input could be used as a makeshift i2c to communicate with a smart battery chipset, thus communicating the same intentions ("hay! give me more!") without any additional wiring or need for access to the USB subsystem, while making use of the USB form-factor that's so ubiquitous today. if lithium batteries weren't so problematic when overcharged you could float-charge everything pretty efficiently, then you wouldn't even need a management system. Our current way of doing things is probably here to stay, though.
      - joosters 12y ago
        Since the whole concept of this 'usb condom' is to physically disconnect the data communication, re-designing the protocol to use the remaining pins as a data channel would defeat the whole point.

deleted 12y ago

[deleted]

nly 12y ago

What are the fundamental flaws in the USB protocol that make it insecure? I know firewire allows for DMA, but I didn't think USB, besides being a complex serial protocol, had any intrinsically unsafe features?

joosters 12y ago
It's not the protocol but the fact that USB devices are just too trusting. Plug your phone into a USB socket and you've little protection against it communicating with whoever is on the other end of the USB connection.
- collyw 12y ago
  Is this not why my phone asks me what I want to do when I plug it into the computer? USB debugging mode, charge only, and another option or two that I can't remember right now. If I select "charge only" will I be secure in the same way?
  - prutschman 12y ago
    Unfortunately, this isn't universal.
  - ZoFreX 12y ago
    This really varies from phone to phone, sadly. When I plug mine in I am only given a choice of which protocol to use to give the host computer access to all my files (and it connects using the default one as soon as you plug it in).
almost 12y ago
It's the fact that you're using the same cable to charge and for data (which is also one of the things that makes USB really useful), now add that the devices tend to not to be hugely secure and to just trust whatever they've plugged into (or at least trust after popping up an easy to miss dialog) and you have a (potential) problem.
rasz_pl 12y ago

srslack 12y ago

Be sure to check out http://int3.cc/ http://int3.cc/ Ridley's community project, and watch his talks if you haven't seen those.

flavor8 12y ago

The board looks a little fragile. A tool like this (which is going to be used on the road) needs to be as solid as possible. For $10/unit it seems like they could afford to at least give it an epoxy surround.

skrebbel 12y ago
I think it's on purpose. Looks cooler, gets attention of your fellow coffeeshop nerds.
- serf 12y ago
  yeah, but it's also suspicious looking to a laymen at an airport whose inspecting your luggage. i've been hassled for a cubieboard. (a single board ARM computer). They seem to hate exposed PCBs. You'd think they would have seen quite a few...
- IshKebab 12y ago
  I doubt it - it's because it's pretty trivial to make a PCB like that with components - one could design the PCB in maybe an hour and then manufacture is really easy and cheap - probably about $1 each for those boards even in low numbers (check OSHPark.com). In contrast, making a case is much much harder. There really aren't any good low-volume case making methods. Injection moulding is out. Machining from aluminium is an option here, but it's very expensive. There's resin casting, but that's difficult and I don't know if it's really suited to manufacture. Honestly, making the case is 10-100 times harder than the PCB (for such a simple one like this anyway).
  - serf 12y ago
    3d printing is an OK solution to low-volume cases. tinkercad.com to create an stl file, and shapeways.com to print it out. (simple) PCB design and production is super quick and easy though, you're absolutely right.
    - IshKebab 12y ago

yoran 12y ago

$10 is expensive for such simple electronics! I understand that the price of the first piece is the highest, but if this gets mass-produced I think the price can easily drop to something like $1.

rythie 12y ago
That assumes a massive number of people want this. As it is only geeks understand the risk and even fewer want/need to protect from it.

mayuro 12y ago

Did no one else get that it's a joke?

daledavies 12y ago
Is it a joke? IMO the name is bad and would put me off using it in professional/business situations, but everything else about the project seems serious to me.

ulfw 12y ago

Or you could buy one of the charge-only USB cables I saw all over Asia. They are a bit cheaper than the normal data-carrying ones as they have fewer wires.

kken 12y ago
This! I got lot's of these things from portable usb batteries.

ColinWright 12y ago

See also the extensive discussion from a year ago: https://news.ycombinator.com/item?id=6379272 https://news.ycombinator.com/item?id=6379272

lazerwalker 12y ago

It's worth noting that this is unnecessary for iOS devices, where plugging your device into an unknown USB port prompts you to either "trust" or "not trust" the computer in question (with "not trust" disabling data transfer).

TeMPOraL 12y ago
Do you trust your "trust" and "not trust" settings? Are you sure that there are no backdoors in there, or bugs that could still lead to device getting hacked?
- lttlrck 12y ago
  Do you trust your (USB) condom?
  - TeMPOraL 12y ago
    Honestly? No. There's a bit too much electronics in that one for my taste. I'd happily trust the one designs of which I audited, and board I soldered myself. But until I get over to doing this, I'll be stuck with just cutting data wires. EDIT: I retract that. From what I can tell, it's just three SMT resistors on that board. So it seems fine to me.
bsamuels 12y ago
knowing how well apple does embedded security, there's probably a vulnerability that'll allow bypass of that feature - it's just a matter of how long you want to invest in finding it.
- aroman 12y ago
  what embedded security screwups has Apple had? (Not asking because I don't believe you, rather because I can't think of any)
  - gurkendoktor 12y ago

shimon 12y ago

Seems like you can already get similar stuff elsewhere for cheaper and with a little plastic around the PCB: http://smile.amazon.com/PortaPow-Fast-Charge-Blackberry-Charging/dp/B00GC4AJOU/ref=sr_1_2?ie=UTF8&qid=1408799798&sr=8-2&keywords=usb+condom http://smile.amazon.com/PortaPow-Fast-Charge-Blackberry-Char...

Thiz 12y ago
Exactly, and for just $6.99 Not adding the plastic is being lazy.

cnvogel 12y ago

Or in software (Linux): # cd /sys/bus/usb/devices # for n in usb* ; do echo 0 >$n/authorized_default ; done ...so that no drivers or userspace programs are allowed to communicate with any newly connected devices. https://www.kernel.org/doc/Documentation/usb/authorization.txt https://www.kernel.org/doc/Documentation/usb/authorization.t... Of course this only prevents the USB host, you'd have to disable all USB-gadget daemons on your android phone to not have the charger tinker with the phones's data. NOTE/added: I just realized that the main purpose this is marketed is to protect the phone's data. I'd me more worried about the computer if someone asks me to lend some juice...

mindstab 12y ago
yeah but then there is badusb http://www.wired.com/2014/07/usb-security/ http://www.wired.com/2014/07/usb-security/ which attacks the usb firmware on devices. ANY data communication and your usb device/port itself can get hacked the usb condom might actually prevent that,
- Dylan16807 12y ago
  Are you sure? As far as I could tell that thing was about messing with the firmware after you've already gotten control through normal communication.

classicsnoot 12y ago

In terms of a protective cover/case, maybe there is a cheap, everyday item or container it would fit into nicely. I put pen springs around all of my cable heads.

mindslight 12y ago

Mobile USB charging ports (as found in airports etc) are more of a gimmick than anything else. A shoddy one will easily damage your device, and if you're constantly plugging into different ones, that seems like just a matter of time. Plus, an unknown one will most likely just put out 500mA (slower charging), and USB A connectors aren't made for high insertion cycles so expect flaky connections. Plus you still have to carry the bulkiest part (the cable) so you still need kit. I personally just carry a three way AC power splitter cube while traveling, which gives me enough ports for laptop+phone+whomever I ask to share with.

fencepost 12y ago

There are multiple projects/products out there for this, some of which are linked here and some of which are not. Not all are currently available. There was a fair amount of discussion and useful information in a Brian Krebs article: http://krebsonsecurity.com/2014/06/gear-to-block-juice-jacking-on-your-mobile/ http://krebsonsecurity.com/2014/06/gear-to-block-juice-jacki... USB Condom: ~$10, available. Tends towards either a bare board with USB connectors or that board with plastic shrink tubing on it. (https://www.crowdsupply.com/xipiter/usbcondom https://www.crowdsupply.com/xipiter/usbcondom) (http://www.usbcondoms.com/ http://www.usbcondoms.com/) (probably an earlier version but the same person: http://int3.cc/collections/frontpage/products/usbcondoms http://int3.cc/collections/frontpage/products/usbcondoms) UmbrellaUSB: ~$12, available soon? More polished/finished looking than the USBCondom, got their information on voltages from the USBCondom folks (see comments in the Krebs article above). Working on fulfillment of their Kickstarter (funded July 3). (http://www.umbrellausb.com/ http://www.umbrellausb.com/) ChargeDefense: ~$??, a "coming soon" page, a picture of a prototype, and maybe more in September. (http://www.chargedefense.com/ http://www.chargedefense.com/) LockedUSB: ~$20, available. More technical details available, more expensive and very blocky looking - expect it to block any adjacent ports. Technical information indicates that the single unit should work with both Apple and non-Apple devices (https://lockedusb.com/product/lockedusb-adapter-charger-firewall-power-optimizer/ https://lockedusb.com/product/lockedusb-adapter-charger-fire...) Practical Meter: ~$20, available. Protects ONLY when used with their optimized 3-in-1 charging cables otherwise passes data through. Provides a 5-bar indicator of current. (http://www.powerpractical.com/product/practical-meter http://www.powerpractical.com/product/practical-meter) more details in their kickstarter (https://www.kickstarter.com/projects/david-toledo/the-practical-meter-know-your-power https://www.kickstarter.com/projects/david-toledo/the-practi...) PortPilot: ~$60, not yet available. Much more expensive, MUCH more informative, switchable between data/no data. Includes a display showing possible and actual power draw, etc. Almost a development/diagnostic device. (https://hakshop.myshopify.com/products/portpilot https://hakshop.myshopify.com/products/portpilot) At least 3 listed below via Amazon (2 in UK): PortaPow $7 (2 versions, www.amazon.com/gp/product/B00GC4AJOU, looks like a "beat you to market" device), and Pisen ~$1.70 (http://www.amazon.co.uk/dp/B00E8ALIYU http://www.amazon.co.uk/dp/B00E8ALIYU and http://www.amazon.co.uk/dp/B00E8AJ41E http://www.amazon.co.uk/dp/B00E8AJ41E).

12y ago

geuis 12y ago

Honestly the Wired quote is a much better summary and gets right to the point. "Many public locations now offer USB charging stations, but it's a trivial task to modify one of these to allow an attacker to access your data. Int3.cc's device cuts off access to the data transfer pins on the USB port, while still permitting access to the power supply." Way too many words on that page before just getting to the damned point.

Sephr 12y ago

I'd pay more for something like a "smart usb condom" which does allow data but only just for power negotiation, so that my devices can still negotiate for higher power when available.

sbierwagen 12y ago

We resell something similar, from DFRobot: http://www.robotmesh.com/usb-power-detector http://www.robotmesh.com/usb-power-detector One of the ports has the data lines connected, the other port doesn't, so it could be used as a USB condom.

tomphoolery 12y ago

Oh...I thought this was a...um... Never mind.

ihsanyounes90 12y ago
:0 ok it's another sht

MAGZine 12y ago

I can't help but wonder if we'll see USB condoms that help to protect against spying through EM/power draw changes, i.e. to spy on decryption activities.

ufo 12y ago

I wonder if it would be possible to use a similar system to make a usb hard disk read-only. This would make it easy to avoid malicious computers transferring pesky autoexec.inf files and things like that.

nyar 12y ago

If I can get a flash drive for $10 I should be able to get this for <$5. I'll wait until the novelty wears off and get it for $1 from china, on Ebay.

dbbolton 12y ago

Couldn't a person just cut the green and white wires in their charging cable if they were concerned about this?

Springtime 12y ago

Had hoped from the title the product would be a way to switch a USB drive from read/write to enforced read-only mode to protect from malware on unknown hosts. Would be a nice product in itself.

uaygsfdbzf 12y ago

10$ for the piece is ridiculous! someone is ..

sirwolfgang 12y ago

I feel someone should point out that the iPhone charger uses the data lines to basically ask for the available amperage, and charger faster if the charger is "iPhone compatible". So something like this will still work for iPhone but it will force it to charge much slower then it would otherwise. > https://learn.adafruit.com/minty-boost/icharging https://learn.adafruit.com/minty-boost/icharging

guelo 12y ago

If you're going to carry this around why not just carry a wall charger instead?

djrogers 12y ago

I use a $10 usb 'lipstick' battery for the same thing - it charges itself and the phone, no data. Plus I get a free battery to charge my phone when there isn't an outlet available...

chargedefense 12y ago

ChargeDefense's website is live and we are taking pre-orders. We have our Juice-Jack Defender (500mA) for $12 and our Juice-Jack Defender Turbo (1A) for $15. We have volume prices and can do customized case with your company colors and company logos. ChargeDefense also had a array of other products, wall charges, battery pack, and cables. We will start shipping orders out this month. Please visit our website for more information.