Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play?

I don't know what protocol the transfer is there. Can a malicious program automatically transfer once the plug and play is going?

I'm new to this stuff, but I would be worried about them being able to monitor network traffic based on that scenario. I don't know if that is a founded worry though, which is why I'm asking here.

share|improve this question
    
It probably depends on multiple details. Though the simple answer may just be a yes. After all, it is USB. The question may actually be about how difficult it would be. Are you talking Android, iPhone, or are you talking about your basic line of phone that might just have a folder for a music player, desktop backgrounds and (any) other file? Are you talking Windows XP, or Windows 7, or are you referring to Mac or Linux? Are you talking about your own phone, or some unknown phone, in which case the general purpose USB device vulnerabilities apply? –  George Bailey Feb 6 '12 at 22:56

10 Answers 10

up vote 3 down vote accepted

@schroeder has nailed it. A malicious USB device can attack your computer in a number of ways: by pretending to be a CDROM reader containing a CD that has an autorun file on it; by pretending to be a USB keyboard. And there's always the possibility of an exploitable vulnerability in the software on your computer, an exploitable vulnerability in the USB driver code.

Related: I suggest that you take a look at juice jacking, which describes how hooking up your device to an untrustworthy USB thingy can compromise your device.

By combining these methods, it would be technologically feasible for a worm to spread from computer to mobile phone to computer, and so on. Fortunately, we haven't seen that arise much in practice, but it could.

share|improve this answer

At my school the Information Assurance department came up with this complete USB takeover with an Android phone.

https://media.blackhat.com/bh-dc-11/Stavrou-Wang/BlackHat_DC_2011_Stavrou_Zhaohui_USB_exploits-Slides.pdf

share|improve this answer

There's a fun exploit developed at Georgia Tech: they can take the accelerometer data from a phone siting next to your computer keyboard and figure out what you're typing just from the vibrations passing thru the desk.

http://gatech.edu/newsroom/release.html?nid=71506

share|improve this answer

InfoSec Island Article

InfoSec Island produced an extremely detailed article detailing specific software which can be used to turn a rooted Android-based device into a Pen Testing / Hacking platform. They outline various areas including USB connectivity, Wi-Fi exploitations and Remote Access. The link is above.

share|improve this answer

Using USB devices to spread malware has already been demonstrated as a very viable attack vector. See: http://www.theregister.co.uk/2011/06/27/mission_impossible_mouse_attack/ The article discusses how an ostensibly harmless mouse was used to infect a PC.

share|improve this answer

You're phone can definitely penetrate your thick client if there is any form of connection between them. Examples of this, but not limited to is:

  • Directly connecting the phone to the client, allowing it to spread as @schroeder pointed out
  • Take advantage of storing and executing files from Dropbox folder
  • Launch attacks against wireless or other devices that surround you

In these days where you have the same operating system on your phone, tablet and PC you can be sure that new types of malware will have no problem spreading and exploiting from device to device where it is not important if it is a phone or a PC.

share|improve this answer

I don't believe anyone is thinking broad enough. Using features provided in many modern mobile devices, I believe an attacker if driven, could compromise a mobile host(smartphones/tablet), and use it to do a variety of things like pivot, rouge-AP, remote bluetooth/wifi spectrum analysis... You could probably do a lot of remote exploitation through the 3g connection, and micro SD cards can hold 2tb(theoretically) so, its really a matter of who, when, what, and where.

If you are an enterprise or any business that needs a more secure data policy then I suggest having a "check-in" for all devices before entering a specified structure or area.

Trust me when I say mobile devices are not being looked @ heavy enough in corporate security. The same with any wireless devices such as personal cameras with wireless eye-fi chips or any personal wireless router.

PAN/BAN networks are a real threat as they can get as close to the target as possible with the least amount of resistance. How do you think stuxnet was deployed? (a flash-drive)

Hope it helps ;-0

share|improve this answer

I wanted to add that if you have a phone that has wifi and bluetooth, you don't need to plug into your desktop (if the network has a wifi component).

share|improve this answer

There are virusses that spread through USB, in essence on windows it were problems with an autorun "feature". On Linux it will get a bit harder because the phone might not be auto mounted. So it might be possible on some systems and less likely on other. Also there have been other attacks than just virusses.

The thing is, once you have physical access to a server (which you need to attach the phone), the fact is the security is quite low. You rely on physical security (security guards, locks,doors...)that people can not just access your equipment. If they have physical access there might be other scenarios that are more feasible/dangerous than hooking up a phone.

share|improve this answer

Yes

When you plug into USB, you can do a lot. The link above is about using your phone as a USB keyboard, which means you can run commands, download and execute software, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.