Yeah. It was pretty interesting to hear the details of pretending to be a HID device and how you could use it in practice to make malicious changes to the host computer. But surely adding to /etc/hosts is not the most preferred sneaky thing you can do with your unrestricted access.
I also own my computer. Doesn't hold me back to remove my user all admin rights.
If you still log in with admin rights, being hacked by a charging phone won't be the first bad thing happening to your system.
You would also get several prompts asking if you want to do this, both from Windows under UAC (by default, even if you can escalate), the Android driver, and the phone itself. It's rarely the case now that Windows users execute privileged actions without notification, but it's possible.
I don't want to discourage people testing ways to compromise security for the good of everyone, but this is a well known vector and a lot of jumps have to succeed to give the attacker value.
You can cut down a lot of room for failure by just using a rubber ducky USB instead. It doesnt have to be an Android phone. Even then, there's more than a few controls in the way.
No one pays attention to the prompts. If you've ever watched a standard computer user they click away a prompt as fast as it appears without even reading it.
So I understand better, could you explain the scenario where you would use this and what it would get you as the attacker?
Is it like: "Hey bud, please plug my phone into your computer." Then, they click through everything, you get privileged execution, and you choose to modify the hosts file?
You believe that would have a high chance of success? What do you get afterwards?
My account uses 2FA and my browser remembers my password. If I get a sign in prompt but my browser doesn’t / won’t auto fill my password, I assume it knows something I don’t and I’m immediately suspicious.
Your scenario is absolutely valid and would probably catch a lot of people who don’t think about security.
I only once got a real security notice from Google and this was several years ago, before Covid even. It simply stated that a (correct) login attempt was made, but from an IP address in China, and Google blocked this by default because it was "suspicious".
I changed all my passwords and have never had a problem since, but I agree with your scenario. There's ample stories of people even having 2FA set up and still getting locked out from their own accounts, although I suspect the grand majority of these cases are through social engineering rather than actual hacking.
That is awesome. Though since he could patch the firmware and they had custom encryption code, I would have patched that out to get unencrypted calls. Those his method allowed for stock operation.
netsec
Top