52

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk.

It was for 3 seconds and I was in control of the MacBook the whole time.

Improve this question
15
  • 19
    In theory, yes, in practice, probably not. If it had been a Firewire device, quite possibly.
    – Matthew
    Jun 9, 2016 at 12:55
  • 23
    Is there a reason to suspect that this person is targeting you or your data? Or are you worried about general Android malware that the person would have unwittingly exposed you to? If it's the former, yes, you are at risk from anything plugged into your computer; if it's the latter, nope even the worst Android malware seen in the wild doesn't have any special upstream infection techniques.
    – Jeff Meden
    Jun 9, 2016 at 14:03
  • 2
    @MartinCarney Yes, in theory, though you would be limited to the slowest possible charge as it blocks all possible methods of asking for more current. Certainly not so good on a 2A charge tablet, at 500mA it just won't charge, just drain slower.
    – ewanm89
    Jun 9, 2016 at 20:21
  • 2
    I would carry around charge only usb cable, I learned the hard way (when trying to import code onto my arduino) that such a thing exists, (it would only have +,- cables into the usb instead of the data cables) that way data cannot be transmitted.
    – andyADD
    Jun 10, 2016 at 15:02
  • 3
    It's dangerous -- you can catch Android, which slowly turns your Macbook into a Chromebook. Remember, only use your Macbook to charge iPhones!
    – Federico Poloni
    Jun 13, 2016 at 6:16

6 Answers 6

Reset to default
62

Yes.

Android devices have the capabality to act as basically any USB device.

This opens up gates for all kind of Bad USB attacks like

Rubber ducky attack that types in scripts very fast (Almost un-noticable by the user) by acting as a keyboard (HID | Human interface device).

Then it could act as a network device and setup MITM

These two are done by emulating normal USB devices.

Also USB exploits specific to the OS or platform maybe used.

If you want to try these you can try NetHunter.

https://en.wikipedia.org/wiki/NetHunter

https://nakedsecurity.sophos.com/2014/08/02/badusb-what-if-you-could-never-trust-a-usb-device-again/

Improve this answer
6
  • 2
    what if the session is locked? the device has to guess the password, right?
    – Display Name
    Jun 10, 2016 at 11:56
  • @SargeBorsch If the session is locked using a pasword normal Ruberducky attacks won't work. But USB exploits usually work. I remember reading about a thumbnail exploit used to run code cos the thumbnail cache process was running even when locked.
    – user76223
    Jun 10, 2016 at 13:24
  • @SargeBorsch I think MITM will work even with session locked.
    – user76223
    Jun 10, 2016 at 13:24
  • but how? USB devices do not receive all key presses. And even if they could act as a display, password characters are usually masked on screen.
    – Display Name
    Jun 10, 2016 at 13:36
  • @MITM works by the USB device acting as a network or device similar to USB-LAN device. As long as USB device driver is loaded the attack works. I don't know if USB devices are loaded in Mac during lock state.
    – user76223
    Jun 10, 2016 at 13:58
17

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of course there are many more possibilities to run malicious software too.)

The smartphone pretty much acts like an usb stick. So every security risk you get with plugging in an usb stick also applys for smartphones.

Improve this answer
14
  • 13
    @EmanuilRusev Since it's highly unlikely that an Android device would contain autorun software for iCloud (unless they were somehow personally targeting you) I would suspect that the iCloud popup was simply your MacBook's response to seeing that the connected usb device had photos on it. Try it with a normal usb stick that has a few JPGs on it, and you will probably see the same screen.
    – Jeff Meden
    Jun 9, 2016 at 13:58
  • 7
    No need for autorun, all one needs to do tell the USB to emulate a keyboard and send the keystrokes to do whatever...
    – ewanm89
    Jun 9, 2016 at 16:29
  • 7
    @dandavis Yeah, clearly a unix based operating system is nigh impossible to configure without a mouse. Any reference for that weird claim?
    – Voo
    Jun 9, 2016 at 18:58
  • 5
    @dandavis in other words it's as open as a standard user on windows or linux... funny that is. And if someone is emulating HID and sending scripted keystrokes then I wouldn't call it low-skill. Automated yes, low-skill, no. Privilege escalation exploits do exist, popping the terminal with just the keyboard is easy, and emulating keyboard is HID, which means I can emulate mouse just as easily.
    – ewanm89
    Jun 9, 2016 at 20:04
  • 3
    @bonsaioak only if you are logging in to an account with admin privileges else it asks for username and password for uac escalation. Maybe we should enable root account on Mac and log in directly with that and compare. Or modify sudoers to not need password for any escalation. I am a UNIX guy through, give me Linux or freeBSD any day, but don't drink the sole collage that it is more secure just because it isn't configured correctly.
    – ewanm89
    Jun 10, 2016 at 7:42
16

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live.

You would still be exposed to attacks that can take place over the power cables, such as the device supplying a very high voltage or current back to your laptop. Presumably MacBook USB ports have taken some preventative measures against this kind of attack, but I don't know for sure.

Improve this answer
2
  • As the attacker currently didn't use the USB port before you, softwarematically disabling the usb may also do the trick. Not sure if it will still charge, but here is a description of how it can be done: Browse to ‘/System/Library/Extensions’ folder on the system disk. Remove both IOUSBMassStorageClass.kext and IOFireWireSerialBusProtocolTransport.kext which are found in this directory. Reboot the machine. (Putting them back will probably restore the ports)
    – Dennis Jaheruddin
    Jun 10, 2016 at 13:31
  • 1
    @DennisJaheruddin This might prevent the OS from interacting intentionally with that USB port, but do you know it doesn't permit that USB port from interacting with the hardware USB controller in a malicious way?
    – Yakk
    Jun 10, 2016 at 15:30
7

There's also the possibility that it's not actually an Android phone, but a "USB Killer" of some sort:

enter image description here

This is a device which, when connected to the USB port, will send -220 volts down the data / power lines, thereby frying the USB controller and possibly other components of your laptop. This one looks like a flash drive, but it could easily be made to look like an Android phone.

I don't think this is a significant risk though, unless someone is targeting you and wants to destroy your laptop for some reason.

Improve this answer
3
  • 3
    Scared me. So diabolical. I'm sleeping with one eye open tonight.
    – Paulb
    Jun 10, 2016 at 18:57
  • One could fit a lot of power storage caps inside a phone-sized device.... BRB!
    – Criggie
    Jun 11, 2016 at 23:59
  • 1
    @Paulb that won't help you. Instead of getting your laptop fried (property damage + break and entry, easily suable) you end up in a bloody fight (lots of physical pain, risk of death, can be sued for defending yourself too well)
    – John Dvorak
    Jun 12, 2016 at 6:33
5

There is always the possibility that someone could have found a vulnerability that could abuse the system at any level. Vulnerabilities have been found continuously on all systems throughout the history of computers, so it is not impossible.

That said, the risk seems fairly low.

Improve this answer
3
  • 2
    USB is a well known attack vector, but you don't need any exploit or find a vulnerability. That's working as intended. The only thing one has to do is claim to be an USB keyboard and then do whatever you want. There are some recent mitigations as additions to the linux kernel (the user is basically asked what kind of device they're plugging in) but in all mainstream OSes it's really simple to exploit.
    – Voo
    Jun 9, 2016 at 18:58
  • 2
    Your answer boils down to "Anything's possible." That's not a very useful answer.
    – Mar
    Jun 9, 2016 at 19:37
  • 3
    Martin, how would you answer if I asked you if I had any chance of catching an unknown disease when going somewhere? There can not be a definite answer.
    – Julie Pelletier
    Jun 9, 2016 at 19:45
0

Depends on the cable. If it's a cheapo "one-size fits all" charger cable like this, (sold in chain store pharmacies like CVS, Walgreens, etc), it might have fewer wires, (to save on manufacturing costs). If the data wires don't exist, it can't transmit any data.

Instructables has a how to for downgrading a four wire USB data cable to a two wire charger cable. Summary, open cable sheath, see four wires, leave the red and black, cut the other two, tape it up.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .