Slashdot Mirror

← Back to Stories (view on slashdot.org)

USB Type-C Authentication Program Launched (newatlas.com)

Posted by msmash on from the bolstering-security dept.

With the arrival of USB-C a few years back, plugging into laptops, tablets and smartphones became even easier than before. But there are potential security risks. The USB Type-C Authentication Program launched today aims to address such issues. From a report: The new protocol from the USB Implementers Forum (USB-IF) can be used to validate the authenticity of a cable, charger or hardware at the moment of connection, and stop attacks in their tracks. The USB-IF has chosen DigiCert to operate registrations and certificate authority services for the new specification, which makes use of 128-bit cryptographic-based authentication for certificate format, digital signing, hash and random number generation.

"USB Type-C Authentication gives OEMs the opportunity to use certificates that enable host systems to confirm the authenticity of a USB device or USB charger, including such product aspects as the descriptors, capabilities and certification status," said DigiCert in a press release. "This protects against potential damage from non-compliant USB chargers and the risks from maliciously embedded hardware or software in devices attempting to exploit a USB connection."

11 of 133 comments (clear)

  1. Lovely. by Anonymous Coward · · Score: 5, Insightful

    So this is going to enable Apple and their ilk to even more aggressively force people to buy their own craptastic cables.
    Good intentions, but I know exactly how this will be used.

    Mark my words, it will be used to oppress the user, not protect them.

  2. Authorized Devices Indeed by Mia+Yuuki · · Score: 5, Insightful

    I can see it now. I am sorry, the certificate on your charging cables does not match the approved list on the phone and thus you need to order a new charging cable from the vendor. Oh, and if you persist in trying to use the non-approved cable from Amazon, we will be forced to void your warranty. Remember kids, only use Vendor OEM USB Devices. Everyone else is just a crook.

    1. Re:Authorized Devices Indeed by Anonymous Coward · · Score: 5, Insightful

      Worse: "The certificate for your otherwise authorized power supply has now expired."

    2. Re:Authorized Devices Indeed by WankerWeasel · · Score: 3, Interesting

      To be fair, Amazon was selling a ton of cables that didn't meet the spec and were putting devices in danger of being legitimately damaged. Still, it'd doubtful they'll be able to prevent such junk on the platform as they still allow all kinds of counterfeit product for sale on their site. https://www.theguardian.com/te...

    3. Re:Authorized Devices Indeed by mysidia · · Score: 4, Insightful

      On the other hand it can be used to prevent that rogue USB flash drive you found on the parking lot from installing a key logger in your computer.

      Not at all. That Rogue USB flash drive will still be able to contain installable malware. Nothing about the authentication standard changes that.

    4. Re:Authorized Devices Indeed by sexconker · · Score: 4, Insightful

      Devices were putting themselves in danger by not having basic electrical protection on the ports. In 90s, this was such a common (and commonly solved) problem that the Tawainese motherboard manufacturers listed all sorts of per-USB-port short, over voltage, over current, etc. protections on the box.

      It became a problem again with USB 3 because the first players to the market with USB controllers didn't learn their lesson from the USB 1.0/1.1 days. There's absolutely no reason a bad USB cable should be able to kill an entire device. At worst, it should kill a single port. Ideally, it would have a replaceable/resettable fuse so you don't even lose the port.

  3. Oh it's worse than that. by Anonymous Coward · · Score: 3, Interesting

    This just helps ensure that only authorized compromised cables can be used with your USB 3 device. It does NOTHING to ACTUALLY stop malicious cables being used to disable or destroy your device, since they can just take components from an authenticated cable to pass the handshake then use their own microcontroller or circuit to fry your hardware when it attempts to charge or connect over the cable.

  4. This is all Apple was waiting for... by FrankSchwab · · Score: 4, Interesting

    ...to transition from Lightning to USB-C. They had to have a way to maintain their revenue from selling $20 cables, and licensing the ability to sell authorized cables. I don't know how many lightning cables I've thrown away because they worked for three months, then Apple updated IOS and blocked them.

    Now I'll have to buy Apple USB-C cable, and HP USB-C cables, and Lenovo USB-C cables, and Nikon USB cables, and Microsoft USB cables. And, with OEMs promiscuously relabeling each others products, I'll never know which cable to use with which devices.

    They've re-invented the RS-232 connection nightmares, but without the ability to carry a bag of dongles that might straighten things out. And so dies USB as the most successful cabling and protocol standard in technology history.

    --
    And the worms ate into his brain.
    1. Re:This is all Apple was waiting for... by DontBeAMoran · · Score: 4, Interesting

      Do you really think Apple will be the only one to abuse this DRM-inside-the-cable bullshit?

      --
      #DeleteFacebook
  5. Re:This protects additional revenue streams by mysidia · · Score: 3, Insightful

    As for malicious attacks, no certificate is going to protect the port against a brute force "fry the port" chargers.

    Malicious actors are likely going to find a way of cloning the certificate off a legitimate USB Host and simply re-using that identity.

  6. Re:Why the cable? by willy_me · · Score: 3, Insightful

    The USB Type-C standard already mandates an active cable if you want to utilize the full 5A that the standard can supply. It might not have information on the condition of the cable - but nothing can prevent users from being stupid. It is just another level of security which, with all the other protections, helps prevent damage when power traverses USB.

    It is easy to add an IC to a USB connector - they are basically designed for it. See this part to see how it is typically done. So adding the ability to verify the cable does make sense for workplaces that require the security. It is just too easy to, for example, add a keylogger to a cable.

    No computer manufacturers would ever get away with requiring authenticated cables. Apple might try but the public outcry would be immense. That being said - having it as a bios setting is exactly what a certain subset of users require.