Modern smartphones consume so much energy that charging them once a day is not always enough. When they are used intensively, the user sometimes has to look for a power source in the middle of the day, and charge their device whenever and wherever possible. At first glance, it seems absurd to worry about safety in these circumstances. You plug the smartphone into a socket and it starts charging – the same as with a flashlight or a toothbrush, right? But, in fact, there are some hidden dangers which you need to be aware of. Public charging stations help smartphone users, but also open a new avenue for hacking.
When charging a smartphone from a PC, or connecting it to a USB port in a car or plane, we rarely consider the possibility that information may be exchanged, as well as power. Beware of Juice-Jacking is asking do you hesitate before connecting your phone to this unknown device that could be configured to read most of the data on your phone, and perhaps even upload malware?
Settings vary on different smartphones – they often automatically connect using PTP or MTP modes, and the connected PC can upload all the relevant files from the smartphone. This is especially annoying if you store confidential photos on your smartphone. This behavior is more frequent than it might seem – the automatic upload of photos is a standard setting of many photo album managers, Dropbox and similar applications. If the smartphone automatically connects when it is in removable media mode (UMS, Mass storage), that makes all files in the internal storage accessible to the PC. It is also possible to get virus this way, but this this threat is not that considerable, but users should still bear it in mind.
The easiest, and usually quite effective, way to avoid these problems is to switch off the smartphone completely before charging it and keeping it switched off until the procedure is completed. Usually this is not the most user friendly when you want to be on-line all the time.
Last week there were headlines like USB “Condom” Allows You To Practice Safe Charging and Wrap That Rascal With A USB Condom. Yep, a USB condom. That term is mostly a dose of marketing brilliance, which is to say that grabs your attention while also serving as an apt description of the product.
A little company called int3.cc has developed a product—a USB condom—that blocks the data pins in your USB device while leaving the power pins free. Thus, any time you need to plug a device such as a smartphones into a USB port to charge it—let’s say at a public charging kiosk or a coworker’s computer–you don’t have to worry about compromising any data or contracting some nasty malware. It’s one of those simple solutions that seems so obvious once someone came up with it. They sell the product at http://usbcondoms.com/.
The first version of USB Condom achieve this by cutting off the data pins in the USB cable and allowing only the power pins to connect through.Thus, these “USB Condoms” prevent attacks like “juice jacking”. Juice Jacking is when a USB charger is modified so that it reads, modifies or deletes information on a user’s cell phone. This can include stealing passwords or adding spyware onto the device.
According to their web page Version2 of the USBCondoms will debut soon (the version mentioned on those news): For a few bucks more, it includes a microprocessor on the “untrusted” side to ensure full line power.
All smartphones charged from a USB have a supply voltage of 5 volts, while the charger voltage may vary from 500 to 1500 mA. If you just wire the power wires, you will not get the full power because the smartphone and charger can’t agree that they can use more than the normal default maximum current (that being 100 mA or 500 mA depending on the case).
That first version of USB condom sounds pretty simple, so how about a DIY version. Charge Only MicroUSB Cable article tells that if you are armed with a soldering iron and heat shrink tubing, building a charge only USB cable an easy hack: If you cut open the USB cable and clip the signal wires, then you effectively create a charging cable.
A USB cable has four wires; two for power, two for signal. Important: The signal wires on the host or USB A end of the connection must remain open or you risk shorting out your USB port or damaging your computer. This simple design has some downsides: it not being able to charge and operate all phones. Some phones need the data pins to be at correct state (especially devices made by Apple).
Many phones allow you charge with only power and ground connected. Some phones (looking at you, Apple) use the data lines to determine whether or not the charger is “permitted” to charge your phone. Other phones still (some Android phones in particular) explicitly ask you to decide what to do with the USB connection — e.g. charge only, or mount as usb drive, or application-specific data connection. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 & 3 and only connects 1 & 4 (power pins). At least worth to try. Many phones allow you charge with only power and ground connected. Some USB cables (often the cheap ones you get with a cheap charger) will only run power and ground leaving the data lines unconnected. If you want to buy such cable (instead of making your own), Google “USB power only cable”.
How to make a “USB fast charge cable” for your phone posting gives some tips how fast charging detecting works on phones. USB devices like your phone will draw only 500ma from devices that they recognize as USB hosts, such as your computer. Dedicated USB chargers will supply more than 500ma — usually 1 amp but sometimes more. How does your phone know the difference between a dedicated charger and your computer? The way you fool the phone into thinking it is on “AC power” rather than “USB power” is to short the two data pins that go to smart phone connector together. When the phone probes the data pins, it will see that the pins are connected together, decide that it is on “AC power”, and will draw more current. You should take care, however, to short the pins in such a way that the phone sees the short, but whatever you plug the cable into (our computer) doesn’t see the pins at all. Shorting the data pins on your computer may damage it. You’ve been warned! And also the computer might not like if the cell phone tries to take more than 500 mA current from it’s USB port.