Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 & 3 and only connects 1 & 4. (see Wiki for pinouts)

I'm sure that I can't be the only one who thought of this, so I'll assume it's a hardware dongle of some type that I can use to filter power before it gets to my phone.

Question

  • Is this a legitimate idea?

  • What hardware devices exist that allow this filtering?

  • Do any cellular phones incorporate this security feature in hardware? (akin a hardware switch that opens or closes pins 1&2)

*Definition: Juice Jacking is when a USB charger is modified so that it reads, modifies or deletes information on a user's cell phone. This can include stealing passwords or adding spyware onto the device.

share|improve this question
1  
I know my iPhone doesn't allow me to read any contents through usb if I haven't unlocked the screen with the pincode. –  Lucas Kauffman Nov 3 '12 at 16:54
    
@LucasKauffman I believe this is true for most iPhones, and probably many other smartphones. However, when given the option between a software/firmware solution and a physical solution to achieve the same effect in terms of security, the physical solution is often more reliable. –  Iszi Nov 3 '12 at 17:04
    
I know, it was just because he asked if some phones have a feature like that –  Lucas Kauffman Nov 3 '12 at 17:12
    
@LucasKauffman He specifically asked if it was incorporated in hardware, though. I doubt there is a phone that does this via hardware lockout - most are probably software/firmware solutions. –  Iszi Nov 3 '12 at 17:13
    
aha, well it's late :P –  Lucas Kauffman Nov 3 '12 at 18:12

3 Answers 3

up vote 8 down vote accepted

Many phones allow you charge with only power and ground connected. Some phones (looking at you, Apple) use the data lines to determine whether or not the charger is "permitted" to charge your phone. Other phones still (some Android phones in particular) explicitly ask you to decide what to do with the USB connection -- e.g. charge only, or mount as usb drive, or application-specific data connection.

Some USB cables (often the cheap ones you get with a cheap charger) will only run power and ground leaving the data lines unconnected. It's pretty trivial to tell if you have one of them by attempting to use it for data and see what happens.

While I don't belive that any "adapters" exist for this purpose, it would be very simple to make one: just take any existing adapter and clip the data lines. Just bear in mind that with some devices (e.g. apple) this will prevent charging.

share|improve this answer
    
How did you learn this about Apple devices? Self experimentation? Blog, ...? Reason I ask because my next question is how would one "hack" this permission. Assume a hardware USB "filter" would close the circuit on the +5v line to the other two pins. Maybe add a resistor or cap for the fun of it... something along those lines but more scientific. Thoughts? –  makerofthings7 Nov 3 '12 at 21:29
    
@makerofthings7 - Common knowledge. –  Ramhound Nov 3 '12 at 22:33
1  
@makerofthings7 Limor Fried did a full write-up of reverse-engineering the required voltages for her "mintyboost" project. Look it up over at adafruit. –  tylerl Nov 3 '12 at 23:50

Yes this is a legitimate need, particularly if you use power from laptop/computer.

If you wish to have hardware protection the best is to have a USB cable or a cable/adapter extension with only PIN 1 and 4 mapped (2 and 3 shorten).

Very unlikely that hardware protection will be provided in phones as the USB port has also a use for data transfer in some other scenarios.

share|improve this answer
    
My thought is that there may be an on off switch that controls the hard connection... similar to the physical wifi switch located on some laptops –  makerofthings7 Nov 4 '12 at 3:21

Answers:

  • Yes, this is a legitimate idea - and it works. USB power supplies are generally data only.
  • If you Google "USB power only cable" you'll find a few like this 0.96 GBP cable on Amazon.co.uk. Alternatively you can make your own by simply opening a standard USB cable, clipping the two data lines and connecting them. Some devices use the fact that the data lines are connected to identify that this is a power only USB connection.
  • Phones can't incorporate this in hardware because they need the data lines to communicate data over USB.
share|improve this answer

protected by Community Jan 27 at 7:34

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.