A USB attack named ChoiceJacking subverts protections on Android and iOS devices by using malicious chargers to silently access user data.
  • unexposedhazard@discuss.tchncs.deEnglish
    5·
    2 months ago

    Mobile OSes currently require user interaction to approve USB host connections (like file transfers or debugging), but they trust input devices and accessories by default. ChoiceJacking exploits this gap by emulating input devices to automate the approval process.

    Luckily it is easy to mitigate this attack in case you are a high risk user. Just disable connection of all USB gadgets in your system settings. (“Deny new USB gadgets” in the screenshot)

    For ease of use, most phones come with the weakest setting as a default that allows all new USB gadgets (keyboards, mice, audio adapters, etc) even if the device is locked.

    I have it set to the medium setting (seen below), where as long as you dont plug it into an adversaries device while the phone is unlocked you are safe. With this setting you will have to only ever use your own charging devices that you know can be trusted. You should generally never connect your phone to any USB ports that you dont own. This should be common knowledge, but sadly it isnt. The only “downside” to this is that you have to unlock your phone before plugging in stuff like a USB to 3.5mm audio adapter.

    This option can be found under Settings > Security & Privacy > More security & privacy > Restrict USB