Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB.

The visual assumption is that the USB file transfer mode is protected by a password; but then again, it is subject to implementation flaws and risks.

  • Are there any "known bad" or "known safe" smartphones with regard to USB security?

  • How does a corporation protect from these risks?

  • Does anyone have easy-to-understand explanations of the risks and what not to do? (e.g. use a public cellphone charging station)

share|improve this question
    
Recent advent in this area - theverge.com/2013/6/3/4390808/… –  Steel City Hacker Jun 3 '13 at 13:13
add comment

2 Answers

up vote 9 down vote accepted

The kind of attack you are talking is popularly coined as "Juice Jacking".

  • Are there any "known bad" or "known safe" smartphones with regard to USB security?

    • In my knowledge, NO.
  • How does a corporation protect from these risks?

    1. By making policies (actually spreading awareness) about the threat as many people yet aren't aware about it.
    2. And popularizing the practice of Not Using public charging kiosks.
    3. To charge your phones on the go, use a normal power cord as I'm sure non-smartphone mobiles are not that old to get their public charging outlets removed.
  • Does anyone have easy-to-understand explanations of the risks and what not to do? (e.g. use a public cellphone charging station)

    1. The threat doesn't only get limited to downloading of all your data but also malware could be written to your device, to own victim for longer time.
    2. What to do & Not to do list added in previous part.
share|improve this answer
add comment

There is an additional piece of protection you can put in place:

On my android phones, I have the default connection type set up to be 'charge only' which prevents access through the USB port until I manually set the charge type to accept a connection. And this can only be done through the on-screen menus.

I think iPhones can do the same but don't have any definite data on that.

share|improve this answer
2  
If an iPhone is locked with a passcode, iPhoto/iTunes can't sync until it's unlocked. iOS 4 and above. –  user185 Oct 15 '11 at 10:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.