4

I realize that any .apk may not run on Windows via anything other than an emulator, but my instructor insists that it can. Here are my objections:

  • Can I infect the computers at school with my Android phone? Could a virus be coded to run on Android until a Windows system is detected, and then deploy a payload/exe to the Windows computer?

  • The USB ports are disabled. You cannot attach any storage medium and expect it to be detected by Windows. Disabled by some admin setting in Windows, not by BIOS.

  • My friend got berated for plugging his iPhone 5 in. Could it be coded to maliciously run on iOS until a Windows device is detected?

I keep my phone clean. I regularly run CCleaner, delete unused APKs, watch what I install, etc.

2
  • I have edited your post because it was of rather low quality. Please use [Shift] more generously, in particular capitalize Is. Names of software (Windows, Android) should start with a capital too. I have also pushed one of your objections to the end of a question because it wasn't really a question. Please read more about formatting. You can edit your post if you feel like I have removed something that was important. – gronostaj Dec 12 '14 at 19:40
  • 1
    The firmware of ANY USB device, provided the firmware can be modified, can indeed be modified in such a way the spread of malicious files could be possible. This is true for ANY operating system because of the way USB device identification works, its left up to the device to indicate to the operating system, what it is exactly. If an Android phone could be modified to look like a keyboard, the firmware in theory could then access the keyboard buffer on any operating system, the risks connected to that should be obvious. – Ramhound Dec 12 '14 at 20:02
3

Maybe.

The problem with computer security is that you can never be sure if something is secure. You can only tell when something is known to be insecure. When we say that something computer-related is secure, we mean that no security problems are known. (And of course everybody always says that their stuff is secure. It's not always true.)

Here are some real stories to give you some insight into what can be done with a USB:

  • WireLurker malware is a piece of OS X malware that infects connected iOS devices by downloading installed apps from the device, injecting malware into their code and pushing modified apps back to the device. This shows us that malware can infect another platform even though it's not capable of running directly on it.

  • Windows XP and older would automatically run any program from a USB mass storage device connected to it if it found an autorun file on that drive. You could literally run any program as administrator just by connecting a pendrive. So connecting an USB mass storage device can be dangerous.

  • There was a rather complex security issue that could be exploited to run any code on a PC running Ubuntu just by connecting a pendrive. It was far from obvious that such thing would happen: it involved exploiting non-uniform ASLR and a faulty pointer in font thumbnail generator program. The system was never designed to run code from external storage after connecting it. It was thought to be secure, but it turned out it wasn't.

  • Even "dumb" hardware can attempt to attack a PC it's connected to. A USB device can pretend to be a keyboard and start typing malicious commands, then execute them before you realize what's going on. You don't need any kind of storage.

Infecting a PC through a connected phone is rather unlikely, but not impossible.

If you just want to charge your phone, you can use so called USB condom. It's a pretty simple device that you plug in between your phone and the USB cable. It simply connects only two out of four USB wires: those that are used for charging. Data wires are left unconnected which effectively makes your phone unable to communicate with whatever is on the other end of the cable, but still able to draw power from it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.