A sketchy looking person walked up to my car the other day while I was parking and asked if he could charge his cell phone in my car and offered to pay me $5. I didn't allow him to charge his phone in my car of course, but it made me wonder if there was anything he could have done (other than charge his phone) if I had connected his phone to my car's USB port. Anyone know if this is a scam of some sort?
Since I don't know your car model but you seem to be concerned about information security and the fact that the possible attacker chose your car I make the assumption that the USB port in your car is not power-only.
The telephone could do anything on this USB port because every USB device can identify itself as any device (storage, keyboard, network, display, ...). Have a search for bad USB.
The most critical attack vector is the bus system in your car. CAN is the best known protocol but there are others which are based on it like UDS (which is still weak from a security perspective). You can imagine it as a network in your car where all components can communicate with each other with more or less restrictions.
Here are some possible scenarios:
The USB port could be dual used as a maintenance port which could allow full access to the car bus system.
The car media system could have a vulnerability which could allow privilege escalation to the bus system. (By design the media system should be isolated from the critical components on the bus but in practice all vendors fail to do so.)
If you car supports some kind of wireless features for unlocking and starting, this could be a part of some exploitation technique.
The car could be used as a bridge between the attacker device and your phone (if it's paired somehow with your car via Bluetooth or WiFi) for some kind of attack against your phone.
The car media system could be infected with some kind of malware targeting your smartphone or other connected devices.
Malware which targets your car directly (like ransomware for example) would be also possible but I really really hope that this industry is not at this point yet.
Just to have a sneak peek for some details or to distract you for some reason.
Just to name a few. However. This is a very interesting question and attack scenario. Maybe I would have given this person $100 just to know their real intent in exchange for not calling the cops immediately.
Without being able to research vehicle vulnerabilities, we can't really tell you. It's definitely possible there was some sort of autoplay exploit in your vehicle's USB handling.
We'd need to know your specific model, and then we'd have to go and buy/test the vehicle. After which we'd need to run a lot of tests. However, given that security is an afterthought to most developers, I would say it's definitely possible.
Bottom line, I would not let people do this.
Attacks through USB and other car interfaces such as the stereo are known risks in modern cars. There is research that has shown proof cars can be compromised via various inputs, including the entertainment systems.
Consider the following from this article from IT World:
They found lots of ways to break in. In fact, attacks over Bluetooth, the cellular network, malicious music files and via the diagnostic tools used in dealerships were all possible, if difficult to pull off, Savage said. "The easiest way remains what we did in our first paper: Plug into the car and do it," he said
For more in-depth reading, this paper(linked from previous article) describes some of the research surrounding "unintended acceleration." Some of the examples included being able to do things like turning off brakes, turning off the engine, falsifying speedometer readings, and locking the doors.
All that being said, I highly doubt they wanted to hack your car. More likely, they wanted to rob you, or snag whatever was easy to grab off the dashboard/seat, or maybe even try to steal the car itself.
It depends on what type of USB port you have. If you have a power-only USB port (i.e. in your cigarette lighter adapter), then there is nothing that can be done to attack the vehicle. On the other hand, if your USB port is a data port for some device, then the vulnerabilities could be quite extensive. In assessing risks, consider what the device with the USB data is capable of. For example, if you just have a stereo system with a USB data port, then only the stereo system is vulnerable. However, if your data port allows you to connect devices to a computer that operates any safety systems for the car, then the risks are quite extensive. The exact vulnerabilities which might lead to these risks becoming active will depend on your the computer manufacture and car makers policies, including update policies, OS vulnerabilities, and so on.
It is wise to be cautious about connecting a strange device to a USB data port that interfaces with your car's main computer.