33

Websites like Amazon and eBay sell USB data cables for a pittance, often of unknown or dubious provenance.

Should I be wary of using these cables to transfer data to or from my devices? Is it possible (and plausible) that they have a malicious payload that can compromise the security of the host device?

Will Vousden
  • 432
  • 4
  • 9
  • 6
    If you're talking about a plain cable with simple connectors on each end then there's no real danger. Yes, the KGB could likely devise some scheme to embed logic in the connector, but the cost/benefit ratio of this would be poor. And your regular non-governmental hackers would not have the resources. "Dongles" are another matter. – Hot Licks Nov 04 '16 at 21:10
  • 41
    What makes you think that more expensive cables are harmless and come from more trusted sources? If somebody wants to distribute malicious cables he probably does not care if he infringes some trademarks by labeling their cables with some brand names. – Steffen Ullrich Nov 04 '16 at 21:48
  • 5
    If you had malicious intent, would you sell advanced technology at a financial loss to some random people in your online store? What would be to gain? – spuder Nov 05 '16 at 01:47
  • 7
    Not answering regarding the security aspect, but cheap cables and chargers have been linked to fires and damaged devices. I stay with quality vendors - especially for the charger/cable that my phone plugs into on the headboard of my bed while I'm sleeping. *Not* worth it. – Blackbeagle Nov 05 '16 at 01:56
  • +1 to the previous comment. This isn't an information security question, it's an electronics safety question. – user541686 Nov 05 '16 at 02:47
  • @Blackbeagle That very much is a security issue! (You don't have to assume malicious intent for a DoS to actually happen.) – jpaugh Nov 05 '16 at 13:27
  • This isn't a security answer or a safety answer (wire gauge may be light on cheap cables), but the word is *wary* not *weary* or even *wooly*. – Spehro Pefhany Nov 05 '16 at 13:41
  • 3
    No-name products are sometimes low quality or dangerous. At the same time, brand name products are sometimes low quality, poorly tested, or dangerous. The recent documented cases of a top-of-the-line brand name product catching fire or exploding is a perfect example. When a brand name product has a serious issue, there is perhaps a better chance of the public eventually finding out about it... although there is no guarantee of it. – RockPaperLz- Mask it or Casket Nov 06 '16 at 02:36
  • You can be more concerned about undersized wires that melt the insulation when you try to fast-charge something. – user253751 Nov 06 '16 at 22:25

9 Answers9

33

Do you have reason to expect targeted attacks?

It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons:

  • That would raise the cost of the cable far above its price, and would be uneconomical even considering the ability to "monetize" a certain amount of random untargeted computers owned by the attack, so there are no good economic reasons for attackers to do this.
  • We would have noticed such an attack. While most people wouldn't notice, if this was a mass attack, there would reasonably be some detection of that. Malware that tries to randomly hack many, many computers has obvious problems staying undetected for long.

However, if you have some reason to expect targeted, expensive attacks aimed to compromise you by people who have no qualms to perform illegal actions, then it certainly is a possibility that the hardware you receive is "special". However, that's not limited in any way to cheap USB data cables, or USB data cables - reasonably similar attacks would apply for any device you purchase in the same way, from mice/keyboards to laptops or server hardware. How do you know that your computer didn't have a hardware / firmware backdoor installed when you bought it?

If you have reason to expect such risks, you have to treat your USB data cable purchases in a similar manner as all other sensitive hardware; for example, ensure that you buy an item that cannot possibly be "adjusted" especially for you, e.g. random purchase of a generic item from a store shelf instead of a remote order that will be mailed to your address.

Peteris
  • 8,369
  • 1
  • 26
  • 35
  • 7
    There are also tests you can do once you receive the cable which, while not foolproof (no defence is unassailable, just as no attack is indefensible), have a very high probability of catching any tampering that has occurred, relative to the cost of doing the test. For example, a simple continuity check of each contact on the cable, checking for any power draw by the cable when it's plugged into a computer but not into any peripheral, and checking to see if your computer recognizes the presence of a new USB node when the cable is plugged into said computer with no peripheral on the other end – Matthew Najmon Nov 05 '16 at 16:22
  • "expensive attacks" - as in how expensive? E.g. can a competitor afford this or only an MNC/secret service? – ivan_pozdeev Nov 05 '16 at 22:47
  • _"How do you know that your computer didn't have a hardware / firmware backdoor installed when you bought it?"_ - I'm tempted to link this to https://en.wikipedia.org/wiki/Tailored_Access_Operations... – ivan_pozdeev Nov 05 '16 at 22:54
  • 3
    @ivan_pozdeev "bad" USB sticks with similar hardware can be purchased for ~$50; since such cables don't seem to be mass-produced then making a convincing one-off item will be a more expensive custom job but still definitely affordable for a competitor. However, for business competition a limiting factor would be the fact that this is clearly a crime; generally business spying is limited to legal activities or contract/NDA violations, not felonies. So this is more relevant for surveillance done by local authorities who may have legal permission to do that, or possibly organized crime and such. – Peteris Nov 06 '16 at 00:29
30

Security issues with cables? No.

It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply.

However the cost of a device, especially one small enough to be hidden in a cable, would be quite a bit higher than the cable itself so you probably don't need to worry about this.

700 Software
  • 13,807
  • 3
  • 52
  • 82
  • 70
    Unless this is a case of "you're not the customer, you're the product" - in which case the full cost of the device is payed by \*someone else\*. #tinfoilhattery – Mike Ounsworth Nov 04 '16 at 16:02
  • 14
    @MikeOunsworth Someone else being a particular TLA (Three Letter Agency) known for intercepting packages and installing malicious hardware? – phyrfox Nov 04 '16 at 18:34
  • 4
    In particular, in cases where they know what region the product is going to and know that region tends to have lots of people who are worth targeting. Are you having it shipped to your office? – David Schwartz Nov 04 '16 at 19:25
  • If you're really worried about this, just make a simple adapter from a regular AC plug to the D+/D- of a usb socket, and plug just your cable into it. This will definitely destroy any sniffer chips, and the socket also securely wipes usb sticks as an added bonus! – patstew Nov 04 '16 at 20:33
  • 3
    @phyrfox a lot of cheap electronics comes from a place with many people who probably would like to spy on or mess with companies in the english speaking world. –  Nov 04 '16 at 23:36
  • 1
    I was wondering how much electronics you could stuff into one ordinary USB plug, then I realized there are flash drives much smaller than that. – John Dvorak Nov 05 '16 at 12:12
  • 5
    @patstew That sounds like a great way to electrocute yourself... USB devices and especially their plugs are probably not rated for AC mains (think of the metal bit on the plug). I would recommend a shielded handle at least to safely do this. – Thomas Nov 05 '16 at 13:11
  • 3
    @DavidSchwartz and you think that product could possibly be sold in quantities that cheap products are being sold, without spy game being noticed by someone? Even if it is true price of device plays no role – inemanja Nov 05 '16 at 15:25
  • 3
    @inemanja The game is definitely [noticed](http://thehackernews.com/2013/11/russia-finds-spying-microchips-planted_1.html). – David Schwartz Nov 05 '16 at 21:05
  • @patstew The standard only says that no breakdown shall occur when 100V ac is applied. The etherkiller way may break the cable. – v7d8dpo4 Nov 06 '16 at 09:55
  • @v7d8dpo4 And where I am, common mains is 230-240 volts AC. – user Nov 06 '16 at 12:45
14

I really cannot imagine that the cable itself contains a malicious device as explained by @GeorgeBailey. So I would say that those cables are harmless when confidentiality or integrity is considered.

But if you consider that security also encompasses disponibility (availability), chances are that the contacts are of poor quality and that you experience occasional loss of connection when using them. Whether it is a real problem depends on actual usage...

INV3NT3D
  • 3,977
  • 3
  • 14
  • 25
Serge Ballesta
  • 25,636
  • 4
  • 42
  • 84
3

I'd agree that the potential for malicious access is rather low, and if you are really worried about it you can always buy one more cable than you need and rip it apart to verify that nothing is in the housing that shouldn't be. I do want to note that while I wouldn't be overly concerned with potential security issues the potential for physical damage to the devices being charged is real, many of the lower-end cables available do not fully meet the USB spec and are often missing features required to correctly set the output power of a port, most likely not an issue if being used as a data cable but could be a problem if a device expects very low power input and is plugged into a USB port that is designed to be used to rapidly charge devices.

mike
  • 39
  • 1
  • 1
    *"many of the lower-end cables available do not fully meet the USB spec and are often missing features"* Do you have any citation for this? – user Nov 06 '16 at 12:47
  • 1
    http://arstechnica.com/gadgets/2015/11/google-engineer-leaves-scathing-reviews-of-dodgy-usb-type-c-cables-on-amazon/ – Robin Whittleton Nov 07 '16 at 09:32
3

Cables are incredibly simple things. You are suggesting that the cheaper models house electronics for the purpose of compromising your security? That would only cost the supplier extra money.

What you should really be wary of is paying too much for a $5 product. Cables are not expensive. You should be paying no more than what you call "a pittance" for them.

Octopus
  • 247
  • 1
  • 2
  • 9
  • 5
    Not really. It happened to me that a very sensitive USB oscilloscope was not working at all with some cables, working but losing the connection often with others, and working fine with yet other cables. All three types worked perfectly fine with other devices though, and in the case of the sensitive scope, contact was made with all of them. It seems there have to be differences between the quality of the shielding. – vsz Nov 04 '16 at 22:18
  • 3
    @vsz So what if USB oscilloscope was "very sensitive"? USB cables move digital data... Of course maybe you've been using cables chewed by your dog, but then it would act the same on all devices no matter their sensitivity.. – inemanja Nov 05 '16 at 15:32
  • 1
    @inemanja : so, you accuse me of lying? Why would I do so, how would it benefit me in this situation? If you don't believe I used three different undamaged cables and they worked differently with one device, and those same cables work equally well with other devices, I won't make extra efforts to officially prove it, you can disbelieve me at your leisure if you want to. – vsz Nov 07 '16 at 05:50
3

If you are a person of interest, then anything is possible I suppose. I doubt the cable shipped from e.g. Amazon is not trustworthy, but shipments can be intercepted and what arrives in your mail box could have been tampered with. Unlikely to happen to 99.9% of us.

A bigger problem is that many USB 3 cables have been shown to be of very poor quality.

The problems stem from manufacturers not complying with the interface's specifications, specifically the use of resistors: a 56kΩ pull-up resistor should be connected to the Vbus pin to signal that one end of the cable or converter is a legacy USB device that can't handle a 3A current draw.

(http://www.theregister.co.uk/2015/11/05/google_engineer_ids_dodgy_usbs/)

The same engineer later reported frying some of his equipment due to a faulty cable:

Further analysis showed that the advertised SuperSpeed cables were missing entirely, and a 10 kΩ resistor was used instead of the 56 kΩ resistor the spec calls for. Needless to say, by the time the checks were done all of Leung's testing equipment was fried.

(https://www.engadget.com/2016/02/03/benson-leung-chromebook-pixel-usb-type-c-test/)

9Rune5
  • 131
  • 1
2

If the cable supplier has no way to guess at the purchaser's identity, chances for exploits are low.

However, I seem to remember that a German computer magazine had acquired and tested cheap USB3 cables that were wired wrong enough to potentially destroy devices.

There are also intentionally computer destroying USB devices around. If someone is just being an asshole, such things might get into circulation even though it is more expensive to produce than a proper cable.

And the first waves of computer viruses had no commercial payload, so assholery is not all that unheard of.

user129685
  • 21
  • 1
  • 1
    As it happens, most often initial examples of anything are more proof of concepts than anything else. Back in those days, people commonly wrote computer viruses for the heck of it, not to make money or engage in industrial espionage. Many such viruses were buggy and ended up causing data loss for their victims, but even when that happened, it generally wasn't the original intent. (While it's hard to determine intent with certainty, reasonable conclusions can be drawn from looking at computer code: Does it have a deliberately destructive payload or not?) – user Nov 06 '16 at 12:51
1

That depends on your definition of "safe". It's unlikely that such a cable will contain a malicious payload, but it is possible for such a cable to spy on you. There's an old Powerpoint presentation floating around the Internet, supposedly used at an internal meeting by a government espionage agency, discussing a way of spying on your monitor through your cables. This presentation claimed that this device, the size of a few rice grains, was in use already, and that some cable manufacturers agreed to put this device in the cables they sold. It claimed that it beamed back your red VGA signal when a radio beam hit a small radio dish in this spying device. It seems plausible enough, RFID and NFC chips are powered in a similar way.

The good news is, if a strange truck isn't sitting outside your house, this method can't work. If it works with digital signals at all.

Full disclosure, this Powerpoint may have been a hoax. Hardware is not my strong suit, nor is electronics, especially not anything related to modulated waves.

VHS
  • 111
  • 1
-1

If you want to do anything malicious, except for killing the device, you nead power supply for your tool.

The USB A-B, A-mini, A-micro, A-Olympus, A-lightning cables are only conductors. Whole comunication is done by USB dirver in your computer and the device. In the cable, there can be resistors and passive filters only.

The cable, and hypothetical TLA device, are designed to operate with 5 VDC power supply and digital signals.

If you connect 20 VAC between any pair of pins, icluding shielding, and something blows up, the cable was TLA-modified and it drew power from USB.Building something capable to fully operate with power supply ranging from 0-1 kV, both AC and DC is impossible.

If you are suspicious of self-powered TLA-device, you can use good ol' X-Ray. Buy Photographic paper, keep it in dark envelope, put the USB ports on it and place uranium ore ontop of it. Develop the photograph next day and you will get X-Ray shadow of the interior. If it is TLA-modified, you will see extra circuitry.

If you think it is still not enough, you can apply really strong and dynamic magnetic field to it. EMP (nuke) or magnetic resonance (NMR) are capable of such magnetic shocks. Every circuit will induce enough current to fry itself. If the cable survives, you are sure, it wasn't TLA-modified.

In the real world, device, that is capable of anything malicious and is that small costs a lot of effort (= money) to be used as a random device. There is no way the atacker has ide wht are you about to do with the cable - they are Universal (Serial Bus cables) -, you can use them to charge your bike light, for example.

Therefore thay are useful for targetted attack only. In that case, TLA will more likely replace cable you already use with the TLA-enhanced one. If you are paranoid enough, using randomly bought cheap USB cables is the way to be sure, you are not TLA-monitored via USB plug listen-and-report technique. The procedure is: Buy, use, dispose. No re-use, no storage.

tl;dr:
Using cheap USB cables is, with respect to TLA-infestation only, completely safe.

Crowley
  • 1