0

For example, if my phone is compromised, can it execute code on my desktop computer just by plugging it in USB? Or vice versa. I ask because banks' and other services' 2-factor authentication commonly depends on sending a text message to the user's phone. If this is a risk, follow up questions: is it a theoretical or practical risk? What's the suggested way for moving data between devices?

Edit: To add a concrete example, let's say I have a Windows 10 desktop pc and an Android phone. My pc is infected with a banking trojan which wants to transfer money out of my bank. In order to do that, it needs access to my phone, because my bank sends the 2-factor authentication code as a text message. Once I plug the phone into the computer (to transfer photos or something) the trojan now infects the phone. The next time I log into my bank, the trojan on my pc can make a transfer out of my bank account while showing me an innocuous page. When the 2-factor auth code is sent to my phone, the trojan in my phone will hide the message from me and send it over the internet to the trojan on my pc, to finalize the transfer.

  • Could you explain why do you need to connect your phone to your computer in order to enter the code sent via SMS? – A. Darwin Aug 8 '16 at 14:46
  • 1
    @A.Darwin I don't think they are related in regards to OP's question. (read: extraneous info) – HashHazard Aug 8 '16 at 15:26
  • 2
    If you are asking about a specific risk, you'll need to provide more info (Desktop OS, Phone Info, etc). But in general, if a device is compromised, lateral movement into a connected device is almost always possible (theoretically). – HashHazard Aug 8 '16 at 15:28
  • your edit scenario is possible but unlikely. going from an infected phone to a desktop is a lot easier, especially on a rooted android phone. But really, a trojan could simply steal your keystrokes when you type in the 2fa code from the TXT – dandavis Aug 8 '16 at 19:16
1

due to the USB protocol design and lack of vendor signatures especially with USB firmware updates it's possible to install malicious firmware into the internal chip if a USB; antivirus are of no use in this case check out nohl & lell research called bad USB presented at black hat 2014

http://m.youtube.com/watch?v=nuruzFqMgIw

0

As the phone has now USB3 anymore, I am transfering data between the devices using my own cloud storage based on seafile.

Everyting also depends on your operating systems, i.e. if your OS would start some applications (autorun) when the phone is plugged in. I think theoretically it is possible, e.g. that a trojan on your phone would fetch data from your home directory and send this via the mobile connection. But I am no expert here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.