Smartphones can be compromised when charged using a standard USB connection connected to a computer, Kaspersky Lab experts have discovered in a proof-of-concept experiment.
Have you ever wondered how safe your smartphone and data are when you connect the device to freely available charging points at airports, cafes, parks and public transport? Do you know what, and how much data your mobile device is exchanging with these points while it’s charging? Kaspersky Lab researchers became curious and conducted research to find the answers to these questions.
As part of this research, the company’s experts tested a number of smartphones running various versions of Android and iOS operating systems in order to understand what data the device transfers externally while connected to a PC or Mac for charging. The test results indicate that the mobiles reveal a whole litany of data to the computer during the ‘handshake’ (a process of introduction between the device and the PC/Mac it is connected to), including: the device name, device manufacturer, device type, serial number, firmware information, operating system information, file system/file list, electronic chip ID. The amount of data sent during the handshake varies depending on the device and the host, but each smartphone transfers the same basic set of information, like device name, manufacturer, serial number etc.
Now that smartphones almost always accompany their owner, the device serves as a unique identifier for any third party who might be interested in collecting such data for some subsequent use. But it wouldn’t be a problem if collecting a few unique identifiers was all that an attacker could do with a device connected to an unknown computer or charging device.
Back in 2014, a concept was presented at Black Hat that a mobile phone could be infected with malware simply by plugging it into a fake charging station. Now, two years after the original announcement, Kaspersky Lab experts have been able to successfully reproduce the result. Using just a regular PC and a standard micro USB cable, armed with a set of special commands (so-called AT-commands), they were able to re-flash a smartphone and silently install a root application on it. This amounts to a total compromise of the smartphone, even though no malware was used.
Although information about actual incidents involving fake charging stations has not been published, the theft of data from mobiles connected to a computer has been observed in the past. For example, this technique was used in 2013 as part of the cyberespionage campaign Red October. And the Hacking Team group also made use of a computer connection to load a mobile device with malware. Both of these threat actors found a way to exploit the supposedly safe initial data exchange between the smartphone and the PC it was connected to. By checking the identification data received from the connected device, the hackers were able to discover what device model the victim was using and to progress their attack with a specifically-chosen exploit. That would not have been as easy to achieve if smartphones did not automatically exchange data with a PC automatically upon connecting to the USB port.
“It is strange to see that nearly two years after the publication of a proof-of-concept demonstrating how a smartphone can be infected though the USB, the concept still works. The security risks here are obvious: if you’re a regular user you can be tracked through your device IDs; your phone could be silently packed with anything from adware to ransomware; and, if you’re a decision-maker in a big company, you could easily become the target of professional hackers,” warns Alexey Komarov, researcher at Kaspersky Lab. “And you don’t even have to be highly-skilled in order to perform such attacks, all the information you need can easily be found on the Internet,” he concludes.
In order to protect yourself from the risk of possible attack through unknown charging points and untrusted computers, Kaspersky Lab advises the following:
· Use only trusted USB charging points and computers to charge your device;
· Protect your mobile phone with a password, or with another method such as fingerprint recognition, and don’t unlock it while charging;
· Use encryption technologies and secure containers (protected areas on mobile devices used to isolate sensitive information) to protect the data;
· Protect both your mobile device and your PC/Mac from malware with the help of a proven security solution. This will help to detect malware even if a “charging” vulnerability is used.
Low-cost wireless sport earphones get a kickstart
Wireless earphone brands are common, but not crowdfunded brands. BRYAN TURNER takes the K Sport Wireless for a run.
As wireless technology becomes better, Bluetooth earphones have become popular in the consumer market. KuaiFit aspires to make them even more accessible to more people through a cheaper, quality product, by selling the K Sport Wireless Earphones directly from its Kickstarter page
KuaiFit has an app by the same name which offers voice-guided personal training services in almost every type of exercise, from cardio to weight-lifting. A vast range of connectivity to third-party sensors is available, like heart rate sensors and GPS devices, which work well with guided coaching.
The app starts off with selecting a fitness level: beginner, intermediate and advanced. Thereafter, one has the ability to connect with real personal trainers via a subscription to its paid service. The subscription comes free for 6 months with the earphones, and R30 per month thereafter.
The box includes a manual, a USB to two USB Type B connectors, different sized soft plastic eartips and the two earphone units. Each earphone is wireless and connects to the other independently of wires. This puts the K Sport Wireless in the realm of the Apple Earpods in terms of connection style.
The earphones are just over 2cm wide and 2cm high. The set is black with a light blue KuaiFit logo on the earphone’s button.
The button functions as an on/off switch when long-pressed and a play/pause button when quick-pressed. The dual-button set-up is convenient in everyday use, allowing for playback control depending on which hand is free. Two connectivity modes are available, single earphone mode or dual earphone mode. The dual earphone mode intelligently connects the second earphone and syncs stereo audio a few seconds after powering on.
In terms of connectivity, the earphones are Bluetooth 4.1 with a massive 10-meter range, provided there are no obstacles between the device and the earphones. While it’s not Bluetooth 5, it still falls into the Bluetooth Low Energy connection category, meaning that the smartphone’s battery won’t be drastically affected by a consistent connection to the earphones. The batteries within the earphones aren’t specifically listed but last anywhere between 3 and 6 hours, depending on the mode.
Audio quality is surprisingly good for earphones at this price point. The headset style is restricted to in-ear due to its small design and probable usage in movement-intensive activities. As a result, one has to be very careful how one puts these earphones, in because bass has the potential of getting reduced from an incorrect in-ear placement. In-ear earphones are usually notorious for ear discomfort and suction pain after extended usage. These earphones are one of the very few in this price range that are comfortable and don’t cause discomfort. The good quality of the soft plastic ear tip is definitely a factor in the high level of comfort of the in-ear earphone experience.
Overall, the K Sport Wireless earphones are great considering the sound quality and the low price: US$30 on Kickstarter.
Find them on Kickstarter here.
Taxify enters Google Maps
A recent update to Taxify now uses Google Maps which allows users to identify their drivers, find public transport and search for billing options.
People planning their travel routes using Google Maps will now see a Taxify icon in the app, in addition to the familiar car, public transport, walking and billing options.
Taxify started operating in South Africa in 2016 and as of October 2018 operates in seven South African cities – Johannesburg, Ekurhuleni, Tshwane, Cape Town, Durban, Port Elizabeth and Polokwane.
Once riders have searched for their destination and asked the app for directions, Google Maps shares the proximity of cars on the Taxify platform, as well as an estimated fare for the trip.
If users see that taking the Taxify option is their best bet, they can simply tap on the ‘Open app’ icon, to complete the process of booking the ride. Customers without the app on their device will be prompted to install Taxify first.
This integration makes it possible for users to evaluate which of the private, public or e-hailing modes of transport are most time-efficient and cost-effective.
“This integration with Google Maps makes it so much easier for users to choose the best way to move around their city,” says Gareth Taylor, Taxify’s country manager for South Africa. “They’ll have quick comparisons between estimated arrival times for the different modes of transport, as well as fares they can expect to pay, which will help save both time and money,” he added.
Taxify rides in Google Maps are rolling out globally today and will be available in more than 15 countries, with South Africa being one of the first countries to benefit from this convenient service.