USB Type-C in Virgin Lounge

[hossein_au]

Great to see this...but there is of course a security risk plugging your device directly into a USB port that you know nothing about. Much safer using your own power brick.

That is EXACTLY what I was thinking. I never plug my phone into any USB port I am not sure about. Those who do, are either not very IT literate or have no idea how a collection of seemingly benign data can become very potent intel indeed.

 

[CPMaverick]

I think that the odds of someone hacking a USB-C port in the VA lounge is pretty low. But there are charging cables with no data wires in them if you want to be 100% safe.

 

[moa999]

But there are charging cables with no data wires in them if you want to be 100% safe.

And certainly my Android requires me to authorise anything more than charging

 

[hossein_au]

I think that the odds of someone hacking a USB-C port in the VA lounge is pretty low. But there are charging cables with no data wires in them if you want to be 100% safe.

Odds might be low, but it is there. If I were to target a particular section of society, patrons of airline lounges could be a decent target: (I know I am over-generalising here) usually white-collar, more than average income, etc... I would target CL first, then business lounges, and if I had time I would target Qantas club as well.

Manufacturer of those USB chargers would be a very lucrative targets for anyone who may want to cast a wide net (pun intended). Imagine getting into mobile phones and laptops of 10% of people visiting Chairman Lounges and The Lounge...

 

[hossein_au]

And certainly my Android requires me to authorise anything more than charging

Never rely of those... anything that requires software to operate can be hacked. Do you think the light on your laptop's camera HAS TO be on when the camera is operating?

 

[CPMaverick]

Quite a conspiracy theory, requiring (more than one person) at the charger manufacturer to be in on the illegal activity, and many additional components installed in each charger (some way to both transmit the data out, and hack the phone security). All the while knowing that the entire master plan is easily bypassed by a cheap power-only cord. And knowing that decent IT person could tell that these chargers were

I'll take my chances.

 

[hossein_au]

Quite a conspiracy theory, requiring (more than one person) at the charger manufacturer to be in on the illegal activity, and many additional components installed in each charger (some way to both transmit the data out, and hack the phone security). All the while knowing that the entire master plan is easily bypassed by a cheap power-only cord.

I'll take my chances.

Of course. As long as you make an informed decision. I am not a fascist when it comes to IT security. It is all a matter of weighing risks versus rewards, and deciding what level of risk one is happy to take.

 

[CPMaverick]

That's very different than saying this:

Those who do, are either not very IT literate or have no idea

 

[Pleb Status]

I assume that the 'IT literate' here never use a lounge WiFi connection. And, if they must use one in an emergency, I also assume they religiously use a highly encrypted VPN connection...

 

[Daver6]

The risk is probably low, but would be naive to assume none. There are always flaws and vulnerabilities being found every day. A bad actor could enter the lounge and quite easily tamper with the charging point. It could exploit zero day vulnerabilities. They do exist.

 

[hossein_au]

I assume that the 'IT literate' here never use a lounge WiFi connection. And, if they must use one in an emergency, I also assume they religiously use a highly encrypted VPN connection...

Yep; 4 sure!

 

[CPMaverick]

A bad actor could enter the lounge and quite easily tamper with the charging point.

I'm skeptical, so inform me. How does one 'easily' tamper with an integrated charging point in the VA lounge, so that you can successfully do some damage to and/or infiltrate a device?

Remember, first you have to find a seat near a charging point

 

[atreides]

Awesome, well done VA

 

[Deleted member 29185]

The whole USB-C bit is still a bit annoying (sort of). I left my HP spectre charger (a brick with USB-C terminated output lead) at home, but I have recently added a Huawei P20 to my collection of electronic necessities, which has a typical lower current phone charger with USB-C lead. Great I thought, I should be able to charge the HP via the Huawei charger but obviously take considerably longer to do it. My reasoning is that USB-C is a standard format with standard voltage and charging pin configuration and the only difference between the two should logically only be the current capability. Essentially the difference between a bulk battery charger and a trickle charger. Unfortunately, not even the charging LED lit on the HP, so there is obviously some protection circuit in either the Huawei charger or the HP (probably the HP) to prevent trickle charging.

I was fairly peeved off by that as I can see no logical or technical reason to prevent the USB-C being used in that way and I put it down purely to Apple style commercial protectionism (probably by HP) to the detriment of the customer. Why have wide ranging standard technology and then place restrictions on it for commercial gain? Does anyone know of any real reason to prevent what I tried to do? I doubt very much the Huawei charger has overcurrent protection that is instantaneous. Perhaps at best, a simple thermal cut out to protect against overheating, but that would not be an instantaneous device.

 

[Daver6]

I'm skeptical, so inform me. How does one 'easily' tamper with an integrated charging point in the VA lounge, so that you can successfully do some damage to and/or infiltrate a device?

Remember, first you have to find a seat near a charging point

Well, your last point is the safety net really

Easily, in terms of someone (read state sponsored) could open it up and add a device in the middle. I've not seen them. I'm no expert on how to do it. I do know enough to know it can be done.

The point is, to assume there is zero risk in using such charging points in any location would be naive. That is all I'm saying here.

 

[jetset]

... I left my HP spectre charger (a brick with USB-C terminated output lead) at home, but I have recently added a Huawei P20 to my collection of electronic necessities, which has a typical lower current phone charger with USB-C lead. Great I thought, I should be able to charge the HP via the Huawei charger but obviously take considerably longer to do it. My reasoning is that USB-C is a standard format with standard voltage and charging pin configuration and the only difference between the two should logically only be the current capability. ... Unfortunately, not even the charging LED lit on the HP, so there is obviously some protection circuit in either the Huawei charger or the HP (probably the HP) to prevent trickle charging.

I was fairly peeved off by that as I can see no logical or technical reason to prevent the USB-C being used in that way and I put it down purely to ... commercial protectionism (probably by HP) ...

HP is a special case. HP had locked down their USB-C charging points to only support their own chargers, although some testing last year was more promising. Essentially they've implemented some sort of charging DRM claiming necessity due to device 'safety'.

Bear in mind however that USB-PD does not have a 'standard' voltage. Instead there are four voltages that can be used - 5v/9v/15v/20v. Smaller phone chargers tend to only support lower voltages (e.g. 5v, sometimes 9v) whereas laptops tend to run at either 15v or 20v. Some laptops may trickle charge at a lower voltage but this varies widely by laptop. For instance Apples Macbook's and MBP are pretty flexible and will trickle charge from as low as 5v. They will even charge from an old style Type-A phone charger (lol).

In regards to the theoretical security concerns raised above, this is completely unchanged irrespective of Type A or Type C port. If you don't trust Virgins ports, bring your A/C adapter. And your VPN. And your 4G dongle.

 

[Deleted member 29185]

HP is a special case. HP had locked down their USB-C charging points to only support their own chargers, although some testing last year was more promising. Essentially they've implemented some sort of charging DRM claiming necessity due to device 'safety'.

Bear in mind however that USB-PD does not have a 'standard' voltage. Instead there are four voltages that can be used - 5v/9v/15v/20v. Smaller phone chargers tend to only support lower voltages (e.g. 5v, sometimes 9v) whereas laptops tend to run at either 15v or 20v. Some laptops may trickle charge at a lower voltage but this varies widely by laptop. For instance Apples Macbook's and MBP are pretty flexible and will trickle charge from as low as 5v. They will even charge from an old style Type-A phone charger (lol).

I suspected it was HP as I have had past problems with USB-C multi-adapters talking nicely to the HP and is a reason why I will not buy a HP again (one reason, the fact HP are A-Holes also plays into my decision).

So for USB-C to support multiple voltages and yet be universal, do they use difference contacts? I was of the impression the different contact usage was simply to enable paralleled outputs for higher currents, not different voltages. I'm struggling to understand how they can claim to be the all-round universal solution if different manufacturers are putting different voltages onto the same contacts yet they don't appear to have enough contacts to provide for the different voltages you mention?

EDIT - I just checked the pin out config for USB-C and there are more pins than I thought, however to get the reversibility, I'm thinking many of those are paralleled from either end ... but I'm not sure.

 

[jetset]

I suspected it was HP as I have had past problems with USB-C multi-adapters talking nicely to the HP and is a reason why I will not buy a HP again (one reason, the fact HP are A-Holes also plays into my decision).

So for USB-C to support multiple voltages and yet be universal, do they use difference contacts? I was of the impression the different contact usage was simply to enable paralleled outputs for higher currents, not different voltages. I'm struggling to understand how they can claim to be the all-round universal solution if different manufacturers are putting different voltages onto the same contacts yet they don't appear to have enough contacts to provide for the different voltages you mention?

The answer is USB-PD. The host and client intelligently communicate which voltages and current levels they support.The client can then select the voltage it requires. They use the same pins but due to the negotiation there should be no risk of electrical damage to the client or host.

The additional pins can be used for all manner of functions including USB 3, thunderbolt, video signals (alternate mode etc). The CC pins are used to detect orientation and also for power delivery negotiation.

 

[Deleted member 29185]

Many thanks for the explanation. So it is purely HP blocking a trickle charge. It would have been really handy for me over the past couple of weeks.