News for hackers. Stuff that matters.
Re:Should you fear your USB cable? by Animats on Monday February 29, 2016 @09:47PM (#11200471)
USB-C has too many pins.

USB started with four pins - GND, Vcc, Data+, and Data-. USB-C has 24. Yes, 12 of them are just the other side of the connector flipped over. And there are two ground and two power lines on each side, for heavier current. But there are 10 different pins, with 3 differential pairs for data (the original bidirectional pair, plus two unidirectional pairs), and the SBU line, which is used to tell the ends that some lines are not being used for USB, but for some other protocol, such as DisplayPort or PCIe. (Coming soon to an airport near you - power outlets with enough smarts to load exploits through these features.)

A true USB-C cable is simple - it's just wires. It's the ones that are adapters to other connectors that give trouble. Here's a USB-C to DisplayPort connector.[1] There's far more in those devices than a programming resistor.

Controlling USB-C ports is so complicated that Cypress's IC has a 32-bit ARM processor just to operate the port.[2] Either end can be the master, and either end can be the power source. (These need not be the same.) If all the complicated setup fails, the interface drops back to USB 2.0 and pretends to be a "Billboard device", which gives diagnostic info.

The scary part is that USB-C can potentially deliver 100 watts, as 20V at 5A. USB-A was rated for 5V at 0.5A. Botch the power handshake and Bad Stuff is likely to happen.

[1] http://www.ecnmag.com/product-release/2015/05/adapter-soluti... [2] http://www.cypress.com/products/ez-pd-ccg2-type-c-port-contr...

Re:Should you fear your USB cable? by cnvogel on Tuesday March 01, 2016 @03:48AM (#11201507)
> Controlling USB-C ports is so complicated that Cypress's IC has a 32-bit ARM processor

...it's a Cortex-M0, 4k RAM, 32k Flash. By today's standards, this is a very small controller. For the Arduino-Crowd, it's roughly equivalent to the ATmega32u4 on the Arduino Leonardo, but with a Cortex-M0 instead of the 8-bit AVR. Both, by the way, run 16bit opcodes. -- But I get your point, it's nevertheless a lot of "brains" for what people wish would be a dumb cable.

> Either end can be the master, and either end can be the power source.

Unfortunately, this is what people expect from a USB device these days. The poor little "ID" pin on micro-USB was overloaded with functions already: There are interface chips that can distinguish 40 or so different resistor combinations on various lines (see the ancient TSU6721, which was used in the Galaxy-SII). So, I think requiring some intelligence at least for the more complicated combinations really makes sense.

Regarding the number of pins, I don't think it's that bad: USB2+/- has stayed the same, just bridged to two pins each. USB3 Tx/Rx is still two differential pairs, with two extra differential pairs for "future use", Display-Port, ... The ID-pin with resistors to Gnd/Vcc just has been massively upgraded to a serial protocol spoken on the CC1/CC2 pins.

So, for me, after reading a little bit about it, I now see USB-C as Micro-USB3 plus upgraded ID-Pins plus two spare differential pairs... But I was very skeptical at first, too.

Re:Should you fear your USB cable? by Animats on Tuesday March 01, 2016 @10:57AM (#11203457)
The power negotiation alone takes 15 pages in the developer's guide.[1] One can see how an adapter cable with a botched power negotiation protocol could screw this up. Also, statements such as "Should the USB specifications change, then a new firmware will be updated and released" are kind of scary when applied to power negotiation. Especially since you can load new firmware from the connector side of the port. Someone is going to develop an attack based on this, with a USB "power outlet". The OS can't even see this level.

[1] http://www.cypress.com/documentation/application-notes/an965...

Re:Should you fear your USB cable? by colejohnson66 on Tuesday March 01, 2016 @01:12AM (#11201047)
How is USB-C's inane amount of failure points and different than Thunderbolt?
Re:Should you fear your USB cable? by mey on Tuesday March 01, 2016 @01:33AM (#11201118)
Considering you can run Thunderbolt over USB-C, it would be the super set.

https://thunderbolttechnology.net/blog/thunderbolt-3-usb-c-d...