Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play?
I don't know what protocol the transfer is there. Can a malicious program automatically transfer once the plug and play is going?
I'm new to this stuff, but I would be worried about them being able to monitor network traffic based on that scenario. I don't know if that is a founded worry though, which is why I'm asking here.
@schroeder has nailed it. A malicious USB device can attack your computer in a number of ways: by pretending to be a CDROM reader containing a CD that has an autorun file on it; by pretending to be a USB keyboard. And there's always the possibility of an exploitable vulnerability in the software on your computer, an exploitable vulnerability in the USB driver code.
Related: I suggest that you take a look at juice jacking, which describes how hooking up your device to an untrustworthy USB thingy can compromise your device.
By combining these methods, it would be technologically feasible for a worm to spread from computer to mobile phone to computer, and so on. Fortunately, we haven't seen that arise much in practice, but it could.
When you plug into USB, you can do a lot. The link above is about using your phone as a USB keyboard, which means you can run commands, download and execute software, etc.
There are virusses that spread through USB, in essence on windows it were problems with an autorun "feature". On Linux it will get a bit harder because the phone might not be auto mounted. So it might be possible on some systems and less likely on other. Also there have been other attacks than just virusses.
The thing is, once you have physical access to a server (which you need to attach the phone), the fact is the security is quite low. You rely on physical security (security guards, locks,doors...)that people can not just access your equipment. If they have physical access there might be other scenarios that are more feasible/dangerous than hooking up a phone.
Using USB devices to spread malware has already been demonstrated as a very viable attack vector. See: http://www.theregister.co.uk/2011/06/27/mission_impossible_mouse_attack/ The article discusses how an ostensibly harmless mouse was used to infect a PC.
I wanted to add that if you have a phone that has wifi and bluetooth, you don't need to plug into your desktop (if the network has a wifi component).
I don't believe anyone is thinking broad enough. Using features provided in many modern mobile devices, I believe an attacker if driven, could compromise a mobile host(smartphones/tablet), and use it to do a variety of things like pivot, rouge-AP, remote bluetooth/wifi spectrum analysis... You could probably do a lot of remote exploitation through the 3g connection, and micro SD cards can hold 2tb(theoretically) so, its really a matter of who, when, what, and where.
If you are an enterprise or any business that needs a more secure data policy then I suggest having a "check-in" for all devices before entering a specified structure or area.
Trust me when I say mobile devices are not being looked @ heavy enough in corporate security. The same with any wireless devices such as personal cameras with wireless eye-fi chips or any personal wireless router.
PAN/BAN networks are a real threat as they can get as close to the target as possible with the least amount of resistance. How do you think stuxnet was deployed? (a flash-drive)
Hope it helps ;-0
You're phone can definitely penetrate your thick client if there is any form of connection between them. Examples of this, but not limited to is:
In these days where you have the same operating system on your phone, tablet and PC you can be sure that new types of malware will have no problem spreading and exploiting from device to device where it is not important if it is a phone or a PC.
At my school the Information Assurance department came up with this complete USB takeover with an Android phone.
There's a fun exploit developed at Georgia Tech: they can take the accelerometer data from a phone siting next to your computer keyboard and figure out what you're typing just from the vibrations passing thru the desk.
InfoSec Island produced an extremely detailed article detailing specific software which can be used to turn a rooted Android-based device into a Pen Testing / Hacking platform. They outline various areas including USB connectivity, Wi-Fi exploitations and Remote Access. The link is above.
