Hackers Can Now Trick USB Chargers To Destroy Your Devices - Page 1
Forum section: electronics / general

author: splin
author_rank: Frequent Contributor
timestamp: July 21, 2020, 03:15:50 pm
content: https://www.forbes.com/sites/zakdoffman/2020/07/20/hackers-can-now-trick-usb-chargers-to-destroy-your-devicesthis-is-how-it-works/#4f7548bd5bf2QuoteQuoteJust like coronavirus this was clearly "totally unprecedented" and thus you can't blame anyone for not foreseeing the possibility during the USB fast charge specification design process (in the same way governments couldn't have been expected to have made any worthwhile preperations for the possibility of a pandemic).It will be interesting to see how the USB consortium react to this. One way is to have an approval system for fast chargers requiring the use of fully certified ICs with exclusive control of the USB charge process which cannot be overriden by an external controller - rather like the implementation of HDMI preventing access to the unencrypted datastream. Conformant products would then be allowed to sport the new 'GoodPower' logo.It will be interesting to see if any high profile manufacturers/brands prove to be vulnerable.Unfortunately I guess there won't be any easy way to identify vulnerable chargers. Probably best to avoid fast chargers altogether unless you know your device is robust. Hopefully this may be just another in a long list of vulnerabilities that in reality is a low probility risk. Now there needs to be an urgent investigation to find out which devices are vulnerable and need to put them into 'shielded protection measures' to ensure proper social isolation from 'BadPower' chargers. Daily prime time news announcements/government presentations will be needed to publicise the ever present danger.

author: davep238
author_rank: Contributor
timestamp: July 21, 2020, 03:45:56 pm
content: Are you trying to say that if I have a phone that needs 500mA to charge and it's connected to a 2 A charger, that the charger will somehow "force" 2A into the phone? Unless the charger raises its output voltage, how does the charger "force" more current into the device?

author: Mr Evil
author_rank: Regular Contributor
timestamp: July 21, 2020, 04:42:13 pm
content: Quote from: splin on July 21, 2020, 03:15:50 pmThis sounds like it's the fault of the manufacturers, not the spec. Or does the spec demand that chargers have upgradeable firmware, and accept unsigned images?

author: edy
author_rank: Super Contributor
timestamp: July 21, 2020, 04:52:20 pm
content: To mitigate the problem for now at least... don't use a fast charger. Use a "dumb" charger that simply outputs 5V and can't change it's output voltage. But who couldn't see this coming? Why expose firmware to be capable of being reprogrammed? Why wasn't this "negotiation" set up in a secure way, so that malicious software couldn't access this low-level hardware function?

author: MrMobodies
author_rank: Super Contributor
timestamp: July 21, 2020, 05:27:17 pm
content: I thought the firmware could signal back to the charger to simply change the voltage but I never thought of firmware reprogrammable usb chargers.I wonder whether the battery controllers on these phones and tablets can also be compromised to over charge the batteries.So even most phones I have seen now are so locked down and unrooted to the user criminals have more rights to it however malware it gets on there maybe through some "app".It looks like it can also start from the charging stations at a controller level and not malware installed on the phone itself:https://www.forbes.com/sites/zakdoffman/2019/11/15/dont-let-public-usb-charging-stations-ruin-your-holiday-travels-officials-warn/#7b704718410cQuote

author: davep238
author_rank: Contributor
timestamp: July 21, 2020, 05:28:49 pm
content: Quote from: blueskull on July 21, 2020, 03:48:28 pmThanks for letting me know. I only have an old phone that does not do quick charging.

author: splin
author_rank: Frequent Contributor
timestamp: July 21, 2020, 05:30:56 pm
content: Quote from: Mr Evil on July 21, 2020, 04:42:13 pmI've not read the specs, but sure it's the fault of the manufacturers. However the USB Implementers Forum (who are in control of the standard) should have anticipated this possibility - after all, the image of the USB PD standard risks becoming severely tainted if this turns out to be a significant real-world problem.It isn't an easy issue to deal with in the specifications; it's one thing proving a product conforms when operated as intended but how can you prove it continues to conform in the face of an almost infinite variety of possible malign external attacks, especially when in the firmware of the microcontroller in control of the charger?That is why I suggested that chargers should only be approved where sufficient proof exists that the critical charging voltage negotiations between the charger and the device to be charged and the actual generation of the selected voltage to the interface could only be compromised by physical modification of the product. It would likely add considerable costs and would work to the advantage of the big players at the consumers expense.

author: SilverSolder
author_rank: Super Contributor
timestamp: July 21, 2020, 06:01:07 pm
content: It's a side effect of the general trend of over-complicating and making brittle even simple products that were robust and trustworthy in the past.

author: edy
author_rank: Super Contributor
timestamp: July 21, 2020, 06:22:07 pm
content: This reminds me of this scene from one of my favorite movies:Hackers will find a way to send 40,000 V to your phone and blow it up!

author: SparkyFX
author_rank: Frequent Contributor
timestamp: July 22, 2020, 12:39:36 am
content: This is tricky on several levels...A QC-capable device might be able to handle the wrong output or detect a bad power sourceA non-QC device might not reprogram the charger, but the one before this could haveIn other words... only use a trusted charger.OTOH i think the issue is somewhat overrated, because there is no value in the mindless destruction of devices or an imminent fire hazard, which limits motivation to do so. Such an act would have been possible with manipulated or faulty USB chargers before there were chargers with reprogrammable firmware.

author: sleemanj
author_rank: Super Contributor
timestamp: July 22, 2020, 12:47:57 am
content: IMHO USB-C and all the quick charge stuff was made stupid complicated. The developers threw software, negotiations, protocols, special chips, rewritable firmware... at a problem that amounts to connecting a wire to a voltage source.K.I.S.S

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: July 22, 2020, 12:50:59 am
content: Quote from: sleemanj on July 22, 2020, 12:47:57 amI remember first reading about them wanting to deviate from the 5v, 500mA standard. I thought, oh f***, here we go.

author: SilverSolder
author_rank: Super Contributor
timestamp: July 22, 2020, 01:31:49 am
content: Quote from: sleemanj on July 22, 2020, 12:47:57 amExactly... and any experienced engineer could have told them that the end result could only ever be less reliable than connecting a wire to a voltage source!

author: Halcyon
author_rank: Unknown
timestamp: July 22, 2020, 02:43:20 am
content: Most decent phones will handle extreme over-voltages up the USB port anyway.

author: Halcyon
author_rank: Unknown
timestamp: July 22, 2020, 06:27:18 am
content: Quote from: blueskull on July 22, 2020, 06:21:07 amI'd hardly call the voltages pumped into the Samsung Galaxy Note series as "instant". It was fairly continuous and the phone didn't even lock up or reboot. And we're talking about 215 volts, not 20.

author: Halcyon
author_rank: Unknown
timestamp: July 22, 2020, 06:35:32 am
content: Quote from: blueskull on July 22, 2020, 06:30:53 amEven worse. Why would manufacturers bother only protecting the data lines and not bothering with the power as well? Phones routinely get charged off all kinds of shitty power supplies, everything from your crappiest Chinese adapters that are mains referenced, to noisy vehicle power adapters.

author: tom66
author_rank: Super Contributor
timestamp: July 22, 2020, 08:05:23 am
content: Quote from: blueskull on July 22, 2020, 06:21:07 amNo, but most modern phones have something along these lines:https://www.maximintegrated.com/en/products/power/protection-control/protection-ics/MAX4987AE.htmlThis is the device that was fitted to my Samsung S4, and it provides OVP up to 28V even though the phone only supported 5V.ESD diodes can keep the device within its momentary OVP limits as well.

author: Halcyon
author_rank: Unknown
timestamp: July 22, 2020, 08:24:23 am
content: Quote from: blueskull on July 22, 2020, 06:44:58 amNope, but I know the stupid shit that consumers do and what manufacturers are up against. You pay a premium for decent hardware for a reason (other than the badge).Quote from: blueskull on July 22, 2020, 06:44:58 amWatch Big Clive, he does several videos on "death-dapters".

author: tom66
author_rank: Super Contributor
timestamp: July 22, 2020, 08:25:16 am
content: Quote from: blueskull on July 22, 2020, 08:16:39 amDo you have a link to this technology? I'm quite interested to understand this. Surely the phone must still support 5V USB charging to be compatible with existing kit, but the high power path is also available with compatible chargers.

author: Halcyon
author_rank: Unknown
timestamp: July 22, 2020, 08:44:56 am
content: Quote from: blueskull on July 22, 2020, 08:31:17 amFrom memory he did one on a camping light with a "5 volt" USB output which can be used for any consumer devices. He also did one on some coloured Poundland chargers which he ended up blowing up (on purpose).The point is, dodgy USB adapters exist in the consumer market. I don't recall a single brand-name phone blowing up or having their port destroyed because of it. Many are designed (within reason) to cop what owners throw at them.

author: bitwelder
author_rank: Super Contributor
timestamp: July 22, 2020, 08:58:56 am
content: Quote from: blueskull on July 22, 2020, 08:31:17 am"With anadvanced encryption algorithmand strict temperature control regulators, it enables the safe and efficient use of the flash charging device."Whaaat? Is the encryption algo part of some proprietary power negotiation protocol, or where else does came into play?

author: Berni
author_rank: Super Contributor
timestamp: July 22, 2020, 09:49:50 am
content: Quote from: Halcyon on July 22, 2020, 08:44:56 amSo you expect the phone to have an isolated DC/DC converter inside of it to remain floating even when a crappy chinese mains referenced charger is plugged in? Have you seen the size of isolated switching converters for these kind of powers?Phones are built down to a price AND formfactor. They have to keep the costs down in the mainstream phones to be competitive in the fierce phone market. Also any high power protection devices require extra board space. With the trend of phones pushing to be ever thinner this space is very limited.Any decently made phone will survive a lot of static zaps to its USB port, It will survive being charged from a USB charger that is not isolated from mains (But the phones owner might not survive that). But it is not reasonable to expect a phone to survive continuous reverse polarity or 24V on the USB port. Yes it is possible to do it, but might not be worth it. It is the users own fault for using a shitty charger, just like it is the users fault if you put diesel in your gasoline car and complain to the manufacturer when it doesn't run.But the fact that this hack is possible is indeed horrible design that should have never happened. How fucking difficult is it to get about 2 bits worth of information across a wire reliably.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: July 22, 2020, 10:15:36 am
content: today's old news.Such is the price for using those ubiquitous public USB chargers. The best counter measure is to use a DC only - or no data - USB lead. And one with a built in limiter circuit.Today's student design challenge: design a USB charging protection device and lead that is 100% safe to connect to any random public charger point. Whether that USB charger point is on a plane, a bus or attached to a cycling machine in a train station, your design will handle over voltage, over current and, provide isolation from transients, floating earths, etc. Plus, it provides a nice user friendly status LED. Don't cut and paste a design off of Google, figure it out yourself just like your classmates will have to.

author: tom66
author_rank: Super Contributor
timestamp: July 22, 2020, 10:17:21 am
content: Quote from: Syntax Error on July 22, 2020, 10:15:36 amThere's no such circuit. Say someone designed a USB charging point that was connected directly to 3ph 415V. No protection circuit is going to protect against that unless it is self-sacrificing. And then it would need to have a relay/contactor/MOSFET to isolate it and even that has a maximum breakdown rating.There always comes a reasonable limit for which protection circuits are designed to handle. 28V protection on a 5V USB device makes sense because it protects against the worst case of a failed cigarette-lighter charger in a 24V vehicle. Beyond that point failures are almost certainly intentional.

author: Berni
author_rank: Super Contributor
timestamp: July 22, 2020, 10:32:14 am
content: Quote from: tom66 on July 22, 2020, 10:17:21 amWell not to say it is impossible to make a protection circuit that will survive having 400V AC put into it. Its just that the circuit would become unpracticaly large and expensive. Heck you could make a device that survives being hooked up to a 20kV AC transmission line, but the power input connector for that alone would be larger than the phone itself.At some point the device would become bigger than a USB power bank, at that point it makes more sense to just bring a power bank. It does the same job of keeping your phone protected by preventing you from needing to plug into a unknown source.But yes id say you could make a protection device that can survive 220V mains put into it that is the size of a disposable cigarette lighter using off the shelf reasonably priced components (Would still take a fair bit of design work tho). Making it work with all of USB-PD would be tougher but probably still possible.But getting this to fit into the phone itself... ho boy. Good luck with that

author: Syntax Error
author_rank: Frequent Contributor
timestamp: July 22, 2020, 11:08:17 am
content: @tom66 - No need to connect to the device National Grid, just any suspicious USB charger port, such as those on the school bus.@Berni - This just needs to be a inline box that sits between the charger cable and the target device. It's about the size of a cigarette packet.Also for your challenge, come up with a catchy name for your protection device.

author: Mr Evil
author_rank: Regular Contributor
timestamp: July 22, 2020, 11:52:55 am
content: Quote from: splin on July 21, 2020, 05:30:56 pmMaybe the spec could have been better; I don't know because I haven't read it either. I don't think it's reasonable or even possible to prevent crap hardware from being created though. Consider that the original USB 1 faced a comparable problem with the possibility of damage from connecting two USB hosts together, as they would both try to supply power on the same wire. To prevent that, A-to-A cables were disallowed, and yet that didn't stop manufacturers from creating peripherals with USB-A sockets on them, and A-to-A cables to go with them! They often have the USB logo on them too, despite the logo only being legally permitted on devices that are compliant.

author: Halcyon
author_rank: Unknown
timestamp: July 22, 2020, 12:12:53 pm
content: Quote from: blueskull on July 22, 2020, 08:51:58 amNo one is talking about the user being fried. This thread is specifically about devices being destroyed.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: July 22, 2020, 12:20:02 pm
content: QuoteMaybe place a crowbar mosfet plys a spark gap across the input VUSB/GND?

author: JoeyG
author_rank: Regular Contributor
timestamp: July 22, 2020, 01:18:59 pm
content: Protection

author: Zero999
author_rank: Super Contributor
timestamp: July 22, 2020, 02:04:15 pm
content: All this talk of protection to 400VAC is BS. The maxiumum output voltage of USB-C is only 20V. It's trivial to design a protection circuit to withstand that. I'd go for overvoltage protection up to 24V, just in case, but that's still easy and inexpensive to implement.

author: Berni
author_rank: Super Contributor
timestamp: July 22, 2020, 07:40:55 pm
content: Yeah to be fair 24V does seam like a reasonable bar for protection. But then again something that can handle multiple amps with next to no voltage drop can be pretty bulky, especially when the whole mainboard in a phone is only the size of a few postage stamps.Also what benefit does the manufacturer get from the extra cost and effort into adding the protection? They expect there users to buy a new phone every 2 years anyway. If a doggy charger that is the fault of the user gets that down to 1 year that's even better.

author: Cerebus
author_rank: Super Contributor
timestamp: July 22, 2020, 08:12:03 pm
content: Quote from: tom66 on July 22, 2020, 10:17:21 amYou've obviously never heard ofload dumps.

author: tom66
author_rank: Super Contributor
timestamp: July 23, 2020, 06:30:31 am
content: Quote from: Cerebus on July 22, 2020, 08:12:03 pmOf course load dumps are a thing, but you'd be having a remarkably bad day if you happened to have your device connected to one while a load dump occurred, while the charger was short circuited and malfunctioning, and the charger had no load dump provision at all on its input.The point is you need to stop at some point and engineering a phone to survive 120V from a 28V load dump given it normally charges on 5V is not going to be easy. Maybe it is something an industrial smartphone could do.

author: Berni
author_rank: Super Contributor
timestamp: July 23, 2020, 04:13:35 pm
content: I think its more the case that a load dump would blow up a cheap cigarette socket USB charger since most are not all that well made. And the failure mode of buck DC/DC converters is often to just let the full input voltage trough. Still a load dump is rather rare is likely to fry something else too.But yeah its ridiculous to try and design a phone to handle that. I do think it would make sense to survive 24V if you have a USB-C port on the phone. But i can see why a lot of phone manufaturers wouldn't bother with the extra cost and the effort to find room inside the phone for an additional bulky power IC.

author: asmi
author_rank: Super Contributor
timestamp: August 13, 2020, 02:11:04 pm
content: Quote from: blueskull on July 22, 2020, 08:31:17 amThat page seems to be full of marketing BS. First of all, USB PD only goes up to 100 W (20V@5A), and even that is only with EC-marked cable certified to withstand 5 A current - non-EC cables are only allowed 3 A, so 60 W max. Second - what kind of battery will be able to take such huge charging current without exploding anyway? I have S9+ phone, and it's "quick charge" is only 5V@2A, so 10 W total (measured it on 45 W USB-C PD power supply which I use for my own USB-C PD development). USB-C allows up to 5V@3A (15 W) without all of that PD business, with a simple pair of resistors. I'm yet to actually hold in a hand a phone that raises the charging voltage above 5 V, but USB-C spec requires all devices to withstand 20 V regardless of what it actually needs or uses. It also needs to withstand 20 V on CC lines (because these lines are right next to Vbus ones, so they might get connected for a moment during connection/disconnection). USB PD sinks are required to ensure Vbus voltage is Vsafe5V before they proceed with any power negotiations, and a "charger-that-is-stuck-at-20V" is a recognized failure mode that all USB-C compliant devices need to be able to handle. Finally, building a reliable over-voltage protection is not a rocket science - polyfuse + crowbar circuit were invented a long time ago.

author: SilverSolder
author_rank: Super Contributor
timestamp: August 13, 2020, 02:22:24 pm
content: Quote from: Berni on July 23, 2020, 04:13:35 pmDoes the protection have to be anything fancier than a mosfet pass transistor that can block the current?

author: asmi
author_rank: Super Contributor
timestamp: August 13, 2020, 02:56:27 pm
content: Quote from: blueskull on August 13, 2020, 02:37:24 pmYes, I said above - it's BS, not PD.Quote from: blueskull on August 13, 2020, 02:37:24 pmChinese are known to not care about safety as much as they rest of the world. You might want to read up on where this 20V@5A limit came from - this is not just a random number.Quote from: blueskull on August 13, 2020, 02:37:24 pmTechnically they do - you are only supposed to put USB logo on compliant devices. Whether they actually do it is a separate discussion.Quote from: blueskull on August 13, 2020, 02:37:24 pmI don't see a big problem doing so. But again, there is no need to do so as every USB-C device is required to withstand 20 V - like I said above, this is a recognized failure mode that needs to be tested for in order to be compliant, and no firmware on a PS can cause it to output higher than 20 V as it's a HW limitation.

author: asmi
author_rank: Super Contributor
timestamp: August 13, 2020, 03:20:41 pm
content: Quote from: blueskull on August 13, 2020, 03:08:30 pmI do. Whatever you think about USB-IF (and I have my reasons to dislike them to put in mildly), the big advantage of PD is it's universality. I can connect any PD charger to any USB-C device and know that one of two things will happen -1) it works/charges, even if perhaps slowly, or 2) it doesn't work and complain about insufficient power. But most importantly, I know that one thing will absolutely NOT happen - either device will receive a permanent damage.Quote from: blueskull on August 13, 2020, 03:08:30 pmThe law doesn't say it's OK. That's the point. Like I said - go and read up on where USB PD limit came from.Quote from: blueskull on August 13, 2020, 03:08:30 pmApple are known to cut corners on their HW, and pretty much any of their device has at least some kind of HW fuck up. So they are hardly a good example. I evaluated a few USB PD power controllers, and all of them were able to handle 20 V just fine. If someone does something stupid, it doesn't mean there is no better way.

author: asmi
author_rank: Super Contributor
timestamp: August 13, 2020, 03:38:07 pm
content: Quote from: blueskull on August 13, 2020, 03:32:31 pmI don't care how things work in China. I have enough to worry about in my own country to care what happens elsewhere.Quote from: blueskull on August 13, 2020, 03:32:31 pmAnd what do you do if your phone explodes in your hand due to some kind of incompatibility?Quote from: blueskull on August 13, 2020, 03:32:31 pmThey know better than selling this junk in countries which actually care about their people, and where selling dangerous piece of junk can have serious legal consequences.

author: asmi
author_rank: Super Contributor
timestamp: August 13, 2020, 04:37:29 pm
content: Quote from: blueskull on August 13, 2020, 03:42:11 pmItshould notdo that, but that doesn't mean it won't. Like I said repeatedly (and you repeatedly ignored), this condition is a known failure mode of USB PD that all compliant devices have to be tested against. So no USB-C compliant device will receive any damage if power supply will provide the maximum voltage right from the get go. This, of course, will not work if some "genius" decides that 20 V is not high enough and allow going nigher in their "custom" protocol pulled out of his ass.Quote from: blueskull on August 13, 2020, 03:42:11 pmI can pretty much guarantee you it won't happen, at least not here. In China - maybe, they seem to enjoy killing their own people.

author: asmi
author_rank: Super Contributor
timestamp: August 13, 2020, 05:28:40 pm
content: Quote from: blueskull on August 13, 2020, 04:51:13 pmAgain you skipped the most relevant part. Compliant USB-C device is immune to the "attack" described here by design. It's only by adhoc "improvements" done by incompetent people is how you wreck everything.Quote from: blueskull on August 13, 2020, 04:51:13 pmNo, it's the opposite - killing your own people is how countries stay in the third world, which is where China is right now, and where it will stay for foreseeable future.

author: asmi
author_rank: Super Contributor
timestamp: August 13, 2020, 07:07:37 pm
content: Quote from: blueskull on August 13, 2020, 06:25:13 pmVoltage can't be "dumped" anywhere - that's not how it works. If you connect bad charger that is stuck at HV for some reason, nothing bad will happen if the port is designed and tested properly.Quote from: blueskull on August 13, 2020, 06:25:13 pmAgain, the fact that someone screwed up doesn't mean it's impossible to implement properly. It's just someone is either incompetent, or they knowingly decided to cut corners in implementation, relying on a second party to behave properly.Quote from: blueskull on August 13, 2020, 06:25:13 pm

author: SilverSolder
author_rank: Super Contributor
timestamp: August 13, 2020, 08:23:02 pm
content: Consumers do see fast charging as a benefit when buying a phone - that, and large capacity batteries, and/or low power consumption.Especially now that smartphones are no longer a "new thing", even Grandma knows what their main shortcoming is... i.e., they run out of power, usually at the most inconvenient / annoying times!So, I would definitely expect technology to keep moving in the direction of faster charging, since that is cheaper/lighter than installing a bigger battery...PS. I still don't see why a MOSFET in series with the incoming power won't solve the protection problem. It can just block the power if the phone can't handle the voltage. No need for crowbars etc - just go to a high impedance state.

author: NiHaoMike
author_rank: Super Contributor
timestamp: August 13, 2020, 10:48:18 pm
content: Quote from: blueskull on August 13, 2020, 03:42:11 pmOver 20 years ago, there was an unofficial extension to USB to provide up to 144W. It was implemented as a separate part of the connector so none of the problems with changing voltages.https://en.wikipedia.org/wiki/PoweredUSB

author: eti
author_rank: Super Contributor
timestamp: August 15, 2020, 12:01:31 am
content: Skimmed the title, saw the word "hackers" being misunderstood, exploited for clicks and abused, didn't waste time reading.

author: Cerebus
author_rank: Super Contributor
timestamp: August 15, 2020, 12:59:13 am
content: Quote from: eti on August 15, 2020, 12:01:31 amBut you did waste your time (and ours) telling us that.

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: August 15, 2020, 01:37:26 am
content: Quote from: Cerebus on August 15, 2020, 12:59:13 amTitle skimmage is a thing, apparently.

author: eti
author_rank: Super Contributor
timestamp: August 15, 2020, 03:36:03 am
content: Quote from: Ed.Kloonk on August 15, 2020, 01:37:26 amLolage!

author: eti
author_rank: Super Contributor
timestamp: August 17, 2020, 12:09:10 am
content: Quote from: Cerebus on August 15, 2020, 12:59:13 amAnd along you trundled, and wastedmoretime "setting me straight" ... but I suppose you think that doesn't count eh?

author: Cerebus
author_rank: Super Contributor
timestamp: August 17, 2020, 01:09:10 am
content: Quote from: eti on August 17, 2020, 12:09:10 amYawn.

author: Simon
author_rank: Unknown
timestamp: August 17, 2020, 05:29:40 pm
content: shut up both of you!

author: eti
author_rank: Super Contributor
timestamp: August 17, 2020, 10:29:12 pm
content: Quote from: Simon on August 17, 2020, 05:29:40 pmOkay Ma'am.