Hacker News Reader

Comment by ars | Hacker News Reader

I don't get how this works. When my phone connects to USB data it always asks me if I want to talk to that machine.

Does it emulate a keyboard or something like that?

Android didn't always work like that. A few years ago it used to allow access to internal storage as soon as you unlocked the phone so if you ever used the phone while it was charging you would be exploited.

With how horrible phone makers are at updating things I would not be surprised if there was a significant number of old android versions hanging around.

Even so, I don't see how you exactly you go from internal storage to loading malware or exfiltrating passwords. Exposing internal storage doesn't let you access the isolated app storage where private app data and passwords would be stored, only common areas like downloads and media.

Lacking any technical details, this article reads like one of those scary chain forwards.

When I still used Android, lots of apps would put all sorts of data on the "SD card" storage. This could've included credentials.

What little I've read about USB sounds crazy complex. I wouldn't bet against remote exploits of the kernel driver by sending malicious packets.

To a non tech savvy user they may just hit accept on the prompt out of a bad habit they have built of hitting yes to every prompt.

A non tech savvy user would have USB debugging off and dev settings off and would never be promoted it would just be denied be default.

Reply on news.ycombinator.com