Hacker News Reader

Comment by nyrina | Hacker News Reader

Is it just me or is this a bit.. Over the top?

I've never put my phone into something to charge and thought "Hey, they might steal my data".

Because the NSA hasn't proven that they're willing to go through nearly unimaginable lengths to procure any and all data that they can get their hands on.

NSA hires hacker to install monitoring devices on all the samsung charging stations at O'Hare airport? Not out o the realm of possibility.

Six months ago, I would have called a comment like mine a little too tin foil hat, but not today.

Do they have USB-only chargers? I've only ever seen power sockets.

Boston Logan airport has certain benches dedicated to power charging, and for the most part they all have two power sockets and two dedicated USB charging ports.

I've also seen dedicated cell phone charging stations at other airports that have USB charging ports alone.

USB-only chargers in airports definitely exist, and are sometimes fought over in busier airports.

DTW has approx. 800 USB charging ports at gates.

I believe there are more USB ports than generic power sockets.

In my experience, the USB ports are all in use at any gate with more than 10-15 people waiting at it.

http://www.leviton.com/OA_HTML/SectionDisplay.jsp?section=53...

Newer/remodeled hotels and airports are full of these things now. They don't exactly jump out at you, they would be easy enough to miss.

AFAIK these things are just dumb voltage sources, they don't have any USB controllers that could be hacked. At least, the ones you and I can buy don't. But there isn't, in principle, any reason why they couldn't have such controllers, either.

Dreamliner has USB sockets for charging. I think you can also load media over them, but it might be iPod/iPhone only. (That's lame, but he Dreamliner has the best in-flight entertainment system I've ever seen; I usually shut them off, but they had enough Pink Floyd in the on-demand library for take-off and landing, which was nice.)

They had tons of them at JFK T4 last time I was there in February. None of them were connected to power.

Last time that I flew SouthWest, they had specific "charging seats" (that had power outlets and USB sockets for charging) in their terminal. (Note: this was maybe 2008 ~ 2009)

I've seen them in the Minneapolis airport at least.

A lot of airports are adding charging stations that have USB and power plugs for charging.

It's actually very serious. Just like ATMs, power stations can look completely harmless while being incredibly dangerous under the surface. Once you connect to a system via USB, it automatically allows data transfer, which makes your smartphone vulnerable to malware and data theft.

I can't speak for Android, but iOS 7 now has an automatic warning when you connect to new devices that asks if it should be trusted, presumably to mitigate this risk. However, I doubt anything less than a full hardware solution can actually eliminate the risk entirely.

There's a reason why conferences like DefCon warn you explicitly not to use power stations or ATMs nearby - they can be hijacked very easily.

Well, you should assume that everything out there would be malicious, and work from _that_; if you go to DefCon specifically, this is a reasonable expectation.

New-ish Androids pop up a "USB connected, do you want to use this" prompt as well; but many devices (esp. embedded ones) don't.

"The General Assumption of Security is:

The attacker is smarter than you, he has a bigger computer, he knows your own software better than you, and he is after you, specifically."[1]

[1]: http://security.stackexchange.com/a/19000

For most casual personal computing, anyone reasonably smart being after you already means you lost. If they also know your own software better and have a big computer, you never had a chance.

Well I do use a 11 inch laptop, so most computers are bigger than mine. Better go get a second roll of foil!

And if its like my wife's 11, the 64gig solid state would make getting all the data off easy and fast. Hope they like Breaking Bad.

Exploits like this have actually happened already against Android at conferences. Developers particularly almost always have the Android Debug Bridge (ADB) enabled on their phone. Then someone made fake USB charging stations that used ADB to pull all the files...

ADB now asks for confirmation to talk to a new computer.

Couldn't you spoof a computer fingerprint? The hard part would be figuring out which computers are trusted, of course. Perhaps there is a timing attack that can be performed to find out.

Not easily since it uses RSA to do host verification.

1. Plug your iPhone into a coworkers computer to charge for a minute 2. syncs photos 3. embarrassing picture.jpg.

There are numerous ways this can go down without even having to have some cool hardware device.

Of course, attaching a USB condom when your coworker agrees to let you use their computer to charge is an implication that one of both of you has a "slutty" device.

Mobile devices are inherently slutty.

After all, you never hear of a phone committing to just one outlet.

And consider how many people indiscriminately hookup with anonymous base stations at airports... That "Free Public Wifi" SSID is still being passed around.[^1]

[1]: http://www.npr.org/2010/10/09/130451369/the-zombie-network-b...

Or they simply try to avoid an unwanted USB child that could ruin their professional career.

Don't you have to deliberately set up sync?

On Macs, iPhoto will open up automatically by default to pull photos off. iTunes sync needs to be set up manually though.

iOS7 now prompts you to establish a relationship of trust between the phone and the Mac before it'll do anything data-wise.

http://allthingsd.com/20130801/ios-7-will-immunize-iphones-f...

Not for photos. The iPhone appears as a normal digital camera.

unless you have passcode

“Just because you're paranoid doesn't mean they aren't after you”

― Joseph Heller, Catch-22

Sounds like it would be pretty easy to steal your data.

If you are into unprotected charging, then that's up to you.

Such devices are supposedly in the wild; although actually meeting one at random would be pretty rare (as most of the usages seem to be spear-phishing: operations targetted to acquire data from specific people).

they've been found in airports before, but I can't remember when, so don't ask me for a cite.

You probably shouldn't go to hacker conferences.

(There was at least one trojan USB charger at Defcon this year)

This is a real concern. All phones are suceptible to malicious programs being injected via usb plug. Basically can make your phone into a bot for a botnet. It's like windows 98 all over again.

Perhaps you should, though. I mean, sure, normally you don't need to worry about it; but given how much personal data is being stored on our phones these days, and how easy this sort of attack would be (stick a charger in an airport that actually slurps up the data of anyone who uses it), it's definitely something to think about.

You probably would if you travel, or go to conferences...

Your proof that this doesn't happen is that you never think about it.

I often think about it, I guess that is proof that it happens...

you should

This is catering specifically to the market who does think that.

Reply on news.ycombinator.com