Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 9 submissions in the queue.
posted by martyb on Monday July 20 2020, @06:49PM   Printer-friendly
from the Phones-do-not-come-with-a-fuse? dept.

Another cyber warning has been issued about the risk from compromised chargers—but this time data theft is not the issue...

Hackers Can Now Trick Usb Chargers To Destroy Your Devices—This Is How It Works:

Not all cyber attacks focus on data theft. Sometimes the intent is "to achieve destruction of the physical world through digital means," Chinese tech giant Tencent warns. The company's researchers have just disclosed a serious new vulnerability in many of the mass-market fast chargers now used around the world.

[...] Tencent’s researchers have now proven that a compromised charger can override this negotiation, pushing more power down the cable than the device can safely handle, likely destroying the device and potentially even setting it on fire.

Because the fast charger is essentially a smart device in its own right, it is open to a malicious compromise. An attack is very simple. With malware loaded onto a smartphone, an attacker connects to the charger, overwriting its firmware and essentially arming it as a weapon for whatever plugs in to it next.

The interesting twist here is that the malware might even be on the target device. An attacker pushes that malicious code to your phone. The first time you connect to a vulnerable fast charger, the phone overwrites its firmware. The next time you connect to that same charger to [recharge] your device, your phone will be overloaded.

Tencent has produced a demo video, showing how a charger can be compromised and then used to overload a device.

Tencent have dubbed this issue "BadPower," and warn that "all products with BadPower problems can be attacked by special hardware, and a considerable number of them can also be attacked by ordinary terminals such as mobile phones, tablets, and laptops that support the fast charging protocol."

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 3, Touché) by fustakrakich on Monday July 20 2020, @06:52PM (24 children)

    by fustakrakich (6150) on Monday July 20 2020, @06:52PM (#1024203) Journal

    Or is every contraption made now going to be vulnerable?

    --
    La politica e i criminali sono la stessa cosa..
    • (Score: 3, Informative) by nitehawk214 on Monday July 20 2020, @07:40PM (23 children)

      by nitehawk214 (1304) on Monday July 20 2020, @07:40PM (#1024229)

      Yes but dumb-chargers can only slow-charge. The negotiation is for fast charging modes.

      You could use an old "charge only" cable, where it doesn't pass the data pins.

      Of course, it is complicated as fuck; and most of my devices only slow-charge even when both devices and the cable supposedly support it.

      https://www.digitaltrends.com/mobile/how-does-fast-charging-work [digitaltrends.com]

      --
      "Don't you ever miss the days when you used to be nostalgic?" -Loiosh
      • (Score: 2, Interesting) by fustakrakich on Monday July 20 2020, @07:56PM (22 children)

        by fustakrakich (6150) on Monday July 20 2020, @07:56PM (#1024238) Journal

        I'll take slow-charge over explode-charge

        I can't believe how we make such junk. It is trivial to put a physical voltage/current limiter into the phone

        --
        La politica e i criminali sono la stessa cosa..
        • (Score: 4, Interesting) by JoeMerchant on Monday July 20 2020, @08:41PM (13 children)

          by JoeMerchant (3937) on Monday July 20 2020, @08:41PM (#1024259)

          Limit the current and you can no longer fast charge beyond that current limit... the whole reason for "smart" negotiation of fast charging modes is because simple current limits just don't cut it anymore - the batteries are state-dependent and what makes for a fast charge in some states makes for boom (or at least smolder and puff) in other states.

          They wouldn't have moved from dumb current/voltage limit chargers to "smart" chargers if there wasn't a clear need for the complexity, but now that they've made the move, they're using the "smart" aspects as an excuse for why it's "safe" to eliminate the dumb current and voltage limits altogether and just make them limited in software, "to better accommodate future needs."

          Now, you've got firmware - of course it needs to be update-able, of course that leads to vulnerabilities...

          Someday, a certain class of products (like these smart chargers, maybe automotive controls too) should be classified: NO OTA UPDATES - require a human being to at least throw a physical switch, or replace a chip, or do ANYTHING, to push an update into the system - then make that action part of a "certified update" cycle that provides at least some assurance that the update you are permitting into your potentially dangerous device is not known to contain malicious code.

          --
          🌻🌻🌻 [google.com]
          • (Score: 3, Insightful) by sjames on Tuesday July 21 2020, @12:31AM (12 children)

            by sjames (2882) on Tuesday July 21 2020, @12:31AM (#1024350) Journal

            In this case, the issue is voltage/current that the device itself can't handle at all. The demo video shows the smoke being let out of a device by the hacked charger. Really, any device that can plug in to USB-C should be able to deal with 20v even if it has to disconnect/shut down to do it. That accomplished, the on-board charge controller should be able to charge the battery safely even if the charger pegs itself at 20v.

            Meanwhile, any adapter to allow a pre USB-C phone to be plugged in should absolutely limit the supply voltage to 5v or disconnect.

            That would at least avoid device destroying events.

            • (Score: 2) by JoeMerchant on Tuesday July 21 2020, @01:57AM (11 children)

              by JoeMerchant (3937) on Tuesday July 21 2020, @01:57AM (#1024398)

              the on-board charge controller should be able to charge the battery safely even if the charger pegs itself at 20v

              and unlimited current, yes, it should - but that would raise the cost of the on-board device, increase it's size, weight, heat generated, all by tiny fractions that are unacceptable in the consumer electronics competitive marketplace. Shouldn't be that way, but it is.

              I think the year was something like 1994 when Cypress Semiconductor sent me a "sample" USB mouse and T-shirt, touting the benefits of this brave new replacement for RS232 - all I could think at the time was: "Oh, yeah, this is gonna screw everything up."

              The main feature of USB is its low per-unit cost, that comes at a pretty high price for the design of those units - and people will skimp on that design in all kinds of ways, including the potential to let the smoke out - because: as everyone who sells consumer electronics knows, when you make things that last forever, you screw yourself out of the replacements business.

              --
              🌻🌻🌻 [google.com]
              • (Score: 2) by sjames on Tuesday July 21 2020, @06:02AM (10 children)

                by sjames (2882) on Tuesday July 21 2020, @06:02AM (#1024478) Journal

                Surely a device costing near $1000 can afford a couple polyfuses and a zener diode for clamping.

                • (Score: 3, Interesting) by JoeMerchant on Tuesday July 21 2020, @11:49AM (8 children)

                  by JoeMerchant (3937) on Tuesday July 21 2020, @11:49AM (#1024536)

                  You would think so... now, make 10 million of these $1000 retail devices, which trade for $600 at wholesale, which have $200 per device spent on corporate level marketing, which already cost $150 in parts and labor to manufacture, and convince the board of directors that dropping your net profit on the $50 million R&D investment from $450 million to $440 million (by increasing the per unit cost of manufacture to $151) is a good idea.

                  --
                  🌻🌻🌻 [google.com]
                  • (Score: 2) by sjames on Tuesday July 21 2020, @07:53PM (7 children)

                    by sjames (2882) on Tuesday July 21 2020, @07:53PM (#1024725) Journal

                    Sadly, it won't happen until people realize that they're paying $1000 for junk and the sales shift to support someone who does spend the extra $0.50/unit.

                    • (Score: 2) by JoeMerchant on Tuesday July 21 2020, @08:19PM (6 children)

                      by JoeMerchant (3937) on Tuesday July 21 2020, @08:19PM (#1024732)

                      the sales shift to support someone who does spend the extra $0.50/unit.

                      Yeah, you'd think that, wouldn't you?

                      The consumer electronics marketplace of the past 50 years has done nothing but laugh at your silly idealistic notion.

                      --
                      🌻🌻🌻 [google.com]
                      • (Score: 2) by sjames on Wednesday July 22 2020, @01:17AM (5 children)

                        by sjames (2882) on Wednesday July 22 2020, @01:17AM (#1024819) Journal

                        And that's why capitalism only works when it is well regulated.

                        It's why phones all used to have their own special snowflake charger until the EU put it's foot down.

                        • (Score: 2) by JoeMerchant on Wednesday July 22 2020, @02:33AM (4 children)

                          by JoeMerchant (3937) on Wednesday July 22 2020, @02:33AM (#1024838)

                          Capitalism, as practiced on Earth, is regulated as all hell. There is no such thing as a free market anywhere in the economic foodchain above the Flea market.

                          --
                          🌻🌻🌻 [google.com]
                          • (Score: 2) by sjames on Wednesday July 22 2020, @03:09AM (3 children)

                            by sjames (2882) on Wednesday July 22 2020, @03:09AM (#1024850) Journal

                            But is it WELL regulated?

                            • (Score: 2) by JoeMerchant on Wednesday July 22 2020, @11:22AM (2 children)

                              by JoeMerchant (3937) on Wednesday July 22 2020, @11:22AM (#1024904)

                              is it WELL regulated?

                              According to Bezos and the other billionaires, yes, very well thank you, couldn't be better in fact.

                              --
                              🌻🌻🌻 [google.com]
                              • (Score: 2) by sjames on Thursday July 23 2020, @10:07AM (1 child)

                                by sjames (2882) on Thursday July 23 2020, @10:07AM (#1025352) Journal

                                News flash: Fox declares Henhouse security sufficient!

                                • (Score: 2) by JoeMerchant on Thursday July 23 2020, @01:29PM

                                  by JoeMerchant (3937) on Thursday July 23 2020, @01:29PM (#1025382)

                                  Never really highlighted in the news: the Henhouses have been 100% Fox run operations since forever. The Foxes feel that they are entitled to anything and everything produced in the Henhouses, because their ancestors paid Hens to build them, gathered all the Hens out of the countryside and crammed them into the houses, paid Hens to develop the technology to cram ever more Hens into the houses. If it wasn't for Fox money, those Hens would be free range, unproductive. Of course the Foxes deserve to make all the decisions - which is why the COVID bailout went mostly directly to the Foxes, and the choice in the coming election is between Fox1 and Fox2.

                                  --
                                  🌻🌻🌻 [google.com]
                • (Score: 4, Funny) by DannyB on Tuesday July 21 2020, @01:32PM

                  by DannyB (5839) Subscriber Badge on Tuesday July 21 2020, @01:32PM (#1024562) Journal

                  Surely a device costing near $1000 can afford a couple polyfuses and a zener diode for clamping.
                  Reply to This

                  The $1000 device can be smart enough to protect those polyfuses and the zener diode by blowing first.

                  --
                  The server will be down for replacement of vacuum tubes, belts, worn parts and lubrication of gears and bearings.
        • (Score: 3, Interesting) by anubi on Tuesday July 21 2020, @12:16AM

          by anubi (2828) on Tuesday July 21 2020, @12:16AM (#1024342) Journal

          I think you can still get the simple car chargers for $1 at the dollar store. I bought a few the other day as I needed some 34063 buck regulators, and I discovered the car chargers at my local Dollar Tree were made with them.

          https://www.onsemi.com/pub/Collateral/MC34063A-D.PDF [onsemi.com]

          Another tidbit... Their tea lights, two for a buck, are powered by the same lithium coin cells commonly used by PC clock backup.

          Kinda off topic, but having read this gives you a few more options when you have to get something else working.

          --
          "Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
        • (Score: 4, Interesting) by coolgopher on Tuesday July 21 2020, @01:00AM (6 children)

          by coolgopher (1157) on Tuesday July 21 2020, @01:00AM (#1024363)

          I really don't see how this can be a thing. You do not "push" power. The current is drawn, by the device. And any device with a lithium battery will have a dedicated charging IC to vary how much juice is allowed into the battery at any given time (proper lithium battery charging is Not Simple(tm)). None of the devices we've produced at work have ever had a programmable charging chip, and even if they had been it would've been the height of folly to expose the programming interface to the USB lines. The way the article is written it sounds like the charger is presenting itself as a USB host or device so you can then talk to it using regular USB. That sounds like an insane design. But even then, you don't push power.

          That then leaves the 20V mode of USB-C, which has to be negotiated for (in theory). And for that to be harmful we'd have to be talking about devices without overvoltage protection on the charge circuit. Which again would be insane. You don't trust your inputs. Put a polyfuse there ffs (or something better if you're wanting those 20V).

          The amount of fail that would have to be going on for this to be a thing seems staggering, unless I've missed something. Do feel free to enlighten me.

          Disclaimer: I'm not an EE, I'm just good at creating inadvertent ground loops.

          • (Score: 0) by Anonymous Coward on Tuesday July 21 2020, @02:14AM

            by Anonymous Coward on Tuesday July 21 2020, @02:14AM (#1024406)

            This would work by doing something like this:

            Device asks for 12v - send 24v instead.

            Device asks for 20v - send 40v instead.

            etc....

            What this is pointing out is that the devices do not have sufficient charge port protection to disconnect from the voltage source when the wrong voltage is applied. The designers have gone and created the smoking hardware variant of the software "bad data received, formatting hard drive" bug.

            Do not trust the other device to behave as requested, and build your charge port inputs under the assumption that the device on the other end might miss-behave, and you won't have this problem.

          • (Score: 2) by shortscreen on Tuesday July 21 2020, @03:45AM (3 children)

            by shortscreen (2252) on Tuesday July 21 2020, @03:45AM (#1024437) Journal

            So USB is not limited to 5V anymore? That explains everything. It does more than explain it, it makes this outcome inevitable. The headline could have just said "Some Geniuses Decided USB Ports Should Be Able to Output 20 Volts" and I could have inferred all the rest without any TFA or TFS.

            • (Score: 2) by DannyB on Tuesday July 21 2020, @01:35PM (2 children)

              by DannyB (5839) Subscriber Badge on Tuesday July 21 2020, @01:35PM (#1024564) Journal

              This was one of the problems of the Raspberry Pi 4. It has a USB-C charge port. But its designers seemed to have the quaint idea that it should only be 5V and not negotiate for more. Just like programmers don't negotiate for more.

              --
              The server will be down for replacement of vacuum tubes, belts, worn parts and lubrication of gears and bearings.
              • (Score: 0) by Anonymous Coward on Tuesday July 21 2020, @02:01PM (1 child)

                by Anonymous Coward on Tuesday July 21 2020, @02:01PM (#1024572)

                I remember reading somewhere about a phone that always overheated when charged in the car. Turned out that the cheap car charger (lighter socket-->USB) was supplying nominal 12VDC (possibly more, since cars often run up to 14+ volts when running). So either that dollar-store-car-charger had no 5 volt regulator inside, or the regulator failed leaving the full input voltage available at the USB end.

                While I haven't read anything about other charger failures, it seems possible that mains voltage (115AC in USA) could also make it through to the USB connectors if a home charger failed...

                Prudent device design should protect for both these cases?

                • (Score: 2) by DannyB on Tuesday July 21 2020, @05:34PM

                  by DannyB (5839) Subscriber Badge on Tuesday July 21 2020, @05:34PM (#1024666) Journal

                  We are potentially talking about considerable amounts of power.

                  A USB-C laptop charger can provide up to 100 W. A USB-C phone charger up to 15 W.

                  You CAN actually use the laptop charger on a phone, and phone charger on a laptop.

                  The phone simply charges fast. The laptop warns that it is charging slowly.

                  My wife and I plan to only buy USB-C laptop chargers in the future because they're almost as cheap as phone chargers.

                  A Raspberry PI design assumes more power is delivered by more current rather than higher voltage. By negotiating higher voltage, you don't need thicker USB-C cables to charge a laptop.

                  --
                  The server will be down for replacement of vacuum tubes, belts, worn parts and lubrication of gears and bearings.
          • (Score: 0) by Anonymous Coward on Tuesday July 21 2020, @04:37AM

            by Anonymous Coward on Tuesday July 21 2020, @04:37AM (#1024452)

            Based on that reasoning incandescent lights wouldn't exist. As somebody that accidentally melted a tape player casing, the draw has little influence over that, the power has to go somewhere. Give something too much power and something has to come of the amps and volts.

  • (Score: 1, Insightful) by Anonymous Coward on Monday July 20 2020, @07:01PM (2 children)

    by Anonymous Coward on Monday July 20 2020, @07:01PM (#1024205)
    I don't think my cheap slow charger has any firmware and barring a lightning strike or similar it's not going to produce enough voltage to get more than 500mA through crappy USB cables.

    Charge your devices slowly (and to not more than 80%) and the batteries will probably last a lot longer. Try to keep stuff cool too while you're charging.
    • (Score: 2) by Bot on Monday July 20 2020, @07:34PM (1 child)

      by Bot (3902) on Monday July 20 2020, @07:34PM (#1024222) Journal

      > Slow charging For The Wait
      amen

      Me, I just have a 160$ 6000Mah phone. I slow charge every 2 days, with the PC usb as the normal charger is too fast. This way it always hovers 20% to 85%.

      --
      Account abandoned.
      • (Score: 4, Funny) by Bot on Tuesday July 21 2020, @12:02PM

        by Bot (3902) on Tuesday July 21 2020, @12:02PM (#1024539) Journal

        >6000Mah
        Yet nobody asks me where did I find a phone with 6000 mega ampere per hour.

        --
        Account abandoned.
  • (Score: 5, Insightful) by Mojibake Tengu on Monday July 20 2020, @07:02PM (16 children)

    by Mojibake Tengu (8598) on Monday July 20 2020, @07:02PM (#1024206) Journal

    You shall not entrust a critical fixpoint of physically engineered structure to software.
    Because, doing thusly, it is not a fix point anymore.

    The sooner the experts understand this simple mathematical commandment the quicker our civilization could return to normal progress.
    Keep ignoring, and you will suffer.

    --
    Rust programming language offends both my Intelligence and my Spirit.
    • (Score: 1) by fustakrakich on Monday July 20 2020, @07:13PM (8 children)

      by fustakrakich (6150) on Monday July 20 2020, @07:13PM (#1024211) Journal

      You shall not entrust a critical fixpoint of physically engineered structure to software.

      There are places you shouldn't even trust a diode or a relay. You wanna be at the actual switch/valve

      --
      La politica e i criminali sono la stessa cosa..
      • (Score: 3, Touché) by Bot on Monday July 20 2020, @07:27PM (5 children)

        by Bot (3902) on Monday July 20 2020, @07:27PM (#1024218) Journal

        Can we still say "switch" or the trannies get offended?

        --
        Account abandoned.
        • (Score: 5, Funny) by fustakrakich on Monday July 20 2020, @07:34PM (4 children)

          by fustakrakich (6150) on Monday July 20 2020, @07:34PM (#1024221) Journal

          Then just cut the wire with a pair of dikes...

          --
          La politica e i criminali sono la stessa cosa..
          • (Score: 2) by Bot on Monday July 20 2020, @07:38PM (3 children)

            by Bot (3902) on Monday July 20 2020, @07:38PM (#1024227) Journal

            Uh oh I am afraid the term "Just", subliminally reminding people of "Justice", can be used only if your skin's luma value is in the lower 75%. Do you qualify?

            As for the dikes, is there anything a pair of dikes cannot achieve eventually?

            --
            Account abandoned.
            • (Score: 2) by DECbot on Monday July 20 2020, @09:21PM

              by DECbot (832) on Monday July 20 2020, @09:21PM (#1024270) Journal

              Stretching wire. Generally, I need to use the wire stretches after too liberal applications of dikes.

              --
              cats~$ sudo chown -R us /home/base
            • (Score: 0) by Anonymous Coward on Monday July 20 2020, @09:44PM (1 child)

              by Anonymous Coward on Monday July 20 2020, @09:44PM (#1024277)

              can be used only if your skin's luma value is in the lower 75%

              For some reason the world hates pastels

              is there anything a pair of dikes cannot achieve eventually?

              Have a baby? with no outside assistance?

              • (Score: 2) by Bot on Wednesday July 22 2020, @01:09PM

                by Bot (3902) on Wednesday July 22 2020, @01:09PM (#1024925) Journal

                If you can't have a baby, make friends with social services until they let you steal one. EZ

                --
                Account abandoned.
      • (Score: 4, Interesting) by Mojibake Tengu on Monday July 20 2020, @09:09PM (1 child)

        by Mojibake Tengu (8598) on Monday July 20 2020, @09:09PM (#1024266) Journal

        You can actually create a completely static construction diodic device in many physical domains:
        https://en.wikipedia.org/wiki/Tesla_valve [wikipedia.org]

        This is kind of engineering I trust.

        --
        Rust programming language offends both my Intelligence and my Spirit.
        • (Score: 2) by Bot on Wednesday July 22 2020, @01:10PM

          by Bot (3902) on Wednesday July 22 2020, @01:10PM (#1024926) Journal

          Yeah if there is one way to show genius is in this kind of inventions.

          --
          Account abandoned.
    • (Score: 0) by Anonymous Coward on Monday July 20 2020, @07:28PM (4 children)

      by Anonymous Coward on Monday July 20 2020, @07:28PM (#1024219)

      > You shall not entrust a critical fixpoint of physically engineered structure to software.

      Sounds important in your odd flowery English, but (if I understand you correctly), all you are saying is: critical systems shouldn't depend on software.

      Depending on what we determine to be "critical", we are far, far past this point. I mean, it's unfortunate if the little battery in your phone goes pop and burns up the sofa where you left it charging--if you are lucky the smoke detector in the room will give you enough warning to solve the problem with minimum damage. It's another thing when the descendants of Stuxnet destroy large facilities.

      • (Score: 2) by maxwell demon on Monday July 20 2020, @09:02PM (3 children)

        by maxwell demon (1608) on Monday July 20 2020, @09:02PM (#1024264) Journal

        if you are lucky the smoke detector in the room will give you enough warning to solve the problem with minimum damage.

        If you are unlucky, the smoke detector also got hacked, and refuses to alert you of the problem.

        --
        The Tao of math: The numbers you can count are not the real numbers.
        • (Score: 2) by MostCynical on Monday July 20 2020, @09:58PM

          by MostCynical (2589) on Monday July 20 2020, @09:58PM (#1024280) Journal

          you didn't pay the extra subscription for the AlertTone(tm), did you?

          --
          "I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex
        • (Score: 4, Informative) by coolgopher on Tuesday July 21 2020, @12:11PM (1 child)

          by coolgopher (1157) on Tuesday July 21 2020, @12:11PM (#1024541)

          No, the fancy IoT smoke alarm stopped working when the company went bust and took down their cloud...

          • (Score: 2) by Bot on Wednesday July 22 2020, @01:16PM

            by Bot (3902) on Wednesday July 22 2020, @01:16PM (#1024928) Journal

            Kind of a holy grail of cloud computing. You take down one cloud, fire ensues, another cloud forms automatically.

            --
            Account abandoned.
    • (Score: 3, Interesting) by Common Joe on Tuesday July 21 2020, @09:03AM (1 child)

      by Common Joe (33) <common.joe.0101NO@SPAMgmail.com> on Tuesday July 21 2020, @09:03AM (#1024509) Journal

      The sooner the experts understand this simple mathematical commandment the quicker our civilization could return to normal progress.

      Heh.

      Some of these supposed experts took 10 years to figure out that maybe perhaps having two control panels isn't the brightest of ideas. And they figured out they should ignore years of research so that they can make buttons not look like buttons in a UI. And that installing firmware without a physical switch to explicitly allow an update it is also a great idea. (In the old days, we used jumpers, but a switch would work just fine.) And, of course, the internet of things is a great idea when there isn't a plan to push security updates. And we should use hackable, non-verifiable electronic voting machines instead of paper ballots. And that writing the majority of our important software on a house of cards is also the right direction to go in (i.e., web development which uses dozens or even hundreds of 3rd party apps / APIs)

      Quite frankly, I'm amazed technology still works at all.

      What I'm trying to say is, don't hold your breath on this USB thing. People will have to die before they wise up. Which, interestingly enough, might happen in this circumstance, but it will still take time. And once you get your wish, don't expect experts to become actual experts. They'll fix just that one problem because money (law suits) was involved.

      • (Score: 3, Interesting) by Bot on Tuesday July 21 2020, @12:16PM

        by Bot (3902) on Tuesday July 21 2020, @12:16PM (#1024542) Journal

        >And we should use hackable, non-verifiable electronic voting machines instead of paper ballots

        Me thinks that the system foists upon us shitty electronic voting machines to make sure we prefer paper ballots. This way true, alias direct, democracy stays unattainable.

        --
        Account abandoned.
  • (Score: 2) by Bot on Monday July 20 2020, @07:27PM (6 children)

    by Bot (3902) on Monday July 20 2020, @07:27PM (#1024217) Journal

    because a charger must deal with such tremendously intricate protocols that a firmware update is necessary. How on earth did we manage to have working systems till the 80s with the OS in ROM, gee, it's a mystery.

    --
    Account abandoned.
    • (Score: 3, Insightful) by sjames on Monday July 20 2020, @08:00PM (1 child)

      by sjames (2882) on Monday July 20 2020, @08:00PM (#1024241) Journal

      It's even worse. They COULD have made firmware upgrades require opening the case so people couldn't easily sneak in an update (or spread one virally), but they didn't bother because apparently jumpers are SOOOOOooo expensive.

      • (Score: 0) by Anonymous Coward on Tuesday July 21 2020, @04:42AM

        by Anonymous Coward on Tuesday July 21 2020, @04:42AM (#1024456)

        In most cases, a switch on the back of the unit would be sufficient. Few people have computers that people want into badly enough to break in physically and at that point, it becomes rather moot.

    • (Score: 1, Interesting) by Anonymous Coward on Monday July 20 2020, @08:15PM

      by Anonymous Coward on Monday July 20 2020, @08:15PM (#1024243)

      I could see an argument for why such a feature could be useful. An example would be building in extra capacity to be unlocked in later revisions or allow for changes in steps.

      The real reason for this is cost. Rather than come up with some dedicated circuit for this or ROM programming externally, just get a general purpose system with an EEPROM that you can program after assembly. Faster and cheaper to manufacture that way.

    • (Score: 3, Funny) by DannyB on Monday July 20 2020, @08:21PM (2 children)

      by DannyB (5839) Subscriber Badge on Monday July 20 2020, @08:21PM (#1024248) Journal

      How on earth did we manage to have working systems till the 80s with the OS in ROM, gee, it's a mystery.

      Back then, testing was taken seriously.

      So was design.

      So was safety.

      I remember, vaguely, in the late 80's on some brand of "multi sync" monitor, an article came out saying that some variation of a signal timing (that normally didn't occur) could cause damage to the monitor and failure.

      In my shop, we discussed how anyone would even design hardware that could be damaged by faulty software?

      Q. How many hardware engineers does it take to change a light bulb?
      A. None. The device driver team will develop a patch to fix it.

      Q. How many software engineers does it take to change a light bulb?
      A. None. That's a hardware problem.

      --
      The server will be down for replacement of vacuum tubes, belts, worn parts and lubrication of gears and bearings.
      • (Score: 4, Informative) by choose another one on Monday July 20 2020, @10:45PM (1 child)

        by choose another one (515) on Monday July 20 2020, @10:45PM (#1024301)

        I remember, vaguely, in the late 80's on some brand of "multi sync" monitor, an article came out saying that some variation of a signal timing (that normally didn't occur) could cause damage to the monitor and failure.

        Sounds vaguely like the Killer Poke on the Commodore PET, think that was early-mid 80s though - certainly was rumoured about when I was in school and the school moved to BBC Micros in about 83 (at latest) I think.

        By early 90s it was Linux and a similar warning was about every monitor and the "variation of a signal timing" was the modeline you had to set manually in the X Config file, the modeline being a set of numbers you could play with to optimise your picture in many and varied ways, including, allegedly, blowing up flyback transformers. Windows and DOS didn't seem to feel the need to expose users to this fun, I can't remember why that was.

        Modern stuff is, of course, much smarter than this and most Linux users never see a modeline because: "Modelines are a relic of times when drivers were dumb and monitors/TVs did not respond to EDID requests". Yup, that's right, all the blowing up flyback transformers stuff is now negotiated between the "smart" display and the "smart" video driver. Sound familiar, sort of charger-y perhaps? [ Oh, and of course flyback transformers themselves are a relic of times when monitors were real monitors, and men were real men and could actually get a hernia moving a decent size one ].

        In my shop, we discussed how anyone would even design hardware that could be damaged by faulty software?

        And yet it happened, so many many times, and still happens today. Killer poke, Halt-and-catch-fire, just two examples from way back; for 2020 version of HCF see https://www.theregister.com/2020/04/13/security_roundup_100420/ [theregister.com] and for modern Killer Poke, try Boeing's 737 MAX MCAS instruction - more of a Killer-Wind-Up (at the jackscrew), but awfully effective.

        Face it, hardware has been getting ****ed by software for probably as long as software has existed.

        • (Score: 2) by sjames on Tuesday July 21 2020, @01:27AM

          by sjames (2882) on Tuesday July 21 2020, @01:27AM (#1024381) Journal

          Modern stuff is, of course, much smarter than this and most Linux users never see a modeline because: "Modelines are a relic of times when drivers were dumb and monitors/TVs did not respond to EDID requests". Yup, that's right, all the blowing up flyback transformers stuff is now negotiated between the "smart" display and the "smart" video driver. Sound familiar, sort of charger-y perhaps? [ Oh, and of course flyback transformers themselves are a relic of times when monitors were real monitors, and men were real men and could actually get a hernia moving a decent size one ].

          Even before EDID, if you sent an out-of-spec signal to a monitor, it would blank or just display a bad signal message. Even before that, most monitors wouldn't actually fail from a bad modeline the warnings were given in an abundance of caution in case someone's monitor was an exception to that rule. I've heard of (and experienced) monitors making odd noises from bad modelines, but I've only seen one or two claims of a monitor actually being damaged. It was still nice when Xorg came out and modelines went away :-)

          I saw a youtube video a while back where someone actually tried the "killer POKE". Nothing happened but a little video snow when the display scrolled. Hard reset restored it to normal. Perhaps it stressed the video chip somehow and eventually might lead to early failure, but it wasn't the universal instant destruction it was billed to be.

  • (Score: -1, Offtopic) by Anonymous Coward on Monday July 20 2020, @08:23PM (1 child)

    by Anonymous Coward on Monday July 20 2020, @08:23PM (#1024249)

    It’s the Dominicans Every Time, See the demo video
    https://youtu.be/jtchKk_stCU?t=82 [youtu.be]

    • (Score: 0) by Anonymous Coward on Tuesday July 21 2020, @12:33AM

      by Anonymous Coward on Tuesday July 21 2020, @12:33AM (#1024351)

      Come on This should be modded ‘funny’
      Tencent = 50cent
      Chinese Lang = rap Lang
      Hackers brick devices = giving bricks

  • (Score: 1) by Snotnose on Monday July 20 2020, @10:20PM (2 children)

    by Snotnose (1623) Subscriber Badge on Monday July 20 2020, @10:20PM (#1024292)

    I bought a phone. It came with a charger. That charger can now compromise my home network. Really? Seriously? A phone charger can now take over my home network?

    Whiskey Tango Foxtrot?

    / WTF - What's This Feature

    --
    Of course I'm against DEI. Donald, Eric, and Ivanka.
    • (Score: 0) by Anonymous Coward on Monday July 20 2020, @10:26PM (1 child)

      by Anonymous Coward on Monday July 20 2020, @10:26PM (#1024295)

      TFA didn't mention that anything USB, even a cord, could have a chip inside that's not needed for the devices operation. Was it made in China in the last 15 years? Don't trust it.

      • (Score: 0) by Anonymous Coward on Tuesday July 21 2020, @11:20AM

        by Anonymous Coward on Tuesday July 21 2020, @11:20AM (#1024529)

        Oh and where should it be made for me to trust it?

  • (Score: 3, Interesting) by anubi on Tuesday July 21 2020, @12:50AM

    by anubi (2828) on Tuesday July 21 2020, @12:50AM (#1024361) Journal

    Maybe call me paranoid, but I am convinced most of these backdoors are in place at the behest of governments, using their ability to reward with favorable legislation.

    I believe the ones in power studied well what happened in France some 200 years ago, and want an insurance policy in effect to render the technological Infrastructure of the proles useless while leaving military systems under their power intact, should the populace object to the choices offered us by the ruling class.

    So most of live just one update away from a mass bricking of our technology that will make COVID look like a minor toe snub.

    --
    "Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
  • (Score: -1, Redundant) by Anonymous Coward on Tuesday July 21 2020, @03:46AM (1 child)

    by Anonymous Coward on Tuesday July 21 2020, @03:46AM (#1024438)

    This is telling me that if I buy a charger it could put more voltage than it should and hence fry my phone if there is something wrong with the charger? Or if the person selling me the charger is malicious?

    So if the chargers are bad how is this supposed to work then?

    Step 1: Malicious vendor on Amazon, Ebay, Alibaba, or even my local Fry's electronics or whatever sells chargers with the intent of frying my phone.
    Step 2: I buy charger.
    Ste 3: It fries my phone
    Step 4: I give the vendor a bad review
    Step 5: The vendor can't sell any more chargers
    ???
    Step 7: Profit!!!!
    Step 8: I sue the vendor
    Step 9: the vendor has to potentially pay money to defend himself in court and potentially lose and pay for my phone and maybe the cost of my house burning down if the phone caught fire due to his charger
    ???
    Step 11: PROFIT!!!!

    I'm just not getting this. This same thing can be said about any power adapter. If I buy a power adapter for my laptop and it puts way more voltage than what it's rated to put it could fry my laptop. Or even my shaver. If the power adapter that came with my shaver has the wrong voltage it could fry my shaver. Presumably the manufacturer of my washing machine doesn't want the thing to catch fire and burn my house down but, sure, I'm sure they can design a washing machine and dryer that can burn my house down. Sure the manufacturer of a hair dryer can design one that catches fire.

    I already know this. Presumably I buy my products from a trustworthy source that wants to maintain its trustworthiness so that it can continue to profit from my business and its good reputation. Presumably the businesses that are selling me my charger don't want to burn my house down because that's not how it's going to profit.

    So when I buy a charger I presume the vendor's intent is to make money and if their chargers are bad they will have bad reviews, they won't be able to sell their charger, and they will lose money and even potentially get sued for damages.

    I don't see how this is news.

    • (Score: 1) by anubi on Wednesday July 22 2020, @02:20AM

      by anubi (2828) on Wednesday July 22 2020, @02:20AM (#1024836) Journal

      Business people are masters at the art of obfuscation and misdirection.

      Sue who? The unnamed group who made the thing is somewhere we can't get to and our laws do not apply.

      Whack-a-Mole. Same game as copyright violations.

      Incidentally, has anyone had experience driving a switching power converter with the output from another power converter? I can tell you some power supplies will become extremely unstable if loaded with a periodic load. I have handmade quite a few test jigs to help me ferret out this quite destructive demon that silently lies in wait until just the right frequency is applied as a load.

      --
      "Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
(1)