Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
On a long haul flight, I imagine that charging a phone (in flight mode) with the inbuilt USB port on the head rest would be a security risk.
Could I mitigate that risk by taking a regular USB cable and cutting the data (but not the power) cables? Or does the USB protocol need a data handshake to begin charging? Or is there another better solution?
Could I mitigate that risk by taking a regular usb cable and cutting the data (but not the power) cables? Or does the usb protocol needs a data handshake to begin charging?
Such a cable does exist, so a data handshake must not be required.
Such cords are discussed on some Stack Exchange sites:
So yes, using such a cable or making one using a DIY approach could mitigate a risk that depends on the 2 data pins. Of course, a different kind of attack where unexpected power is sent, possibly with the intent to damage the device, would still be possible.
USB devices can negotiate the provided current from the host device. If power negotiation is not possible (because you cut the data wires), a maximum of 100 mA is supplied. This means you can charge devices, but it may be slower than usual.
Devices such as LockedUSB do the power negotiation on both sides, while not allowing data to pass between devices. This charges your devices faster, but arguably may be less secure than cut wires.
Although not entirely in line with the OP's question, I wanted to share a different solution.
You could take a powerbank with you. Small powerbanks capable of charging your phone at least 1 time don't take up too much space. You can charge the powerbank at the airport terminal, in your hotel, or even on the flight (as there's no risk for malicious data affecting the powerbank). When you need to charge your phone, you can use your freshly recharged powerbank to fill it up.
Another advantage of this solution is that you have a powerbank with you on your trip, should you ever need to recharge your phone in an area where no power outlet is available, or when you don't have your charging cable with you. You can even use the powerbank in other areas where you don't trust a USB outlet.
Modern smart devices are power hungry machines that require frequent charging. This problem is usually solved by bringing along portable power chargers that are expensive and bulky. As a solution to the power problem, many public facilities or events are starting to provide booths with USB ports for free charging. However, charging smart devices on unknown / public USB ports will make your device vulnerable to “juice jacking”, which allows unauthorized users access to data on your phone. Additionally, smart devices can be infected with malware through these unidentified USB ports.
The Solution A “neutered” USB cable that allows the charging current to pass through but physically disabling all forms of data transmission. This essentially blocks out all forms of communication between the smart device and the source of power, regardless whether it is a computer or an adapter plugged into a wall socket. This can be achieved by physically disconnecting the data transmission wires between the device and the source of power. Doing this on a standard USB cable requires some technical knowledge and makes for an unsightly cable. This is where a USB condom comes in. Putting one on at the end of a standard USB cable will block the data transmission lines between the device and the power source.
How is it Made? Solder the first and fourth pins of the male drive to the female drive and you have a USB condom that works with most devices. //For the device to work with iPhones, you’ll have to include an additional circuit board to fake a voltage charge.
Note: The current design shown above works for all devices, even iPhones!
http://m.instructables.com/id/Making-a-USB-Condom/?download=pdf
Maker Credit: Tan Guo Wei, Creative Technologist at Metalworks by Maxus
A slightly different take, but you can use a trusted wall-to-USB charger. This is the approach I take when charging from a public/shared facility.
Most (if not all) flights I've been on with power, offer both a wall-compatible outlet as well as USB.
Yes, there is a good solution. The Portpilot is a USB power analyzer which gives you control over locking down data and checking modes, http://portpilot.net/. Shoutout to Hak5, it is available at http://hakshop.myshopify.com/products/portpilot. Not affiliated in any way, but it is on my wish list.
Ok, I read the question again. If you want to dissect the cable and cut parts of it I guess that would work. If you want a solution that works with any USB cable and any device, I would vote for Portpilot.
Most (all?) phones will not have any "data" connection without specifically having been authorised by an affirmative action by the user, e.g. unlocking the phone and accepting a dialog.
So the use of some special (expensive) "secure" USB charging cable is not required.
TL;DR: yes, but connect a small resistor between the data lines at the host end.
USB protocols do support power delivery without data lines. According to the Wikipedia article,
The charging device identifies the type of port through non-data signalling on the
D+andD−signals immediately after attach. A [dedicated charging port] simply has to place a resistance not exceeding 200 Ω across theD+andD−signals.
Without the connection between the data pins, the charging port would supply only 100 mA (a low-speed single unit load - the initial non-negotiated supply), but with this modification (at the power supply end), you should get at least 1.5 A and (at the port's discretion) up to 5A without further action.
For further information, you'll want to consult USB Battery Charging Specification (sorry, that's a Zip archive containing PDFs). There are higher-current modes that may be enabled by FSK signalling on the power lines themselves (USB Power Delivery), but you can safely ignore those.
Note that in this answer, I'm only addressing data risks, that might subvert your device without your knowledge. You are still subject to the usual Denial of Service risks such as over-voltage and reverse voltage, but you will obviously at least know if your device is destroyed by the outlet. I'm assuming you have decent backups of your device (including any removable media you were foolish enough to leave inserted), and that you're not someone who is likely to be specifically targeted - if a charging port is indiscriminately destroying users' devices, it will get noticed!
I've seen one Nokia phone that would charge via USB only when connected to PC, but in most cases it would just work with data wires cut
But there are other risks involved: unstable power source may damage your device, even if it is not intended to be malicious.
To be 100% sure I'd recommend using the powerbank solution, effectively having safety buffer between the pricey device and untrusted power (and possibly data) source
