News for hackers. Stuff that matters.
Re:USB Type-C to Become More Secure with Authentication Stan... by marcosdumay on Wednesday January 02, 2019 @04:25PM (#18810379)
I can trust a public outlet to not fry my phone. That is simple, if my phone stays functional I'm good, and if it gets fried I take some real world measures (go to small causes court, make a denounce to some government agency) to get compensation.

The real problem on public outlets is with data attacks, not power. If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore.

Re:USB Type-C to Become More Secure with Authentication Stan... by warent on Wednesday January 02, 2019 @05:18PM (#18810853)
> That is simple, if my phone stays functional I'm good, and if it gets fried I take some real world measures (go to small causes court, make a denounce to some government agency) to get compensation.

This is much easier said than done (in the US at least.)

First, you'd be looking at at least a year of going back and forth in small claims court and by the end of it still have no guarantee of winning. Even if you did win, there's no guarantee the judge would award you the full amount to pay for your fried device.

It almost certainly would not pay your time at the courthouse though; you can ask the judge for punitive but you cannot include legal expenses in small claims court demands.

In the end you would still be out hundreds or thousands of dollars and numerous hours of your time. That's why to me the tiny benefit of using a public USB outlet is just not remotely worth the risk of such a nightmarish hassle.

Re:USB Type-C to Become More Secure with Authentication Stan... by VectorLock on Wednesday January 02, 2019 @06:16PM (#18811288)
This is the same thing as just plugging into a regular power outlet. You don't know if the thing you're expecting to provide 110v is actually giving you 10,000v.

Then again if things were really bad or malicious you could end up losing your life like Sheryl Aldeguer.

Re:USB Type-C to Become More Secure with Authentication Stan... by userbinator on Wednesday January 02, 2019 @06:32PM (#18811396)
The real problem on public outlets is with data attacks, not power. If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore.

My old no-name Android phone (not USB C) has such an option, and searching around it seems to be a reasonably common feature, although not present on all devices. It looks similar to this (mine has the same typo, "USB fuctions"):

https://farm8.staticflickr.com/7485/16035739946_51d110ea40.j...

In charge-only mode it doesn't even enumerate as a USB device when plugged into a computer with an active USB controller, so I suspect no attacks (besides physical ones like overvolting as others here have mentioned) are possible in this mode --- the USB controller on the device is completely disabled.

Re:USB Type-C to Become More Secure with Authentication Stan... by ardy42 on Thursday January 03, 2019 @12:29AM (#18813042)
>> If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore.

> My old no-name Android phone (not USB C) has such an option, and searching around it seems to be a reasonably common feature, although not present on all devices.

I use one of these. The nice thing about the newer versions is that you can verify the impossibility of a data connection through easy physical inspection.

https://www.amazon.com/PortaPow-3rd-Data-Blocker-Pack/dp/B00...

Re:USB Type-C to Become More Secure with Authentication Stan... by geofft on Thursday January 03, 2019 @09:15AM (#18815197)
The problem with that is you also block the pins needed to negotiate power delivery over USB C, so you're limited to 10 W (5 V * 2 A). Laptops that use USB C for charging use C and not micro-B precisely because they need more power than that.
Re:USB Type-C to Become More Secure with Authentication Stan... by close04 on Thursday January 03, 2019 @08:19AM (#18814815)
The generic (unofficial?) name for such a device is a USB condom.
Re:USB Type-C to Become More Secure with Authentication Stan... by geofft on Wednesday January 02, 2019 @06:51PM (#18811514)
Isn't that the wrong direction? My concern is not so much that my phone will show up to an attacker as a storage device, which can generally be restricted or be set to require pairing - my concern is that the attacker will show up to my phone (or laptop) as an accessory, in particular as a keyboard and mouse and perhaps an external display, at which point they can click through any permission or pairing prompts the OS might try to show.
Re:USB Type-C to Become More Secure with Authentication Stan... by kwhitefoot on Monday January 07, 2019 @06:31AM (#18844394)
Definitely!

If my Moto G5+ is locked then it seems that plugging in a keyboard behaves pretty much like plugging a keyboard into a desktop or laptop computer except that it doesn't respond to c-a-del.

I can unlock from the external keyboard by pressing the windows key and then typing my pin number but the multimedia keys and print screen on the keyboard work even with the screen locked.

I would rather that it didn't do any of that until I give permission on the mobile itself.

Re:USB Type-C to Become More Secure with Authentication Stan... by karmakaze on Wednesday January 02, 2019 @05:00PM (#18810690)
Power-only USB cables offer good data protection, or just set your device in such a mode.
Re:USB Type-C to Become More Secure with Authentication Stan... by geofft on Wednesday January 02, 2019 @05:14PM (#18810808)
No such devices exist with USB Power Delivery support, I believe. (I believe you cannot make a passive adapter as you could for 5V, 2A-or-less plain USB A/B power connections; you have to speak the USB protocol and register as a device before you can switch to more than 5V or draw more than 2A. And plenty of people want more than 10W power.)

I also don't believe any OSes offer a mode where they negotiate power delivery and not data, though I'd love to be wrong - that would be 90% of my proposal. It wouldn't let you authenticate individual devices, but it would let you go back to having a single port that's just a charging port.

Re:USB Type-C to Become More Secure with Authentication Stan... by cesarb on Wednesday January 02, 2019 @06:06PM (#18811223)
> you have to speak the USB protocol and register as a device before you can switch to more than 5V or draw more than 2A.

It depends on which "USB protocol" you're talking about. With USB-C, there are five separate data buses on the plug, each running its own protocol. There is the traditional USB 2.0 bus (half-duplex differential pair), a pair of differential dual simplex buses (normally USB 3.0/3.1/3.2, can also be used for alternate protocols like DisplayPort), a pair of sideband wires (used only by alternate protocols), and the Configuration Channel. All configuration of the other data buses and of the main power bus is done through the Configuration Channel, in simple cases through resistor values, in more complex cases through the USB-PD protocol.

So yeah, you have to speak the "USB protocol" to switch to more than 5V or more than 3A, but the "USB protocol" you have to speak is not the traditional USB 2.0 or USB 3.x protocol, but instead the completely separate USB-PD protocol, which runs on its own dedicated set of wires. I doubt you can show up as a pen drive full of malware through the USB-PD protocol, but I don't doubt that cutting the other buses (keeping only the Configuration Channel/VCONN and the main power bus) will still work to deliver power, even at higher voltages and/or currents.

The reason this isn't standardized (as far as I know, a "charging-only" plug is only allowed as a captive cable on a non-charger) is for compatibility: if your device doesn't understand USB-PD, it might not charge at a full speed unless it sees a short on the USB 2.0 bus (Battery Charging specification), and doing that short on an adapter would allow a device to draw too much power from a non-charger.

Re:USB Type-C to Become More Secure with Authentication Stan... by gumby on Wednesday January 02, 2019 @05:22PM (#18810890)
You can buy type c condoms that do all the negotiation but block data to and from the cable.
Re:USB Type-C to Become More Secure with Authentication Stan... by geofft on Thursday January 03, 2019 @09:16AM (#18815205)
Do you have a link to such an item? All I have found is devices that lower you to USB A-style 10 W charging.
Re:USB Type-C to Become More Secure with Authentication Stan... by anticensor on Wednesday January 02, 2019 @05:15PM (#18810821)
18V, 5A would be a shock hazard.
Re:USB Type-C to Become More Secure with Authentication Stan... by semi-extrinsic on Wednesday January 02, 2019 @06:21PM (#18811323)
DC voltages below 50 V are considered "safe" in normal indoor conditions. It's often referred to as "extra low voltage", as opposed to "low voltage" (50 V - 1000 V) and "high voltage" ( > 1000 V).

If you want to verify the safety of 18 V: ever touch both poles of a 9V battery with your fingers? You can't feel anything. Go ahead and try two in series, you still won't feel it.

Re:USB Type-C to Become More Secure with Authentication Stan... by naikrovek on Wednesday January 02, 2019 @09:12PM (#18812252)
Really? I can feel 4 volts between my finger and thumb. Isn't painful or anything, but I can tell when a lipo battery is charged vs. discharged.
Re:USB Type-C to Become More Secure with Authentication Stan... by xxs on Thursday January 03, 2019 @03:39AM (#18813708)
You can feel lower voltages if you fingers are injured, or if you... lick them.

As kids (6-9y) we used to test the voltages of 3R12 (4.5v) by touching the poles with tongue, a sharp bites - the battery was good.

Re:USB Type-C to Become More Secure with Authentication Stan... by Maskawanian on Wednesday January 02, 2019 @10:45PM (#18812650)
Yes, here is a good video about this: https://www.youtube.com/watch?v=ZxBF7WC0TQk
Re:USB Type-C to Become More Secure with Authentication Stan... by userbinator on Wednesday January 02, 2019 @06:22PM (#18811329)
That's roughly the voltage that laptop AC adapters output, and they do so continuously without needing any special negotiation/signaling.

(Even those from manufacturers that try to lock this down using an EEPROM, e.g. Dell, still output their voltage like the others, but the laptop might not want to charge from an "unofficial" power source.)

Re:USB Type-C to Become More Secure with Authentication Stan... by XMPPwocky on Wednesday January 02, 2019 @05:51PM (#18811120)
If you stick it in your mouth or something, maybe. Or if you're soaking wet and have a terrible heart. Otherwise, nobody's getting hurt off 18v.
Re:USB Type-C to Become More Secure with Authentication Stan... by xxs on Thursday January 03, 2019 @03:36AM (#18813692)
Laptops tend to be 19V and you can hold them with both hands wet w/o any risk (it's DC, so even better).

If you lick them it'd be quite unpleasant but that's that.

Voltage below (roughly) 36 are safe.

Re:USB Type-C to Become More Secure with Authentication Stan... by gsich on Wednesday January 02, 2019 @05:59PM (#18811179)
No. Skin resistance is at least around 100k Ohm at that voltage.
Re:USB Type-C to Become More Secure with Authentication Stan... by basementcat on Wednesday January 02, 2019 @07:59PM (#18811906)
The shock hazard is the 5A, not necessarily the 18V.
Re:USB Type-C to Become More Secure with Authentication Stan... by XMPPwocky on Wednesday January 02, 2019 @09:32PM (#18812344)
Well, no. If 5A flows through you from hand-to-hand, sustained for longer than an instant, you're probably dead. But I've touched live power supply terminals for something rated for 20A without a second thought.

And if there's a 10kV differential between your left and your right hand, sustained for longer than an instant... You're probably dead. But I've touched a 10kV power supply (not on purpose, this one), and...still here.

So! What gives?

Well. Place a 0.1 ohm resistor across that power supply. 18V across 0.1 ohms will produce a current of 180A. This will dissipate more than 3kW in the resistor, and it will very rapidly disassemble itself. But that doesn't happen!

Okay, now put a 10 megaohm resistor across that power supply. It's 5A, right? So 5A across 1 megaohm will produce a voltage of 5000kV. This will dissipate 25 megawatts, and destroy the resistor even faster. This also doesn't happen!

In fact, what will happen in the first case is that 5A, not 180A flows (assuming the PSU doesn't detect the apparent short and shut down entirely.). But Ohm's law says that if 18V is placed across a 0.1 ohm resistor, 180A must flow!

Ah, but 18V isn't placed across the resistor. Instead, as current draw approaches the 5A limit, the power supply starts dropping the voltage. No more than 5A will flow, even if that means the voltage must be decreased.

And 5A won't flow through the 1 megaohm resistor, either. Instead, no more than 18V will be placed across the load, even if that means the current must decrease.

So, the power supply won't kill you UNLESS your skin resistance is low enough that 18V causes a lethal (very roughly roughly 1A) current to flow through you. Luckily, humans have a fairly high skin resistance, at least when we're dry, and 18V is fine.

It's not the volts that kill you, it's the amps which the volts are directly related to. 10kV across your body, sustained for a bit, will kill you dead, modulo some sort of miracle. 10kV at 1mA across your body ... is impossible. If you touch a 10kV, 1mA supply- the voltage will drop so that only 1mA flows.

It's not the voltage limit on the power supply that kills you. It's not the current limit on the power supply that kills you. Both need to be high enough to do you in.

Re:USB Type-C to Become More Secure with Authentication Stan... by fb03 on Thursday January 03, 2019 @06:23AM (#18814358)
Extremely interesting explanation. Thank you man.

I would like to peruse your electronic skills for another quite unrelated question that has been hovering my head for quite a while.

I know that normal USB (1,2) devices charge using the provided 5V rail off the USB connection. And I've read somewhere else that coming from a PC motherboard or other regulated (standardized) USB outlet, the port will provide about 500mA.

What would happen if i took a ATX PSU and rigged usb ports directly (at the correct power pins) to the psu's 5V rails?

Would I fry any devices plugged in? Or..

Would any plugged devices limit their intake and I'd be left with a 'super quick charger' which can charge any device at the maximum amount of power that the device can receive power? those 5V rails usually output at 30A+ and stuff.

thank you again, and hope you can shed some light into this long doubt of mine (I always 'dreamed' of creating some atx-frankstein psu which i could use for electronic experiments but also fit some usb ports in it).

o/

Re:USB Type-C to Become More Secure with Authentication Stan... by Kirby64 on Thursday January 03, 2019 @11:45AM (#18816477)
EE/CE here: In order if your questions...

1. Assuming you hooked the 5V to the USB 5V and the GND to the USB GND pins, nothing bad would happen.

2. Nothing would get fried

3. Plugged in devices would respond according to how they're designed. Most cell phones will limit current and only draw 500mA if they don't have any other signalling to test otherwise. Some will slowly ramp current until their own internal limits if voltage drop isn't too bad. Some 'dumb' devices will pull as much current as they 'want' or need. You won't be able to push 30A into any device because there are almost no USB devices that 'want' that much current. Even really poor behaving devices (outside of outright broken ones) will probably only draw 3-5A max. Technically this is non-compliant, since there are defined USB specifications for how USB ports should be connected.

If you wanted to make a 5V 'mega USB' charger, here's all you'd need to do: Take your 5V, many amp power supply and connect all USB-A ports you want to it, with a constraint that number of USB ports should be total amperage divided by 2.5. E.g. if you had a 10A supply, only use 4 USB ports. Short the D+ and D- pins together on the connector. 5V should be connected to your large 5V rail, GND should be connected to ground.

That's it. You've just made a 'DCP' (Dedicated charging port) device. By USB standards any device connected can pull up to 1.5A; in practice they'll usually pull 2.1A or more if they can.

Re:USB Type-C to Become More Secure with Authentication Stan... by fb03 on Thursday January 03, 2019 @12:47PM (#18817156)
THANK YOU! that's what i needed to know.

knowing shit about electronics, i was worried there would be 'too much current' and that i could fry something :-)

have a good one, man o/