USB Type-C Authentication Program Launched (newatlas.com)

With the arrival of USB-C a few years back, plugging into laptops, tablets and smartphones became even easier than before. But there are potential security risks. The USB Type-C Authentication Program launched today aims to address such issues. From a report: The new protocol from the USB Implementers Forum (USB-IF) can be used to validate the authenticity of a cable, charger or hardware at the moment of connection, and stop attacks in their tracks. The USB-IF has chosen DigiCert to operate registrations and certificate authority services for the new specification, which makes use of 128-bit cryptographic-based authentication for certificate format, digital signing, hash and random number generation.

"USB Type-C Authentication gives OEMs the opportunity to use certificates that enable host systems to confirm the authenticity of a USB device or USB charger, including such product aspects as the descriptors, capabilities and certification status," said DigiCert in a press release. "This protects against potential damage from non-compliant USB chargers and the risks from maliciously embedded hardware or software in devices attempting to exploit a USB connection."

Comments

Lovely.

[Anonymous Coward]

So this is going to enable Apple and their ilk to even more aggressively force people to buy their own craptastic cables.
Good intentions, but I know exactly how this will be used.

Mark my words, it will be used to oppress the user, not protect them.

Re:Lovely.

[DaMattster]

So this is going to enable Apple and their ilk to even more aggressively force people to buy their own craptastic cables. Good intentions, but I know exactly how this will be used.

Mark my words, it will be used to oppress the user, not protect them.

That will be the net effect. It's a stupid program designed to extort people for more of their hard earned money.

Authorized Devices Indeed

[Mia Yuuki]

I can see it now. I am sorry, the certificate on your charging cables does not match the approved list on the phone and thus you need to order a new charging cable from the vendor. Oh, and if you persist in trying to use the non-approved cable from Amazon, we will be forced to void your warranty. Remember kids, only use Vendor OEM USB Devices. Everyone else is just a crook.

Re:Authorized Devices Indeed

[Anonymous Coward]

Worse: "The certificate for your otherwise authorized power supply has now expired."

Re:Authorized Devices Indeed

[WankerWeasel]

To be fair, Amazon was selling a ton of cables that didn't meet the spec and were putting devices in danger of being legitimately damaged. Still, it'd doubtful they'll be able to prevent such junk on the platform as they still allow all kinds of counterfeit product for sale on their site. https://www.theguardian.com/te...

Re:Authorized Devices Indeed

[gmack]

This won't do anything to solve that problem since it was always an OS issue. You can just as easily install a keylogger on an approved device.

Re:Authorized Devices Indeed

[mysidia]

On the other hand it can be used to prevent that rogue USB flash drive you found on the parking lot from installing a key logger in your computer.

Not at all. That Rogue USB flash drive will still be able to contain installable malware. Nothing about the authentication standard changes that.

Re:Authorized Devices Indeed

[sexconker]

Devices were putting themselves in danger by not having basic electrical protection on the ports. In 90s, this was such a common (and commonly solved) problem that the Tawainese motherboard manufacturers listed all sorts of per-USB-port short, over voltage, over current, etc. protections on the box.

It became a problem again with USB 3 because the first players to the market with USB controllers didn't learn their lesson from the USB 1.0/1.1 days. There's absolutely no reason a bad USB cable should be able to kill an entire device. At worst, it should kill a single port. Ideally, it would have a replaceable/resettable fuse so you don't even lose the port.

Re:Authorized Devices Indeed

[TheRaven64]

There are two kinds of danger for USB devices. This is intended to protect against the first: that a cheap cable from SuperGoodHappyCablesCompany advertises that it's able to carry 40W but actually catches fire if you run more than 5W through it for an extended period. This can be addressed by adding some authentication to everything in the chain so that you can drop the power when things are not certified.

The second problem is that the firmware in the USB controller is typically buggy, as is the USB stack in the host OS. The highest-profile example of this was the Nintendo Switch, where they backed part of the USB stack for firmware updates into ROM and then discovered that it had an exploitable buffer overflow, but a number of attacks have been found on other USB controllers. A malicious device can exploit flaws in this firmware and often install persistent malware: the USB firmware is often running in SMM, so if you find an exploit in it then your malware is more privileged than the hypervisor (and can install EFI-based rootkits for persistence).

Adding more complexity to the USB firmware makes the second type of attack a lot more likely. Given how many people plug their devices into random USB sockets for charging, I expect that we'll see a lot more of this kind of attack in the wild (if I were the NSA, for example, I'd be installing USB chargers in the first class lounges at Dulles and taking copies of everything that foreign diplomats had on their phones / tablets).

Re:Authorized Devices Indeed

[AmiMoJo]

Yeah, those old USB protection circuits won't survive 20v/5A on the data lines. And even if they did, the cable catching fire would burn your house down anyway.

In fact there exist malicious devices that destroy USB ports precisely by applying very high voltages to the data lines of USB ports.

Also, it's even harder to protect USB 3.0 ports because they operate at higher speeds over many more lines. On USB 1.1 you had four wires to worry about, and a maximum frequency of 12MHz. On USB 3.0 with a USB-C connector you are looking at 24 lines and gigahertz speeds that require very careful board layout, far from ideal for adding protecting from 20V to. A simple diode is gonna screw up your signal at those speeds.

Oh it's worse than that.

[Anonymous Coward]

This just helps ensure that only authorized compromised cables can be used with your USB 3 device. It does NOTHING to ACTUALLY stop malicious cables being used to disable or destroy your device, since they can just take components from an authenticated cable to pass the handshake then use their own microcontroller or circuit to fry your hardware when it attempts to charge or connect over the cable.

This is all Apple was waiting for...

[FrankSchwab]

...to transition from Lightning to USB-C. They had to have a way to maintain their revenue from selling $20 cables, and licensing the ability to sell authorized cables. I don't know how many lightning cables I've thrown away because they worked for three months, then Apple updated IOS and blocked them.

Now I'll have to buy Apple USB-C cable, and HP USB-C cables, and Lenovo USB-C cables, and Nikon USB cables, and Microsoft USB cables. And, with OEMs promiscuously relabeling each others products, I'll never know which cable to use with which devices.

They've re-invented the RS-232 connection nightmares, but without the ability to carry a bag of dongles that might straighten things out. And so dies USB as the most successful cabling and protocol standard in technology history.

Re:This is all Apple was waiting for...

[DontBeAMoran]

Do you really think Apple will be the only one to abuse this DRM-inside-the-cable bullshit?

Re:This is all Apple was waiting for...

[Solandri]

The companies will do whatever the people allow them to get away with. If the people willingly buy products which require proprietary cables, they will design their devices to only work with (expensive) proprietary cables. If the people take a stand and refuse to buy any device with proprietary cables, manufacturers will use unlocked USB-C cables.

So ultimately, it still boils down to boycotting companies like Apple until they start behaving and making consumer-friendly products. You're assuming the mere presence of some Android devices which use proprietary cables makes it equal to Apple. It does not. All Android devices would need to use proprietary cables (thus preventing you from buying a non-proprietary option) before it became like Apple. In fact the presence of some Android devices using proprietary cables is necessary, so manufacturers can clearly see the people (hopefully) choosing non-proprietary devices, thus telling them that non-proprietary is the way to go.

Re:Why the cable?

[aaarrrgggh]

Conductor ampacity, resistance, and maximum voltage would be simple starting points.

I do agree that this has far more potential for vendor abuse that consumer protection. I bought my first portable USB-C device over the weekend (an iPad) and am really pissed off about the limitations imposed by the solution even today. My must-have travel charger kit went from a 6-port multi-output charger with dongles for micro-USB, Lightning, Apple Watch now needs a new cable, and potentially a new multi-output charger. I had finally gotten my charging crap down to a manageable mess, and now this.

It is rapidly approaching the point where I want to just abandon consumer electronics altogether. Went without my watch for a week because I forgot the charging cable... and was completely unwilling to purchase yet another one. It wasn't the end of the world.

USB Power Delivery

[tepples]

I'm not sure what you mean here. Do you mean that an adapter meeting the Battery Charging spec or its successor the Power Delivery spec is not a "USB charger"? Or do you just mean that the vast majority of power adapters on the market with a USB A or C receptacle materially fail to meet the spec?

Re:USB Power Delivery

[Pascoea]

For someone being as pedantic as you are, you could have at least used proper English. Improper use of a colon. Incomplete sentences. "Its" vs "It's", "a" vs. "an".

Re:We're all screwed

[omnichad]

I'd say locked bootloaders on laptops and routers and HDCP over HDMI all predate this by a wide degree.

Re:This protects additional revenue streams

[mysidia]

As for malicious attacks, no certificate is going to protect the port against a brute force "fry the port" chargers.

Malicious actors are likely going to find a way of cloning the certificate off a legitimate USB Host and simply re-using that identity.

I wonder what they will do in the EU though.

[Anonymous Coward]

Since here, there are laws requiring device makers to allow using any microUSB charger.
They specifically made a law to end this bullshit. Which is why Apple products include an adapter.
I would be surprised of the same legislators aren't already drafting laws to stop this too as we speak.

There are still a few non-fascists (aka non-neocons) in the EU dictatorship administration, it seems. Coprorations still haven't completely taken over.

Re:Why the cable?

[willy_me]

The USB Type-C standard already mandates an active cable if you want to utilize the full 5A that the standard can supply. It might not have information on the condition of the cable - but nothing can prevent users from being stupid. It is just another level of security which, with all the other protections, helps prevent damage when power traverses USB.

It is easy to add an IC to a USB connector - they are basically designed for it. See this part to see how it is typically done. So adding the ability to verify the cable does make sense for workplaces that require the security. It is just too easy to, for example, add a keylogger to a cable.

No computer manufacturers would ever get away with requiring authenticated cables. Apple might try but the public outcry would be immense. That being said - having it as a bios setting is exactly what a certain subset of users require.

Re:Why the cable?

[dgatwood]

Conductor ampacity, resistance, and maximum voltage would be simple starting points.

Do not want. Putting additional intelligence in cables just increases the odds of the cable failing because some unnecessary chip decides to stop working. And a couple of those don't even make sense:

• The maximum voltage for a USB cable is limited only by the distance between pins (arcing), which is defined by the shape and size of the connector itself, making that number entirely moot, barring something really bonkers.
• The resistance should be approximately zero (at least too small to easily measure). Otherwise, there's something very wrong with the cable.

What you really care about is how much current the cable can carry before the voltage starts to sag, which depends mainly on the conductor size. There's a very easy way to find that out without the cable needing to be smart: ramp up the current until the voltage sags beyond reasonable tolerances, then back off the current. This small amount of extra intelligence on the device end, purchased once, eliminates the need for extra intelligence on cables, which you buy dozens of.

Furthermore, the cable's notion of how much current it can carry is, in practice, completely useless. When a cable starts to fail, it usually fails slowly, with individual wire strands breaking. This can create a hot spot in the cable or connector that, when driven at full amperage, could potentially cause a fire. The cable has no way of determining whether such damage has occurred. But with proper voltage drop detection at the endpoints, properly designed hardware actually *can* detect that type of failure and reduce the amperage to a safe level.

Re:Why the cable?

[LynnwoodRooster]

Apple includes an MFI chip in authorized cables and their consumers took it willingly. I hope Android fans will stand fast against what Apple does...