Hacker News Reader

Comment by notatoad | Hacker News Reader

is there any reason to believe that this is a problem, at all, with modern phones? or is the FBI just warning us about a problem that existed a decade ago and has now been solved.

as far as i know, any somewhat recent version of either android or iOS connect in a charge-only mode to any untrusted USB port. if you want to connect in a way that allows data to flow over the connection, you have to accept a prompt in the phone. should i be worried that this system has been compromised?

View on HN

I suppose there could be some elaborate set of exploits which nullifies the protected pathway, but it seems a stretch that it would be used in a generic fashion to grab randoms at the airport.

Personally, I never use public usb ports because I think it is more likely that some jerk has wired up the port to 120V. Circumventing the OS protection to grab my data feels seems less likely than chaotic destruction.

You could use one of those small usb voltage meter devices to check the port before plugging in your phone. Depending upon the model it may also nullify the data pins.

That sounds like it could lead to an interesting conversation with airport security later when trying to board the plane. "That? Oh, that is just for checking charging ports..."

You'll get more hassle from bringing baked goods through than from bringing a usb dodad.

you'd think that, but i've never had a problem flying with homemade electronics. security has their list of banned things, and if it's not specifically on the list they don't care.

or at least, that's been my experience as an average looking white guy. it's probably not true for everyone.

> Personally, I never use public usb ports because I think it is more likely that some jerk has wired up the port to 120V.

I don't, because while that's unlikely, what is almost certain is that the port only does charging at the lowest default voltage/amperage, which for at least 5 years now is not enough to charge a smartphone on standby.

I suppose a charitable understanding of this “warning” is that less savvy users (e.g., my parents) may blindly accept the iPhone prompt to allow a connection to do non-charging (nefarious) things?

The "charge only" option has been there for over a decade. The fact that, at least on my generic Android it causes the USB host to not even see a device being connected, almost as if the USB controller is completely disconnected, suggests that it's unlikely to be attackable via software means. As the sibling comment mentions, physical damage is still possible by overvolting or similar.

> The "charge only" option has been there for over a decade.

Are you sure it block HID as well?

the usb port can still very very easily spoof itself as a keyboard/mouse and automatically accept any prompt

Reply on news.ycombinator.com