Hacker News Reader

Comment by standardUser | Hacker News Reader

From what I understand, a bad actor would need to physically interact with these charging stations. Sounds like a pretty severe breach of security to me that several agencies should be treating like an emergency. We are talking about spaces that are crawling with security and surveillance. If someone can plant a listening device like that, why can't they plant an explosive or biological weapon?

View on HN

People have been installing skimmers on atms and gaspumps and who knows what else in heavily recorded and busy places for ages. Airports have the benefit of being 24 hours and you can loiter there all you want if you're waiting for another flight.

As for the professional shampoo confiscators I wouldn't factor them at all.

edit: I like the assertion below, too, that the ports may just be factory compromised and unsafe from the start.

You're assuming the charging station isn't compromised to start with. A charging station with one of these tools would look basically the same as a normal charging station. One with a bomb or chemical weapon would look different.

It's a little confusing about airports specifically. Usually official airport usb stations are built into the furniture. They would have to take the thing apart to insert a device? I don't see an example in this article of an inconspicuous device for these types of ports

what he's saying is the usb port thing is possibly compromised at the factory it was made in.

If so, how is carrying your own charger going to help?

AC power lines don't have data lines, and even if they did the juice goes through a process to become DC 5V. It would be pretty tough to exploit a USB stack through a transformer and rectifier.

I've learned never to say never, but ...

I don't think the concern was the power...

If the usb charger outlets being sent to a very federally regulated airports and installed without detection for many years are compromised at the factory, how am I to trust the USB charger I buy at a gas station or Amazon?

Ah indeed, that makes a lot of sense. Thanks!

I think they meant, how you would know that your own charger is save, when they are malicious from the factory. The answer to that question is to buy from a reputable seller/manufacturer or/and use a cable without data lines (for example Apple MagSafe).

Someone could also bring in a USB charger and mount it onto a table to make it look like it was installed by the airport.

> why can't they plant an explosive or biological weapon?

Because you can't chemically detect a circuit based on its use case, but those two items have a low false-negative detection rate?

> We are talking about spaces that are crawling with security and surveillance

For some of these outlets, you need a screwdriver, a compromised replacement outlet, and 30 seconds. Maybe a friend and some luggage to block cameras.

I have no knowledge into the internal workings of airport security, but I doubt this is a threat they're worried about or looking for. No amount of cameras help with that.

Exactly. It's not like it would take compromising the vendor, or the service contract. The install can be a simple and quick swap.

The infeasiblity mostly seems targeting and monitization. You have no clue who or what will plug in, so it's barely useful for directed attacks. And actually getting value (intel or money) when all you know to expect is "a smartphone will connect" is quite hard.

Unlike a skimmer on an ATM.

This is like someone’s mother asking why a software developer can’t fix her printer. Because “computers” is more than a single discipline.

“Security” is not one big umbrella.

The specific people and organizations tasked with protecting air travel are not tasked with protecting the cell phones of the passengers traveling.

> If someone can plant a listening device like that, why can't they plant an explosive or biological weapon?

Because quiet infiltration is of more value than a violent attack.

A sufficiently malicious, motivated, and suicidal (or misled) actor absolutely could use an explosive or biological weapon to attack an airport, essentially regardless of the on-premises security posture. For explosives, one would simply detonate their bomb IN the security line on a busy day. For biologicals, one would simply infect themselves first, then spend the day at the airport waiting for a plane. I continue to be baffled why we don't hear more of such attacks.

Reply on news.ycombinator.com