14

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 & 3 and only connects 1 & 4. (see Wiki for pinouts)

I'm sure that I can't be the only one who thought of this, so I'll assume it's a hardware dongle of some type that I can use to filter power before it gets to my phone.

Question

  • Is this a legitimate idea?

  • What hardware devices exist that allow this filtering?

  • Do any cellular phones incorporate this security feature in hardware? (akin a hardware switch that opens or closes pins 1&2)

*Definition: Juice Jacking is when a USB charger is modified so that it reads, modifies or deletes information on a user's cell phone. This can include stealing passwords or adding spyware onto the device.

Community
  • 1
makerofthings7
  • 50,090
  • 54
  • 250
  • 536
  • 1
    I know my iPhone doesn't allow me to read any contents through usb if I haven't unlocked the screen with the pincode. – Lucas Kauffman Nov 03 '12 at 16:54
  • 1
    @LucasKauffman I believe this is true for most iPhones, and probably many other smartphones. However, when given the option between a software/firmware solution and a physical solution to achieve the same effect in terms of security, the physical solution is often more reliable. – Iszi Nov 03 '12 at 17:04
  • I know, it was just because he asked if some phones have a feature like that – Lucas Kauffman Nov 03 '12 at 17:12
  • @LucasKauffman He specifically asked if it was incorporated in hardware, though. I doubt there is a phone that does this via hardware lockout - most are probably software/firmware solutions. – Iszi Nov 03 '12 at 17:13
  • aha, well it's late :P – Lucas Kauffman Nov 03 '12 at 18:12
  • I dont have the rep to post is as an answer but apparently you can accomplish this with a peice of tape - http://www.instructables.com/id/USB-Condom/ There are also other devices now available that achieve the same purpose such as this one http://www.amazon.com/Plugable-Universal-Charge-Only-Adapter-Android/dp/B00FA9GXKM and this one http://www.amazon.com/gp/product/B00QRRZ2QM/ref=pd_lpo_sbs_dp_ss_3?pf_rd_p=1944687462&pf_rd_s=lpo-top-stripe-1&pf_rd_t=201&pf_rd_i=B009W34XMM&pf_rd_m=ATVPDKIKX0DER&pf_rd_r=0KVJ4HT6JFMFCV4NNT5Q – n00b Nov 05 '15 at 21:30

4 Answers4

10

Many phones allow you charge with only power and ground connected. Some phones (looking at you, Apple) use the data lines to determine whether or not the charger is "permitted" to charge your phone. Other phones still (some Android phones in particular) explicitly ask you to decide what to do with the USB connection -- e.g. charge only, or mount as usb drive, or application-specific data connection.

Some USB cables (often the cheap ones you get with a cheap charger) will only run power and ground leaving the data lines unconnected. It's pretty trivial to tell if you have one of them by attempting to use it for data and see what happens.

While I don't belive that any "adapters" exist for this purpose, it would be very simple to make one: just take any existing adapter and clip the data lines. Just bear in mind that with some devices (e.g. apple) this will prevent charging.

tylerl
  • 82,225
  • 25
  • 148
  • 226
  • How did you learn this about Apple devices? Self experimentation? Blog, ...? Reason I ask because my next question is how would one "hack" this permission. Assume a hardware USB "filter" would close the circuit on the +5v line to the other two pins. Maybe add a resistor or cap for the fun of it... something along those lines but more scientific. Thoughts? – makerofthings7 Nov 03 '12 at 21:29
  • @makerofthings7 - Common knowledge. – Ramhound Nov 03 '12 at 22:33
  • 1
    @makerofthings7 Limor Fried did a full write-up of reverse-engineering the required voltages for her "mintyboost" project. Look it up over at adafruit. – tylerl Nov 03 '12 at 23:50
4

Answers:

  • Yes, this is a legitimate idea - and it works. USB power supplies are generally data only.
  • If you Google "USB power only cable" you'll find a few like this 0.96 GBP cable on Amazon.co.uk. Alternatively you can make your own by simply opening a standard USB cable, clipping the two data lines and connecting them. Some devices use the fact that the data lines are connected to identify that this is a power only USB connection.
  • Phones can't incorporate this in hardware because they need the data lines to communicate data over USB.
David Wachtfogel
  • 5,512
  • 21
  • 35
3

Yes this is a legitimate need, particularly if you use power from laptop/computer.

If you wish to have hardware protection the best is to have a USB cable or a cable/adapter extension with only PIN 1 and 4 mapped (2 and 3 shorten).

Very unlikely that hardware protection will be provided in phones as the USB port has also a use for data transfer in some other scenarios.

Bowabos
  • 39
  • 2
  • My thought is that there may be an on off switch that controls the hard connection... similar to the physical wifi switch located on some laptops – makerofthings7 Nov 04 '12 at 03:21
2

SyncStop

I saw some discussion about a device like this a while back; it was being called "USB Condom". Looks like they've changed the name to SyncStop. At the moment they have an ongoing Kickstarter campaign.

SyncStop Vs power-only USB cable?

It's not clear to me how SyncStop is different from a "power only USB cable" (as @DavidWachtfogel mentioned), which is apparently not a new idea. There some discussion on Slashdot about how, when charging via unmodified USB, the data pins are used to control charging, eg, how much current the device needs/can handle, and when can the charger can go to sleep because the device is fully charged.

Maybe SyncStop has some solution for that, but I don't see it mentioned on their FAQ.

Nathan Long
  • 2,624
  • 4
  • 21
  • 28
  • I wanted to answer with the "USB Condom", but didn't realize they changed their name. It's a simple adapter that does not connect the data pins. – schroeder Nov 13 '14 at 16:49
  • Here's a [photo](http://i.imgur.com/K358owI.jpg) of a DIY version, avoids spending 10 bucks on a kickstarter for something you can make with an old USB cable and a soldering iron. Solder the two connectors together by their power pins (make sure you get the polarity right), and short the two data lines on the device side to enable charging for Apple devices. –  Nov 14 '14 at 02:54