Don't Plug Your Phone into a Charger You Don't Own

http://www.indiegogo.com/projects/portpilot-charge-with-spee... :)

(not affiliated)

I'd pay decent money for a small, USB adapter with the ability to swap the pins (for international travel) and a guarantee that it would reach at least 1.8A and 5V.

I have a 10,000ma/h battery pack i carry with me that I charge my phone with; when that runs out i charge it with any wall jack / usb port i can find.

Effectively the same thing, and portable!

There are already such devices on the market. I just bought one three weeks ago for about $12. It even has a plug for car cigarette lighter (which is actually why I bought it).

It's called "3-in-1 charger" here in Europe and it looks like this:

http://mireltech.ru/node/614

From the last time this came up, I found a few: https://news.ycombinator.com/item?id=5814193

You could just cut the data wires of the USB cable you wish to use. Simple, cheap and effective.

Not exactly what you want, and limited to UK use, but I carry one of these around with me most of the time: https://www.themu.co.uk/

It's even smaller than I thought it would be, and so much more portable than a normal UK plug.

I found this http://www.kickstarter.com/projects/671390578/juicebee recently which looks like a good compromise. There are many similar products on amazon as well.

Like this?

http://www.amazon.co.uk/Power-Only-Charging-Cable-Extension/...

"The CDL-02POWER is a type A male to type A female extension cable with only the + and - power pins connected.

This is extension for charging devices like ipods, Sat Navs etc. It allows you connect the appropriate device cable and charge the device through your USB port on your PC/Laptop with out opening up your webstore, itunes etc. While a device cable has data and power only the power from the extension is carried through.

Please note that due to limitations of 500ma output from a USB port, some devices may take longer than others to charge. "

This part also makes this a bit confusing: "As a final (and alarming) demonstration, they showed a Mactans-pwned phone turn itself on, swipe open, enter the passcode, and call another phone."

So can they attack a passcode protected phone or not?

Also, shouldn't this be one of those bugs they let apple fix first BEFORE they talk about it?

It sounds like "use a passcode on your phone and NEVER unlock (enter the passcode) while the phone is plugged into this charger" is also a defense.

Unlock to check your email while plugged in? Compromised.

The attack relies on the phone being unlocked for it to give up its UDID (and allow them to push the signed malware to it). If your phone is locked (with passcode) it won't be able to attack it as reliably. You can observe the same effect sometimes with iTunes (it complains the phone can't be read until it's unlocked).

They did mention a fix is coming in iOS 7 (explicit approval prompt on the device), but until then your "USB condom" is probably as good a stopgap as any.

Isn't that closer to a USB vasectomy? (not a sentence I thought I'd ever write)

So where can I buy such a cable? I don't feel up to performing surgery on a USB cable myself.

While you're at it, add an indicator to show if the data lines are active. Could this be as simple as LED and resistor?

> (a) why would I do that?

To charge your phone? Also, some of these IFE systems can play back MP4 files stored on USB mass storage devices. The Singapore Airlines IFE system even has Star Office so you can edit office documents without a computer. http://www.flickr.com/photos/82365211@N00/2473197320/in/phot...

Most IFE systems are air-gapped from flight control systems, if that's what you're worrying about.

As laid out in the article:

It turns out that any device you connect with an iOS via the USB port can obtain your device's Universal Device ID (UDID), as long as the device isn't passcode-locked. It just takes a second, so if you plug in your device while it's unlocked, or unlock it while plugged in, or just don't have a passcode, Mactans can attack.

IIRC the adapter would need internet access to add your devices UDID to the certificate.

Unless they use an enterprise signing certificate.

Your implicit comment that the link only points out an iOS vulnerability is correct, but don't you think it's good advice generally?

Most consumers don't think about security beyond enabling a lock screen. Average people do not think twice about promiscuously plugging their devices into any ports they find. This attack vector is entirely off their radar. On the other hand, gadget purchasers care deeply about sleekness. Based on reactions I have witnessed, I suspect some people may even be sexually aroused by gadget sleekness. Therefore, at this point there is little incentive for a company to sacrifice their product's sleekness for a security enhancement. Until typical customers start caring I do not see a split-port solution happening.

Personally, I don't want to carry around a bunch of USB cables and a bunch of power cables. USB provides enough power to charge my phone. I'm glad I can charge with a "standard cable" (as long as I take a few simple precautions).

Does android ask you for permission to be mounted or at least notify you?

Im still using an old n900 which asks you if you want it to just load its battery, be a modem or be a mass storage device.

Well, then it installs an app. And yes, it's the same restrictions as apps for jailbroken devices....and they can take over your phone pretty easily (as described in the article). Sounds like you have the specifics right but may not understand the implications?

Well... we have Ethernet over power line, so why not USB? ;)