Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk.
It was for 3 seconds and I was in control of the MacBook the whole time.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Android devices have the capabality to act as basically any USB device.
This opens up gates for all kind of Bad USB attacks like
Rubber ducky attack that types in scripts very fast (Almost un-noticable by the user) by acting as a keyboard (HID | Human interface device).
Then it could act as a network device and setup MITM
These two are done by emulating normal USB devices.
Also USB exploits specific to the OS or platform maybe used.
If you want to try these you can try NetHunter.
This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of course there are many more possibilities to run malicious software too.)
The smartphone pretty much acts like an usb stick. So every security risk you get with plugging in an usb stick also applys for smartphones.
Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live.
You would still be exposed to attacks that can take place over the power cables, such as the device supplying a very high voltage or current back to your laptop. Presumably MacBook USB ports have taken some preventative measures against this kind of attack, but I don't know for sure.
There's also the possibility that it's not actually an Android phone, but a "USB Killer" of some sort:
This is a device which, when connected to the USB port, will send -220 volts down the data / power lines, thereby frying the USB controller and possibly other components of your laptop. This one looks like a flash drive, but it could easily be made to look like an Android phone.
I don't think this is a significant risk though, unless someone is targeting you and wants to destroy your laptop for some reason.
There is always the possibility that someone could have found a vulnerability that could abuse the system at any level. Vulnerabilities have been found continuously on all systems throughout the history of computers, so it is not impossible.
That said, the risk seems fairly low.
Depends on the cable. If it's a cheapo "one-size fits all" charger cable like this, (sold in chain store pharmacies like CVS, Walgreens, etc), it might have fewer wires, (to save on manufacturing costs). If the data wires don't exist, it can't transmit any data.
Instructables has a how to for downgrading a four wire USB data cable to a two wire charger cable. Summary, open cable sheath, see four wires, leave the red and black, cut the other two, tape it up.