United States. Search. Home. News. Security. Products. Tips. Malware. Interviews. Projects. Contact. Navigate to...

Transcription

1 United States SECURITY FOR HOME Free Virus Scan SECURITY FOR BUSINESS STORE Free Trials DOWNLOADS About Us Partners Search SUPPORT Home News Security Products Tips Malware Interviews Projects Contact Navigate to... Previous Next Charging your smartphone s battery over USB can be dangerous May 26, 2016 Alexey Komarov Featured Post, News, Security, Threats No comments Chances are that each of us has found ourselves in a situation where our phone is dying and we have no charger on hand, but at the same time we desperately need to stay connected to answer an important call, receive a text message or , whatever. It is perfectly normal to look for any source of precious electricity on such occasion any USB port would do. But is it safe? No. In fact, it can be dangerous: Over a USB connection someone can steal your files, infect your smartphone with something nasty or even brick it. Ride the lightning 1 of 7 5/26/16, 4:07 PM

2 Before we get to the problem of thieves, we must point out that not all electricity is equally good for your phone. The Internet is full of complaints, filed mostly by users who tried to charge their fancy phones by connecting them to aftermarket (or non-original) chargers. In some cases doing so turned the phones into quite expensive bricks. In the most bizarre cases, people holding the phone in their hands were seriously injured or even killed. Daily Mail Follow Teen dies after being electrocuted in her sleep while charging her iphone dailym.ai/1o7eia5 5:10 AM - 31 Jul 2014 Teenager was electrocuted in her sleep while charging her ip A 18-year-old women has died in Xinjiang, China, after being electrocuted in her sleep while charging her iphone 4s. It is not dailymail.co.uk Unfortunately, these may be more than just accidents. For example, last year we saw a twisted device aptly named USB Killer. It contained an impressive set of capacitors, housed in a USB-flash-drive-size frame, that would discharge 220 V into a USB port. Such discharge would destroy the USB port at minimum, and possibly fry the whole computer s motherboard in a worst-case scenario. We doubt that you d want to try your phone s durability in such a way. Show me your files, baby Secondly, USB ports were designed not just to provide charge, but also to transfer data. So whenever a mobile device is connected to a USB port, it attempts a handshake, during which it transmits some data. The most data-wasteful are phones based on Android platform 4.x and earlier they connect in MTP (Media Transfer Protocol) mode by default, exposing all of the device s files. On average, it takes more than 100 kilobytes of data just to tell the host system about the phone s files and folders for reference, that s about the size of Alice in Wonderland e-book. Locking the phone will save you from such exposure but, honestly, do you abstain from using the phone while it s charging? And do you always disconnect the phone from the USB port when you receive a text message, for example? Now, let s take a closer look at the data that is transmitted to the USB port even when the mobile is in charging only (blocked) mode. The amount of data varies depending on the mobile s platform and the operating system of the host, but in any case it s more than just charge, nothing personal as we found out, this data includes device name, vendor name, and serial number. Full access and beyond You may think the data transmission issue is not a big deal, but the problem as we ve discovered by looking into publicly available information about one specific vendor is that they allow for much more than specified by the system. How is that possible? It is done by a legacy system of commands called AT-commands. The AT commands were developed a few decades ago to enable the modem and PC communications. Later, the set was included in the GSM standard, and to this day it is supported in all smartphones. To give you an idea of what can be done using AT commands: They enable an attacker to get your phone number and download the contacts which are stored in the SIM card. Then, they can call any number at your expense, of course. (And if you re roaming, such surprise calls may quickly drive your balance into the red.) Depending on your vendor, this mode can also open access to install any type of application including malicious ones. All of the above is possible even if your smartphone remains locked! To sum up: Remember that you can never tell what is on the other side of a normal-looking USB port. A USB port can be a system that gathers data about the devices that are connected to it, a flawed power source, a powerful capacitor, or a computer that installs a backdoor on your device. You simply cannot know before you plug in your device so don t.! Facebook Google 2 # LinkedIn 0 $ HackerNews 0 % Reddit 0 & Pocket 1 ' Twitter androiddangersmobile devicesprivate datasmartphonesthreatsusb About Alexey Komarov Send to Kindle View all posts by Alexey Komarov Leave a Reply Your address will not be published. Required fields are marked * Comment Name * 2 of 7 5/26/16, 4:07 PM

3 * I'm not a robot Post Comment Related Posts recaptcha Privacy - Terms Hospital learns the hard way why you don... May 26, 2016 How to pay for the Olympics and never ge... May 25, 2016 Google I/O 2016: Smartphones are not the... May 23, 2016 Mischa: a friend for Petya and yet more... May 18, 2016 Popular Posts 1 Update: CryptXXX solved again May 13, Change your LinkedIn password NOW May 18, Kaspersky free decryptor for TeslaCrypt victims May 23, Make your web surfing completely private March 4, Thou shalt not covet thy neighbor s wifi May 4, of 7 5/26/16, 4:07 PM

4 May 2016 M T W T F S S «Apr Likes e u #ICYMI Some reasons why you shouldn't use public USB ports #Purecharger /PogcU7TFeC #mobile #Security 2 hours ago Hospital pays ransom, does not get files back... Remember, don't pay #ransomware /nt9mt4d6nb 3 hours ago Warrant Canary #database shuts down hours ago sees a bad password hours ago 4 of 7 5/26/16, 4:07 PM

5 Time Machine May 2016 April 2016 March 2016 February 2016 January 2016 December 2015 November 2015 October 2015 September 2015 August 2015 July 2015 June 2015 May 2015 April 2015 March 2015 February 2015 January 2015 December 2014 November 2014 October 2014 September 2014 August 2014 July of 7 5/26/16, 4:07 PM

6 June 2014 May 2014 April 2014 March 2014 February 2014 January 2014 December 2013 November 2013 October 2013 September 2013 August 2013 July 2013 June 2013 May 2013 April 2013 March 2013 February 2013 January 2013 December 2012 November 2012 October 2012 September 2012 Let s save the world together! Kaspersky Lab 2,925,702 likes Like Page Share Be the first of your friends to like this Kaspersky Lab google.com/+kasperskylab Software Follow ,191 Trending Authors David Buxton 60,859 post views Jeffrey Esposito 1,972 post views Kate Kochetkova 1,656 post views Alex Drozhzhin 957 post views Jen Saber 647 post views Topics advice android Antivirus apple cybercriminals Cybersecurity data breach data security encryption Facebook future google GReAT hackers hacking ios kaspersky internet security kaspersky internet security for 6 of 7 5/26/16, 4:07 PM

7 android Kaspersky Lab kids malware mobile device mobile devices news online protection passwords personal data phishing privacy private data products protection Ransomware research security SecurityIS security news smartphones social media social networks support threats tip of the week tips vulnerabilities Instagram Subscribe to RSS Feeds Get all latest content delivered to your a few times a month. Your Sign Up Personal & Family Security Kaspersky Total Security Internet Security Multi-Device Kaspersky Internet Security Kaspersky Anti-Virus Kaspersky Internet Security for Mac Kaspersky Internet Security for Android Kaspersky Password Manager Kaspersky Security Scan FREE Products for Business Endpoint for Business Advanced Endpoint for Business Select Targeted Security Products for Small Office Kaspersky Small Office Security For Software Users Buy online Get updates Renew license Try for free Technical Support For home products For business products About Us About Kaspersky Lab Why Kaspersky? Press Center Site Map Privacy policy Contact us Legal Blogroll Kaspersky Club Kids Safety 2016 AO Kaspersky Lab. All Rights Reserved. 7 of 7 5/26/16, 4:07 PM