# Isn't USB power a major security risk? **URL:** \ **Category:** Factual Questions\ **Created:** [November 17, 2015, 2:07am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770 "2015-11-17T02:07:36Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [November 18, 2015, 9:21pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/21 "2015-11-18T21:21:24Z")
> [@Alley\_Dweller](#): > > If you are concerned, there are [USB Condoms](http://syncstop.com/) (seriously) available. Tried it, phone said the power didnt feel the same. ---
**Author:** ![Doughbag](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@Doughbag](https://boards.straightdope.com/u/Doughbag)\ **Post date:** [November 19, 2015, 1:39pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/22 "2015-11-19T13:39:28Z")
> [@coremelt](#): > > So far there is still no exploit known that can “root” or Jailbreak eg escape the sandbox on recent iOS devices. This is not true for recent Android releases on which many Jailbreak exploits are available. There is no known USB controller exploits on iOS devices either. Yes, Yes, Yes… iOS devices are unbreakable and[NEVER have any issue](https://threatpost.com/apple-patches-include-ios-9-1-update-pangu-jailbreak-fix/115127/) - whatsoever. [Never mind jailbreaking them.](http://bfy.tw/2s1e) :smack: > [@](#): > > Android is evil - hail the APPLE _Book of Job’s - verse 17:83_ ---
**Author:** ![fubar.gr](https://avatars.discourse-cdn.com/v4/letter/f/898d66/32.png) [@fubar.gr](https://boards.straightdope.com/u/fubar.gr)\ **Post date:** [November 19, 2015, 8:47pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/23 "2015-11-19T20:47:23Z")
> [@Reply](#): > > Wouldn’t this break newer smartphones that communicate with the host to request more power? > > Normal USB is 5V \* 900mA, but newer devices can request up to 20V after negotiations with the charger. > > [USB - Wikipedia](https://en.wikipedia.org/wiki/USB#PD) According to that link: > [@](#): > > The power configuration protocol uses a 24 MHz BFSK-coded transmission channel on the VBUS line. It is using the power rails to send the negotiation data This is probably done so the data lines are left undisturbed for communication. Under the previous charging shemes you couldn’t fast charge and communicate with a device at the same time. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [November 19, 2015, 9:47pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/24 "2015-11-19T21:47:20Z")
Seems to me that, if you’re going to have to carry a “condom,” you might as well carry a full adapter, and then there was no need for USB charging stations at all. I’d prefer some sort of switch on the device that would make the (micro)USB port power only. But people have been slow to see the problem with security and USB. What Chronos describes–about pretending to be a different device–is an exploit I’ve heard about since 2012 at [a TED talk](https://www.youtube.com/watch?v=hqKafI7Amd8), and so far I’ve not seen anything done about it. The most basic, of prompting when you plug in a new device (and telling you what kind of device it claims to be), hasn’t been done, let alone more complicated stuff like requiring certificates. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [November 20, 2015, 3:48am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/25 "2015-11-20T03:48:11Z")
> [@BigT](#): > > Seems to me that, if you’re going to have to carry a “condom,” you might as well carry a full adapter, and then there was no need for USB charging stations at all. > > I’d prefer some sort of switch on the device that would make the (micro)USB port power only. But people have been slow to see the problem with security and USB. Well, some phones do have that when you plug it in. You can choose from different data transfer types or “charge only”, which I hope does what it says. ---
**Author:** ![SpyOne](https://avatars.discourse-cdn.com/v4/letter/s/82dd89/32.png) [@SpyOne](https://boards.straightdope.com/u/SpyOne)\ **Post date:** [November 20, 2015, 6:16am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/26 "2015-11-20T06:16:41Z")
> [@coremelt](#): > > This isn’t a threat on iOS, as soon as the phone sees a USB connection attempt from an unknown device it puts up a prompt asking you if you trust the device or not. Doesn’t Android do the same? My android device does something similar. If it can sense another device at the end of the USB connection, it asks if you would like to enable communication over USB (which will turn off certain apps and functions). ---
**Author:** ![coremelt](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@coremelt](https://boards.straightdope.com/u/coremelt)\ **Post date:** [November 20, 2015, 6:24am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/27 "2015-11-20T06:24:32Z")
> [@Doughbag](#): > > Yes, Yes, Yes… iOS devices are unbreakable and[NEVER have any issue](https://threatpost.com/apple-patches-include-ios-9-1-update-pangu-jailbreak-fix/115127/) - whatsoever. [Never mind jailbreaking them.](http://bfy.tw/2s1e) :smack: > _Book of Job’s - verse 17:83_ There is exploits for OS X but they are patched much more quickly than the mess that is the Android / phone maker / carrier system: > **[Waiting for Android’s inevitable security Armageddon](https://arstechnica.com/gadgets/2015/08/waiting-for-androids-inevitable-security-armageddon/)** > > Editorial: Android’s update strategy doesn’t scale, and that’s recipe for disaster. As far as I know there has never been an exploit for iOS that worked merely by connecting a USB cable and its fair to say that iOS is generally much more secure than Android. ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [November 20, 2015, 6:57am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/28 "2015-11-20T06:57:12Z")
A reminder about the point I made above; all the security settings on your phone, it asking permission to access the device, ensuring the device is what it says it is, all assume that the USB device is behaving itself, and not mounting a low level attack. If the USB attack is using such exploits as possible buffer overruns, protocol violations or timing violations, the USB controller in your phone will be compromised before the phone OS realises that anything has happened. Such attacks are specific to individual implementations of USB controller hardware and firmware. This is a mixed thing. Your phone might be immune to the exploit, but if it is vulnerable, a software update to the phone’s OS might not be able to fix the problem. A power management protocol encoded over the power wires is another, separate, vector. Such exploits are extremely difficult, simply because there is scant publicly available information on the IP blocks used. But by the same token, once an exploit is found, it is very hard to kill off. I would expect that national security agencies would be the ones to show the most interest in investing the effort. ---
**Author:** ![crazyjoe](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@crazyjoe](https://boards.straightdope.com/u/crazyjoe)\ **Post date:** [November 20, 2015, 4:04pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/29 "2015-11-20T16:04:34Z")
The short answer is that yes, it is an attack vector that can be exploited. Anywhere there are public charging stations, I use my own power adapter and cord. It’s a trivial amount of extra weight and volume to carry the adapter with the cord. I also have a small battery backup I use. I would never plug my device directly into a USB port in a public area, as I just don’t trust them. I might use it to charge up my battery backup, as there isn’t really any code in there that could be exploited. It not like these things are self-replicating, heh heh heh…right? ---
**Author:** ![Doughbag](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@Doughbag](https://boards.straightdope.com/u/Doughbag)\ **Post date:** [November 20, 2015, 5:14pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/30 "2015-11-20T17:14:20Z")
> [@coremelt](#): > > There is exploits for OS X but they are patched much more quickly than the mess that is the Android / phone maker / carrier system: > [Waiting for Android’s inevitable security Armageddon - Ars Technica](http://arstechnica.com/gadgets/2015/08/waiting-for-androids-inevitable-security-armageddon/) > > As far as I know there has never been an exploit for iOS that worked merely by connecting a USB cable and its fair to say that iOS is generally much more secure than Android. Sure, but just saying Android doesn’t mean the same as iOS, since iOS exclusively runs on Apple products and is geared for exactly those few Apple devices by Apple – getting THAT wrong is way worse and sloppy, compared to creating an OS like Android that runs on several thousand different devices by several hundred manufacturer. If you have a cheap Android, they are crap, security is poor and the Android implantation is badly and cheaply done, but blatantly assuming that Android as a whole is inferior because of that is just narrow minded. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [November 20, 2015, 7:58pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/31 "2015-11-20T19:58:17Z")
> [@crazyjoe](#): > > … I might use it to charge up my battery backup, as there isn’t really any code in there that could be exploited. … That’s an assumption. I don’t know enough about what’s actually inside one these days. But if it contains any processor at all, it’s at least theoretically hackable / hijackable. If it’s purely wires, Li-ion or whatever cells, and maybe a couple discrete transistors you’re safe. Otherwise you’re only probably safe. ---
**Author:** ![Digital\_is\_the\_new\_Analog](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@Digital\_is\_the\_new\_Analog](https://boards.straightdope.com/u/Digital_is_the_new_Analog)\ **Post date:** [November 21, 2015, 3:18am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/32 "2015-11-21T03:18:33Z")
> [@LSLGuy](#): > > That’s an assumption. I don’t know enough about what’s actually inside one these days. > > But if it contains any processor at all, it’s at least theoretically hackable / hijackable. If it’s purely wires, Li-ion or whatever cells, and maybe a couple discrete transistors you’re safe. Otherwise you’re only probably safe. Agreed. I haven’t worked on one of them, but it wouldn’t surprise me if some used a simple embedded linux like image to manage the charge/discharge, because it’s just a quick way to get stuff to talk. If that’s the case, I could imagine there being exploits. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [November 21, 2015, 3:30am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/33 "2015-11-21T03:30:01Z")
> [@Digital\_is\_the\_new\_Analog](#): > > Agreed. I haven’t worked on one of them, but it wouldn’t surprise me if some used a simple embedded linux like image to manage the charge/discharge, because it’s just a quick way to get stuff to talk. If that’s the case, I could imagine there being exploits. I seriously doubt it. Most USB chargers are extremely cost-sensitive, which means using a processor that costs in the sub-dollar range. Those are going to be 8 bit devices with a few K of RAM and up to 128K of Flash. You won’t find even the most stripped-down Linux distro that will run on that kind of puny hardware. Some discussion [here](https://www.quora.com/What-is-the-most-basic-microprocessor-that-Linux-can-run-on). ---
**Author:** ![coremelt](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@coremelt](https://boards.straightdope.com/u/coremelt)\ **Post date:** [November 21, 2015, 4:09am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/34 "2015-11-21T04:09:05Z")
> [@crazyjoe](#): > > I would never plug my device directly into a USB port in a public area, as I just don’t trust them. I think you are seriously overestimating the risk. Yes its a hypothetical attack vector. However can anyone provide a cite to a single documented case of a public USB charger being set up in this way and used to successfully infect phones? For the attack to work on the average phone thats plugged in to it has to have exploit code for each specific USB controller chip, firmware revision and possibly even chipset revision. If you’re wanting to infect mobile phones en-mass there is much lower hanging fruit which doesn’t involve hacking low level firmware, eg attacks via webpages, MMS messages and fake app installations with trojans. ---
**Author:** ![ExcitedIdiot](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@ExcitedIdiot](https://boards.straightdope.com/u/ExcitedIdiot)\ **Post date:** [November 21, 2015, 9:00am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/35 "2015-11-21T09:00:53Z")
For the tinfoil hat wearers out there, you can buy a “charge only” usb cable that lacks the communication pins. I think this limits you to the older slow-charge protocols, but PortaPow makes one that should work with the newer fast-charge specifications. ---
**Author:** ![ExcitedIdiot](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@ExcitedIdiot](https://boards.straightdope.com/u/ExcitedIdiot)\ **Post date:** [November 21, 2015, 9:15am UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/36 "2015-11-21T09:15:29Z")
> [@beowulff](#): > > I seriously doubt it. > Most USB chargers are extremely cost-sensitive, which means using a processor that costs in the sub-dollar range. Those are going to be 8 bit devices with a few K of RAM and up to 128K of Flash. You won’t find even the most stripped-down Linux distro that will run on that kind of puny hardware. > > Some discussion [here](https://www.quora.com/What-is-the-most-basic-microprocessor-that-Linux-can-run-on). No ram or flash in a charger. I can’t imagine any company would make a charger that would use a comparatively expensive microcontroller(which they would have to write software for) when they could use one of the many purpose built IC’s that do the job. [http://www.aliexpress.com/item/IW1691-08-1691-08-IWATT-SOP-8/32479164252.html](http://www.aliexpress.com/item/IW1691-08-1691-08-IWATT-SOP-8/32479164252.html) ---
**Author:** ![Digital\_is\_the\_new\_Analog](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@Digital\_is\_the\_new\_Analog](https://boards.straightdope.com/u/Digital_is_the_new_Analog)\ **Post date:** [November 21, 2015, 2:33pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/37 "2015-11-21T14:33:56Z")
> [@ExcitedIdiot](#): > > No ram or flash in a charger. I can’t imagine any company would make a charger that would use a comparatively expensive microcontroller(which they would have to write software for) when they could use one of the many purpose built IC’s that do the job. > > [http://www.aliexpress.com/item/IW1691-08-1691-08-IWATT-SOP-8/32479164252.html](http://www.aliexpress.com/item/IW1691-08-1691-08-IWATT-SOP-8/32479164252.html) I completely agree, from a technical perspective. I’ve just worked for enough high tech companies that do seemingly stupid things for non-technical reasons, that I can imaging some odd situations. For instance - back when I worked in cell phones, we liked to put a accessories ‘in box’ for the customer. The cost of the accessories was rolled into the overall cost of the product, and then subsidized by the carrier. So we got guaranteed sales of the accessory without the end user really seeing the price. We also did lifetime buys of chips, and believed heavily in the miracle of platform based solutions. It wouldn’t shock me if somewhere out there was a charger solution that came out of this type of setup…cost not being a factor…time to market, required oddball safety mechanism, lack of time or staff to do what everyone knows is the easy way… Not saying it’s common, or would even have any level of market penetration. Just that I can picture it actually existing. ---
**Author:** ![ExcitedIdiot](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@ExcitedIdiot](https://boards.straightdope.com/u/ExcitedIdiot)\ **Post date:** [November 21, 2015, 2:54pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/38 "2015-11-21T14:54:59Z")
> [@Digital\_is\_the\_new\_Analog](#): > > It wouldn’t shock me if somewhere out there was a charger solution that came out of this type of setup…cost not being a factor…time to market, required oddball safety mechanism, lack of time or staff to do what everyone knows is the easy way… > Not saying it’s common, or would even have any level of market penetration. Just that I can picture it actually existing. I was actually thinking along the same lines. There probably is some kind of fancy “smart charger” that’s got zigbee or zwave and does have some kind of processor. Like a Nest for chargers. Nest is like the high tech solution to a problem nobody has(I have one fwiw). ---
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [November 21, 2015, 4:35pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/39 "2015-11-21T16:35:19Z")
I remember a story (I think in Wired) of a company that was at an Information Security conference and offered free phone charging. Their presentation was on how they had now installed malware an everyone’s phone that had used their charger. ---
**Author:** ![CarnalK](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnalk/32/486_2.png) [@CarnalK](https://boards.straightdope.com/u/CarnalK)\ **Post date:** [November 21, 2015, 5:31pm UTC](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770/40 "2015-11-21T17:31:33Z")
> [@coremelt](#): > > I think you are seriously overestimating the risk. Yes its a hypothetical attack vector. However can anyone provide a cite to a single documented case of a public USB charger being set up in this way and used to successfully infect phones? > **[CSI: Cyber Screencap Recap: Airplane Edition](https://www.vulture.com/2015/04/csi-cyber-screencap-recap-airplane-edition.html)** > > There’s a perilous airplane situation going on! Agent Mundo needs two phones to handle it. [Previous page](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770.md?page=1) [Next page](https://boards.straightdope.com/t/isnt-usb-power-a-major-security-risk/737770.md?page=3)