Topic: anyone make their own USB cables from scratch? (Read 646 times)

I do agree, you're speaking to someone who has degoogled their phone, uses Qubes OS, and is generally very paranoid . I've never had to use a USB socket at an airport, I tend to go for phones with bigger batteries.

Although, as much as we try to avoid it, if they go to this extent, they've probably already infiltrated most of the phone manufacturers themselves. It's generally why it's said that you can't really escape state level spying, whereas you can at least keep your privacy intact from non state level spying.

I'll take a look at the juice jacking in a bit more detail. I'm quite fascinated, since I knew of USB exploits being plugged into a computer (hence why I like the idea of a disposable sys-usb on Qubes OS), and obviously phones, but I never really considered it with the USB sockets themselves.

Absolutely! State-level stuff can just have malicious USB sockets installed by the contractors when the facility is built / renovated. That way there's not much risk involved. You can argue that they might also simply use those acquired USB exploits by plugging in your device when you pass the x-ray.

However, this 'juice jacking' [1] attack is pretty well researched and there have been warnings by the FBI [2], but I'm not aware of research about the deployments 'in the field'.

That's good to know!

I mean just a 5V charger / transformer from 110 / 220V.

[1] https://en.wikipedia.org/wiki/Juice_jacking
[2] https://news.softpedia.com/news/fbi-warns-against-wireless-keystroke-loggers-disguised-as-usb-chargers-504435.shtml

Yeah, wouldn't this be more state level spying rather than independent malicious actors? First, to tamper with a USB socket in plain sight in public seems rather high risk, for relatively low reward? At least, you don't hear of it too often. I mean, there's plenty of better places to do it than a airport with all the cameras, and security walking about. However, you typical cheap hotel probably isn't going to have this sophisticated attacks, they'd be much more likely to do identity theft with the documents you provide or alternatively run off with your credit card.

I have a 50,000mah one which I know wasn't allowed, which I admit is significantly larger than your usual power bank. I believe the limit is in the 20kmah mark, and you're allowed two of them, which have to be carried in your hand luggage due to risk of the lithium battery catching fire.

Here you go:

Depends on the length of travel. At some point that brick is going to need charging.

From both my gut feeling, news stories and professional experience, I can say that USB exploits are not uncommon, but pretty sought after by companies in the exploit buying / selling business, as well as the people and organizations they sell them to. In my opinion, the highest risk of finding malicious USB ports will be in airports / border controls. There are known cases of some countries' border patrol (hidden or even openly - if I recall correctly) jailbreaking / rooting people's phones to track and spy on them. I expect this risk to be much lower in generic hotel room equipment.

I'm not sure about that, but I've definitely lived off a single (large) power bank for a 7-day week and I believe that was still plane legal.

On the other hand, if you have the capacity and remember to bring a voltage checker, why don't you just bring a 5V brick?

Fair play, I thought I was security conscious, but I'll be honest I've never even thought about the possibility of a socket being compromised. I mean, even now that I've been made more aware that these things do happen, I imagine they're slim chanced. Would be interested seeing when, and where this happened, and to what extent they gained access to someone's device. I do use Qubes OS with a sys-usb for unknown usb devices, but never really thought about it with charging the phone. Although, my Bitcoin hasn't ever touched my phone, so not that I have to worry about that.

Aren't you limited by what you can carry with battery banks anyhow. I always thought there was a maximum of two at a certain volume. Otherwise, I'd be bringing more of them on my travels.

For that you could bring a voltage checker. They're cheap, and if you've done any electricity work in the house you've probably already got one.

another thing i worry about in hotels that have those usb sockets mounted in multipurpose wall sockets (ie 2 x 120/240v outlets and 2+ usb sockets) and found in stuff like nightstand etc with built in usb plugs is you have no idea how good the power supply in them is. while some may be fine as far as voltage regulation etc im sure there is some absolute trash electronics in some of them that supplying lord knows what as far as the powers purity. sure in theory there may be some protection (?)  on the device  but why chance it.

much prefer to plug my $1k plus phones etc into a known good usb supply that i bring.

so a couple good reason to never trust strange usb sockets in the wild.

You don't even need to strip it - a pair of needle nosed pliers and you can reach in there and just yank out the two middle pins. Not the most high tech solution, but it does the job.

Connecting your device to a standard electricity wall socket via your own cable and adapter plug is fine. Connecting your device directly to USB socket on the wall via your own cable is not (unless the cable is power only) - you have absolutely no idea what could be hiding on the other side of that USB socket. The risk of doing this is akin to the risk of picking up a random USB drive you find lying in the street and plugging it in to your device.

How about PortaPow?

nice. thanks for the links. will check into them.

I believe interception would be much easier to do and it would work across operating systems and OS versions, so it's much more likely. Also I don't know how you would set up shared symmetric keys between device and software, without the key being leaked. It should be trivial to extract it from the binaries, so a hardcoded key is out of the question. There would need to be a key agreement setup phase the first time you connect the wallet to the software, which I've never heard of being used in hardware wallet software.
A quick GitHub search on Trezor's firmware repo [1] yields nothing regarding key agreement or public keys to protect the USB connection, but it might be worth analyzing the traffic - especially on closed-source devices - using a device such as Adafruit Beagle USB 12 [2]. Low-cost DIY solutions also exist which may be enough for hardware wallet USB communication [3].
Anything such a USB hardware sniffer can extract, can also be extracted by a malicious cable and either stored locally^{[on the cable]} to later be extracted by the attacker, sent over WiFi or maybe by injecting a process on the host which has network connectivity.

Another search term for these devices would be 'USB sock' or 'USB condom'. They even exist for USB-C (since we talked about it before). Downside is that they're easy to lose.

That's why I currently only use QR codes (like @dkbit98 mentioned) - don't have to worry about all this nonsense anymore at all.

[1] https://github.com/trezor/trezor-firmware/search?q=key+agreement
[2] https://www.adafruit.com/product/708
[3] https://github.com/matlo/serialusb

this is another very good way. except. im lazy af 

once i took a dremel with a diamond bit and ground out the two data traces in the plug on a couple cables i had. works but messy.. i just sprayed the crap out with contact cleaner after.

@dkbit98  at this point in this timeline i have a baseball cap with silver foil liner. that  way i get the sunviser too.

Are you always bringing tin foil hat with you on your travels?
I don't see the problem in connecting devices for charging in wall power socket, you can always bring adapter with you, but it's different thing connecting it with other devices.
Best thing about airgapped hardware wallets is the fact they don't need any cables for connection with computer and other devices, and they are even safer if they don't have bluetooth and wireless conenction.

Why not strip the wire instead and cut the two lines the data+(green wire) and the data-(White wire) then two negative(Black) and positive(Red) should remain then use heat shrink to cover it back. If you need the cable for other things to transfer data make sure it's not related to your wallet or any important data then you can strip it again and connect those two cut lines.

Or buy an adapter like this below then put a tape on the two pins in the middle

sweet. gonna grab me some pronto.

A malicious cable could still inject and run arbitrary code on the computer you are connecting the hardware wallet to, and steal your unencrypted public keys or addresses from there. So although a good hardware wallet should protect you from any direct security risks associated with a malicious cable, as n0nce says there is still a privacy risk.

Go one step further, and make sure all the cables you are carrying with you are power only cables (except maybe one data cable if you need to connect up your hardware wallet/phone/tablet/laptop to each other). That way, you can use public charging points or hotel charging points without risk of transmitting any data to or from your devices. You can buy such cables or make them yourself as I described above. You can also buy small adapters which connect to regular USB cables and only attach to the power pins, leaving the data pins disconnected - search for USB defender or USB blocker.

But if hardware wallets encrypt all data being transmitted from the device to the PC with an AES key [hardcoded in both hardware device and software library], then wouldn't a malicious cable only be able to read gibberish anyway?

After all, it's not like they can get an Ethernet interface or WiFi interface inside it and relay the gibberish to some remote server to attempt to brute-force the key. Or try to do it themselves by putting a mini-ASIC of some sort.

thats why when i travel i never use usb charge sockets in airports and hotel rooms. i bring several usb battery banks for my phones and ebook reader for on the go recharging. in hotel rooms i always bring my own powered hubs.. like the ones that plug into conventional wall power and can charge 10+ usb items and such. plus spare hubs and cables so when one craps out i have spares. no need to by crap stuff cuz youre out.

I think it would also be possible for a badUSB cable to intercept the xpub or individual public keys that are sent from device to host and then send those to a server for deanonymization, wouldn't it?

Should be highly unlikely since the cables in question are much more expensive than regular USB cables so they cannot be sold for like $10 without taking a loss. They are just used for targeted attacks. For instance, someone handing you such a cable, or distributing them in the office.

USB attacks in the wild also happen in airports or other public places where there are free phone charging spots. You connect the phone to a bad USB socket or cable and get infected with some malware / virus / tracker. Speaking of airports: border security of some nations intentionally infects devices of visitors to spy on them.

I cant remember a particular case where i have read of an infected series of cables being distributed over Ebay/Amazon but it is possible, why not. A malicious person could infect at least a few devices before negative comments start to flow in. After that the users would become cautious and ebay/amazon could delete the sales threads.

Any cases where there is malware/virus from buying cables on ebay or amazon?