Hacker News Reader

Comment by tewks | Hacker News Reader

This is a fairly important issue seeing as everyone is pushing towards USB-only charging. There are even USB charging ports on airplanes now.

Plugging in your device, with the intent of charging, shouldn't implicitly grant the host the right to install software or access files on the guest.

The USB protocol doesn't seem properly designed for this use case: I should be able to plug in to charge without having to worry about security holes.

View on HN

This isn't an issue with the USB protocol. The software has to be installed manually, and should not even have been included (why do you need special software to charge batteries?)

There is still a remaining issue with plugging in devices, especially cameras and phones, where the charger has the opportunity to inappropriately, given the context, access the filesystem: software can maliciously be installed a result.

When wanting to charge a camera on an airplane, for instance, the user shouldn't be left to guess if his photos are going to be copied off the device.

You can easily solve this problem by getting a usb cable without data wires. A few things I have came with these included with the charger. It pissed me off at first because they look like regular usb cables and I tried to hook up a disk drive. I marked them with a big X but soon realized how handy they could be when I wanted to charge a media player from a laptop I knew had some issues.

I've done surgery with a razor and some good shrink tube twice now to make more of these little gems.

Smarter devices like my Palm Pre actually ask if you want to let the host connect to them or just take power.

No idea if no-data-wire USB cables are actually sold or do you have to roll your own?

Mind you, I find the point that there should be software for managing a battery recharger incredible.

If I understand the USB spec right, getting more than 100mA of power requires a negotiation with the host, thus data wires. There might be a market for a USB data blocker, a device that negotiates the 500mA output with the host and with the guest but does not pass through any data.

this is a great idea. market it to paranoid corporate IT for blackberries with sensitive materials.

You are right. That's what the spec says. In reality, I've never found a single hub or host that actually does this. They mostly just dump somewhere between 300ma and 700ma right on the wire. The really advanced ones don't crash the all the ports on the whole machine if you short or overdraw a port. Actually, I think my macbook may get it right (i don't plug homemade usb junk into my macbook), but my toshiba I know for certain does not.

You've got a great idea though. A simple micro like a PIC or an arduino (atmel) could do this and get all kinds of neat data on the power flow as well.

USB Specs are available here: http://www.usb.org/developers/docs/

USB 2.0 in particular (10.9 MB zip file): http://www.usb.org/developers/docs/usb_20_122909-2.zip

USB data blocker - totally awesome idea. It could double as a protocol sniffer if it had a buffer.

See, a blocker and a sniffer would have almost entirely opposite functions. Both are cool devices that could be built from essentially the same hardware, so you do have a point there, but I wouldn't combine the two. Too easy to end up doing the wrong thing and compromising your data.

If your OS allows that, you need a better OS. Seriously, that's practically like having an OS that lets anyone on your LAN just SSH into your machine as root without a password just because they happen to be on the same subnet.

man dma

  $ man dma
  No manual entry for dma

get a better manual

http://en.wikipedia.org/wiki/Direct_memory_access

And the description of how to exploit it

http://www.schneier.com/blog/archives/2006/06/hacking_comput...

The FireWire version http://www.storm.net.nz/static/files/ab_firewire_rux2k6-fina...

Er, DMA isn't controlled by the TLB using the usual page table for access permissions? If not, PCs are ridiculously broken.

You can read write system memory at addresses that fit in 32bits even when the Kernel has crashed.

When I plug my camera in to charge, it asks if I want it to go into disk mode. I can say no.

It's the same with printers. They always want you to install some stupid software that "manages" printing for you. Um no, I just want the printer driver thanks.

Reply on news.ycombinator.com