SoylentNews is people
SoylentNews
Another cyber warning has been issued about the risk from compromised chargers—but this time data theft is not the issue...
Hackers Can Now Trick Usb Chargers To Destroy Your Devices—This Is How It Works:
Not all cyber attacks focus on data theft. Sometimes the intent is "to achieve destruction of the physical world through digital means," Chinese tech giant Tencent warns. The company's researchers have just disclosed a serious new vulnerability in many of the mass-market fast chargers now used around the world.
[...] Tencent’s researchers have now proven that a compromised charger can override this negotiation, pushing more power down the cable than the device can safely handle, likely destroying the device and potentially even setting it on fire.
Because the fast charger is essentially a smart device in its own right, it is open to a malicious compromise. An attack is very simple. With malware loaded onto a smartphone, an attacker connects to the charger, overwriting its firmware and essentially arming it as a weapon for whatever plugs in to it next.
The interesting twist here is that the malware might even be on the target device. An attacker pushes that malicious code to your phone. The first time you connect to a vulnerable fast charger, the phone overwrites its firmware. The next time you connect to that same charger to [recharge] your device, your phone will be overloaded.
Tencent has produced a demo video, showing how a charger can be compromised and then used to overload a device.
Tencent have dubbed this issue "BadPower," and warn that "all products with BadPower problems can be attacked by special hardware, and a considerable number of them can also be attacked by ordinary terminals such as mobile phones, tablets, and laptops that support the fast charging protocol."
(Score: 4, Informative) by choose another one on Monday July 20 2020, @10:45PM (1 child)
Sounds vaguely like the Killer Poke on the Commodore PET, think that was early-mid 80s though - certainly was rumoured about when I was in school and the school moved to BBC Micros in about 83 (at latest) I think.
By early 90s it was Linux and a similar warning was about every monitor and the "variation of a signal timing" was the modeline you had to set manually in the X Config file, the modeline being a set of numbers you could play with to optimise your picture in many and varied ways, including, allegedly, blowing up flyback transformers. Windows and DOS didn't seem to feel the need to expose users to this fun, I can't remember why that was.
Modern stuff is, of course, much smarter than this and most Linux users never see a modeline because: "Modelines are a relic of times when drivers were dumb and monitors/TVs did not respond to EDID requests". Yup, that's right, all the blowing up flyback transformers stuff is now negotiated between the "smart" display and the "smart" video driver. Sound familiar, sort of charger-y perhaps? [ Oh, and of course flyback transformers themselves are a relic of times when monitors were real monitors, and men were real men and could actually get a hernia moving a decent size one ].
And yet it happened, so many many times, and still happens today. Killer poke, Halt-and-catch-fire, just two examples from way back; for 2020 version of HCF see https://www.theregister.com/2020/04/13/security_roundup_100420/ [theregister.com] and for modern Killer Poke, try Boeing's 737 MAX MCAS instruction - more of a Killer-Wind-Up (at the jackscrew), but awfully effective.
Face it, hardware has been getting ****ed by software for probably as long as software has existed.
(Score: 2) by sjames on Tuesday July 21 2020, @01:27AM
Even before EDID, if you sent an out-of-spec signal to a monitor, it would blank or just display a bad signal message. Even before that, most monitors wouldn't actually fail from a bad modeline the warnings were given in an abundance of caution in case someone's monitor was an exception to that rule. I've heard of (and experienced) monitors making odd noises from bad modelines, but I've only seen one or two claims of a monitor actually being damaged. It was still nice when Xorg came out and modelines went away :-)
I saw a youtube video a while back where someone actually tried the "killer POKE". Nothing happened but a little video snow when the display scrolled. Hard reset restored it to normal. Perhaps it stressed the video chip somehow and eventually might lead to early failure, but it wasn't the universal instant destruction it was billed to be.