53

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk.

It was for 3 seconds and I was in control of the MacBook the whole time.

  • 19
    In theory, yes, in practice, probably not. If it had been a Firewire device, quite possibly. – Matthew Jun 9 '16 at 12:55
  • 23
    Is there a reason to suspect that this person is targeting you or your data? Or are you worried about general Android malware that the person would have unwittingly exposed you to? If it's the former, yes, you are at risk from anything plugged into your computer; if it's the latter, nope even the worst Android malware seen in the wild doesn't have any special upstream infection techniques. – Jeff Meden Jun 9 '16 at 14:03
  • 2
    @MartinCarney Yes, in theory, though you would be limited to the slowest possible charge as it blocks all possible methods of asking for more current. Certainly not so good on a 2A charge tablet, at 500mA it just won't charge, just drain slower. – ewanm89 Jun 9 '16 at 20:21
  • 2
    I would carry around charge only usb cable, I learned the hard way (when trying to import code onto my arduino) that such a thing exists, (it would only have +,- cables into the usb instead of the data cables) that way data cannot be transmitted. – andyADD Jun 10 '16 at 15:02
  • 3
    It's dangerous -- you can catch Android, which slowly turns your Macbook into a Chromebook. Remember, only use your Macbook to charge iPhones! – Federico Poloni Jun 13 '16 at 6:16
64

Yes.

Android devices have the capabality to act as basically any USB device.

This opens up gates for all kind of Bad USB attacks like

Rubber ducky attack that types in scripts very fast (Almost un-noticable by the user) by acting as a keyboard (HID | Human interface device).

Then it could act as a network device and setup MITM

These two are done by emulating normal USB devices.

Also USB exploits specific to the OS or platform maybe used.

If you want to try these you can try NetHunter.

https://en.wikipedia.org/wiki/NetHunter

https://nakedsecurity.sophos.com/2014/08/02/badusb-what-if-you-could-never-trust-a-usb-device-again/

  • 2
    what if the session is locked? the device has to guess the password, right? – Sarge Borsch Jun 10 '16 at 11:56
  • @SargeBorsch If the session is locked using a pasword normal Ruberducky attacks won't work. But USB exploits usually work. I remember reading about a thumbnail exploit used to run code cos the thumbnail cache process was running even when locked. – user76223 Jun 10 '16 at 13:24
  • @SargeBorsch I think MITM will work even with session locked. – user76223 Jun 10 '16 at 13:24
  • but how? USB devices do not receive all key presses. And even if they could act as a display, password characters are usually masked on screen. – Sarge Borsch Jun 10 '16 at 13:36
  • @MITM works by the USB device acting as a network or device similar to USB-LAN device. As long as USB device driver is loaded the attack works. I don't know if USB devices are loaded in Mac during lock state. – user76223 Jun 10 '16 at 13:58
17

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of course there are many more possibilities to run malicious software too.)

The smartphone pretty much acts like an usb stick. So every security risk you get with plugging in an usb stick also applys for smartphones.

  • 13
    @EmanuilRusev Since it's highly unlikely that an Android device would contain autorun software for iCloud (unless they were somehow personally targeting you) I would suspect that the iCloud popup was simply your MacBook's response to seeing that the connected usb device had photos on it. Try it with a normal usb stick that has a few JPGs on it, and you will probably see the same screen. – Jeff Meden Jun 9 '16 at 13:58
  • 7
    No need for autorun, all one needs to do tell the USB to emulate a keyboard and send the keystrokes to do whatever... – ewanm89 Jun 9 '16 at 16:29
  • 7
    @dandavis Yeah, clearly a unix based operating system is nigh impossible to configure without a mouse. Any reference for that weird claim? – Voo Jun 9 '16 at 18:58
  • 5
    @dandavis in other words it's as open as a standard user on windows or linux... funny that is. And if someone is emulating HID and sending scripted keystrokes then I wouldn't call it low-skill. Automated yes, low-skill, no. Privilege escalation exploits do exist, popping the terminal with just the keyboard is easy, and emulating keyboard is HID, which means I can emulate mouse just as easily. – ewanm89 Jun 9 '16 at 20:04
  • 3
    @bonsaioak only if you are logging in to an account with admin privileges else it asks for username and password for uac escalation. Maybe we should enable root account on Mac and log in directly with that and compare. Or modify sudoers to not need password for any escalation. I am a UNIX guy through, give me Linux or freeBSD any day, but don't drink the sole collage that it is more secure just because it isn't configured correctly. – ewanm89 Jun 10 '16 at 7:42
16

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live.

You would still be exposed to attacks that can take place over the power cables, such as the device supplying a very high voltage or current back to your laptop. Presumably MacBook USB ports have taken some preventative measures against this kind of attack, but I don't know for sure.

  • As the attacker currently didn't use the USB port before you, softwarematically disabling the usb may also do the trick. Not sure if it will still charge, but here is a description of how it can be done: Browse to ‘/System/Library/Extensions’ folder on the system disk. Remove both IOUSBMassStorageClass.kext and IOFireWireSerialBusProtocolTransport.kext which are found in this directory. Reboot the machine. (Putting them back will probably restore the ports) – Dennis Jaheruddin Jun 10 '16 at 13:31
  • 1
    @DennisJaheruddin This might prevent the OS from interacting intentionally with that USB port, but do you know it doesn't permit that USB port from interacting with the hardware USB controller in a malicious way? – Yakk Jun 10 '16 at 15:30
7

There's also the possibility that it's not actually an Android phone, but a "USB Killer" of some sort:

enter image description here

This is a device which, when connected to the USB port, will send -220 volts down the data / power lines, thereby frying the USB controller and possibly other components of your laptop. This one looks like a flash drive, but it could easily be made to look like an Android phone.

I don't think this is a significant risk though, unless someone is targeting you and wants to destroy your laptop for some reason.

  • 3
    Scared me. So diabolical. I'm sleeping with one eye open tonight. – Paulb Jun 10 '16 at 18:57
  • One could fit a lot of power storage caps inside a phone-sized device.... BRB! – Criggie Jun 11 '16 at 23:59
  • 1
    @Paulb that won't help you. Instead of getting your laptop fried (property damage + break and entry, easily suable) you end up in a bloody fight (lots of physical pain, risk of death, can be sued for defending yourself too well) – John Dvorak Jun 12 '16 at 6:33
5

There is always the possibility that someone could have found a vulnerability that could abuse the system at any level. Vulnerabilities have been found continuously on all systems throughout the history of computers, so it is not impossible.

That said, the risk seems fairly low.

  • 2
    USB is a well known attack vector, but you don't need any exploit or find a vulnerability. That's working as intended. The only thing one has to do is claim to be an USB keyboard and then do whatever you want. There are some recent mitigations as additions to the linux kernel (the user is basically asked what kind of device they're plugging in) but in all mainstream OSes it's really simple to exploit. – Voo Jun 9 '16 at 18:58
  • 2
    Your answer boils down to "Anything's possible." That's not a very useful answer. – Martin Carney Jun 9 '16 at 19:37
  • 3
    Martin, how would you answer if I asked you if I had any chance of catching an unknown disease when going somewhere? There can not be a definite answer. – Julie Pelletier Jun 9 '16 at 19:45
0

Depends on the cable. If it's a cheapo "one-size fits all" charger cable like this, (sold in chain store pharmacies like CVS, Walgreens, etc), it might have fewer wires, (to save on manufacturing costs). If the data wires don't exist, it can't transmit any data.

Instructables has a how to for downgrading a four wire USB data cable to a two wire charger cable. Summary, open cable sheath, see four wires, leave the red and black, cut the other two, tape it up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.