At some point iOS started asking if I want to trust the device, so I suppose if I use this malicious cable with charger and iOS asks me about computer or accessory, I would know things are fishy, would not I?
No. Sometimes it asks, sometimes it doesn't. There doesn't seem to be any pattern to it that I have been able to discern.
How often do you charge your phone? I only get those prompts when charging with a computer, not with a charger. One explanation might be that it remembers your computer for 1 week (random guess), but if you irregularly connect your phone to your computer it might seem random to you.
In sufficiently complex software, things can appear to be random (or magic), even when they are neither. — I seldom trust myself to declare something random in computer technology, just because I haven’t figured out the pattern (yet).
Well, no, but I assume it has a way of knowing if the computer I'm plugging it in to now is the same one that I plugged it in to yesterday and that I told it to trust yesterday.
The cable I'm using is the one that came with the phone, so if it was malicious that would be big news. But I just realized that I left out an important detail: my phone is not plugged directly into my computer, but is instead connected through a USB hub and an OWC Thunderbolt dock. So that muddies the waters considerably. It is not at all out of the question that one of those devices is doing something hinky, though I'll give long odds against.
> is there a chance that the trust is lost on a weird AI timer?
Extremely unlikely. This one computer is the only one my phone has ever been plugged in to (AFAIK).
> I assume you’re always using the same cable? And I also assume you don’t get the trust dialog when plugging into a wall charger directly?
Correct on both counts.
(The most depressing thing to me is that people actually pay money for devices like Alexa and Google Voice which are designed to spy on them. Who needs to become a hacker when people will voluntarily give up their privacy for a shiny thing?)
It's very weird, and the fact that the trust dialog does not display any kind of device fingerprint makes it impossible to know what is actually going on.
You're correct that if I plug the phone into my PC the phone defaults to just charging from it, and needs an explicit UI intervention to offer other features - but if I plug it into my USB keyboard it just works as a keyboard, no further UI intervention needed.
I guess it's _possible_ that I forgot having one time authorised this for the keyboard, but even if that's true it means a malevolent device just needs to guess what to impersonate to get into any phone that has even once authorised such a device, because there's no cryptographic protection - if I say "I'm a Cheap Ass Generic USB Keyboard serial # 00001" then there's no way to distinguish me from the real "Cheap Ass Generic USB Keyboard serial # 00001".
Now, maybe the situation is that phones allow some safer things and not more dangerous ones. Maybe you can pretend to be a USB keyboard or mouse, but it will refuse to offer any of the file transfer type features or networking. I don't know, but my expectation is that people who've built these cables do know and there are plenty of holes.
But anyway, suppose phones are smart enough to refuse to charge from a keyboard. These cable are remote controlled. So you plug in your phone, it charges... and then a minute later when you're distracted it gets told the charger went away... and now here's a keyboard. Attack in progress.
I reckon you could work out a procedure e.g. pretend to be power for 90 seconds, supposing experience teaches that's how long people take to forget they plugged the phone in. Then, turn the power off. Watch. An attentive user may notice, unplug their phone and try again thinking the cable may be faulty. Re-enable power when the phone vanishes. If not, after giving them say 30 seconds to notice switch to keyboard mode. Or you could just wing it. A lot of good physical penetration testers "wing it" all the time.
I think you're talking about the "this accessory is not supported by this iphone" prompt, not the "trust this computer?" or "allow this device to access your photos and videos" prompts. The first shows up if your cable can't be verified to be mfi compatible (via a special chip in the cable), and the last two only show up when connecting to a computer.