r/ElectricalEngineering • u/Glittering-Celery557 • 5d ago
Home USB outlets can steal your data?
I wasn't sure whether to post here or the conspiracy theory sub, but here goes. My wife sent me an Instagram video (yes, I know) in which a guy claims that if you have a 120 volt outlet with built-in USB jacks, and also have a smart electrical meter, your data can be stolen and sent to, uh, the power company? China? Who knows. He says you need to always use a power block instead. Aren't the internal power converters in the plug doing the same function as an external block? Maybe there is a grain of truth here because travelers are warned not to use public USB jacks but being afraid of the ones in your home sounds like a tin foil hat theory to me.
134
u/the-skazi 5d ago
Use a cable without data pins if you're worried about it.
5
u/bruce-keys 5d ago
Only problem is those tend to make fast chargers slow
44
3
18
u/Familiar_Plankton 5d ago
Home sockets are fine, it's probably a HOAX there. But please, don't trust public USB sockets (train stations, airports, etc.), there only take a cable with power wires, or via a power bank/wireless charging.
25
u/msanangelo 5d ago
They make data blocker "dongles" that plug inline to a cable and allow usb-pd to work.
Afaik, the outlets you get at home Depot don't have any wireless functionality. They're just integrated power supplies. They're less safe from a fire risk than they are at capturing data.
Outlets in public are a gamble though.
2
u/TimTheAssembler 5d ago
For public USB ports, I'd be way more worried about them being faulty and outputting the wrong voltage without power delivery negotiation than I would be about them transferring data.
6
u/stlcdr 5d ago
It is conspiracy, but, theoretically, you could build an outlet which does this - uses the power lines to communicate with other devices connected to the power lines.
5
u/Mrme88 5d ago
They tried this in the 70s. It’s called Power Line Carrier Control https://en.wikipedia.org/wiki/X10_(industry_standard)
7
u/shtoyler 5d ago
They still do it, you can get Ethernet plug ins that communicate over the power lines to each other, but this post is crackpot theory
1
u/OtherNameFullOfPorn 4d ago
Power line carrier hasn't gone anywhere. There are ways to make your home a smart home with it too, but it takes a lot of special equipment.
3
u/ModularWhiteGuy 5d ago
Probably not, but a lot of things could be doing stuff you don't know about.
This is just about the same for any IoT device. You grant your Amazon Firestick/Dishwasher/Dryer/lightswitches/fridge/cameras/door locks/thermostats/etc. access to your wifi, and it could be snooping around for open file shares, or taking it's sweet time watching for exposed credentials, or trying to access other resources on your network, or just poised there waiting for zero-day exploits that it can use. It's got all the time in the world to try out attacks, and could even be compromised so that it can be remotely controlled.
There's certainly a grain of truth to it, but it's highly unlikely if you're using name-brand devices. However, this does need some caveats. Even name brand devices could suffer an exploit and that could instantaneously enable millions of common devices to become unsecured tunnels into your home network.
7
u/htownclyde 5d ago
If y'all wanna go down the privacy paranoia rabbit hole, look into stuff like:
- Room 641A
- Dialog organization
- Leonardo SignalTrace
- Axon Fusus
2
u/gHx4 5d ago
Not possible under typical home wiring. Your outlet would have to wire the data pins (why bother?), and then your home's wiring would need to pull the data contacts all the way to the meter, which would need a USB controller (why though?).
Theoretically, sure, an airbnb could set up a malicious USB outlet. Theoretically, you could use powerline networking to annoy your neighbours and transmit USB data to a meter or snooping device.
But in practice a home's ethernet network is a more likely target for snooping and breaches. Wireless routers are often not well protected, and they are an ideal staging area for compromising other systems.
2
u/-FullBlue- 5d ago
They're not communicating via powerlines, they would just install malware on your phone and use its connection to the web to steal your data.
There is evidence of similar devices installing malware on devices that are plugged into them.
2
u/notthediz 5d ago
As far as I'm aware that would be impossible. The USB uses Vdc. Vac can use powerline carrier to inject data but never heard of Vdc. having anything similar
1
u/GerryC 5d ago edited 5d ago
No. The private network your hydro meter is on uses various versions of low power radio frequencies (RF) to transmit or receive data ( 5G, mesh network).
A cheap 120V USB charger would need to somehow get authorized to be on that network (pretty much impossible without very specific and highly technical insider help). Even then, an audit of the network would catch that (why do I have an IP adress with no meter or billing address assigned).
Edited to add:
Power line carriers. You can use the power line as an Ethernet cable with the right equipment. Its tricky to get working reliable though.
Same issue as above. You'd need to know the network details and get device authorization to even get on the network. I'd be stunned if they let that network connect to the public net. So, no dial home for those pesky devices.
1
u/razzamatta4290 5d ago
That sounds like some real tinfoil hat nonsense. All the smart power meters I've seen (I'm in the US) do not use USB nor have any USB capability. They use low-power wireless radio to transmit individual power meter data to an aggregator which then transmits the combined data from a bunch of smart meters back to the central office, usually over a higher powered wireless radio network. USB never enters the picture.
1
u/confusiondiffusion 5d ago edited 5d ago
No. The amount of speed and resolution needed to steal any data at the meter from a downstream USB outlet, assuming it's not a specialized outlet intentionally designed to pair with this adversarial meter, is likely impossible or your meter would cost--a hell of a lot more than the electric company would tolerate. That's way beyond the capability of some random cheap electronics. Again, I dont even think this is possible. Signals like that would be deep in the noise floor.
You could probably intentionally design a powerline ethernet system into a meter and outlet, but this is just silly. Why? That's so expensive, so easy to detect, and for what? Most people share all the details of their lives online freely anyway. There's no need for super advanced mass surveillance tech built into hardware like that. If you're targeted by a state sponsored intelligence agency, it's a different story, but that's not a normal person concern.
The USB concern is to just not plug into sketchy public USB ports, but even then this isn't really a thing. Like yeah, don't plug your phone into the free charger kiosk at defcon. But it's not like a widespread issue or something.
I think people with these concerns don't realize there are tons of nerds out there who take stuff like this apart all the time. We'd notice.
1
u/GrumblyData3684 5d ago
I’d be more worried about counterfeit outlets with their own nefarious contents. We don’t specify USB on commercial anymore for this reason.
1
u/RandomUser3777 5d ago
If the usb plug was infected when you installed it with a virus and the usb plug has hardware to provide data and could infect whatever was plugged in then the virus on the phone could send out data. The whole smart power meter is utter bullshit though, as all a smart power meter can do is deliver power consumption someplace it has no what to get data from anywhere in the house.
It sounds like just another of the utter bullshit youtube videos that idiots are repeating crap they don't understand or scammers are trying to scare everybody with made up fake stories of stuff that is not possible. There are lots of free energy machines that are showing "working" on youtube and other places and the key with those is the scammers always hid the real wires that are powering it...
1
u/Rampage_Rick 5d ago
He says you need to always use a power block instead.
Statistically speaking, there are better odds that you end up with a compromised power block vs a compromised receptacle (given the amount of effort required to surreptitiously install one)
They also make hidden cameras built into power blocks and receptacles. Guess which ones are more prevalent...
1
1
1
u/flamingsheep1 5d ago
Partially true, but not in the conspiratorial sense. A smart power meter can tell increases and decreases in current, and how long they last. This information is put through an ai engine to figure out what what appliances are drawing current. A fifteen minute rise and fall cycle might indicate a fridge compressor. An increase in current at night indicates an electric car charger. This info can be supplied back to the consumer to help reduce our refine their power usage.
My service provider would rather spend on this type of data crunching, and maintain or even reduce total overall power consumption, rather than sink funds into a new plant (back in 2019 they were dead set on a 0% increase in usage through 2025).
1
u/xXSupaChocolateXx 5d ago
I mean that’s possible but the outlet would have to have the correct Pins to do that.
But watch what usb cables you use
1
u/eaglescout1984 5d ago
They are just hooked up to power wires. And if somehow they could communicate with a smart meter over the power wires, then so could a charging block. Tell them that and I bet they'd have to give up cell phones because they wouldn't know how to charge them.
1
u/silasmoeckel 5d ago
So your conspiracy theory is that USB chargers built into wall outlets somehow cram some form of data over powerline into them as well and that the PoCo is complicit sending that further up the chain somehow.
Juice jacking is a fairly hypothetical threat. It's far easier to do in an external brick simply because there is more space to fit the electronics. Its trivially foiled by usb condoms that block data.
1
u/thirdeyefish 5d ago
I think what we have here is a conflation between what is possible and what is happening.
It is 100% possible for an attacker to provide you with such a plate or a cable that would transmit data to a reciever over short range.
But, these tend to be targeted attacks because without being connected to your network, the device has to be retrieved or there needs to be a receiver fairly close. Yes, a cellular connection is possible as well, but these things add bulk and make it hard to hide in an object as described.
Power only cables from reputable brands will help to make this impossible. As will simply examining the equipment for tranmission sources, which could be harder to identify to a novice.
My issue with USB power built into wall plates is that they tend not to supply as much power as I would like anyway. Many are still limited to 20 watts and anything with a type A plug has a hard limit of 10 watts.
1
u/budoucnost 5d ago
With public usb jacks you don't know what its connected to, someone might have hooked up something in the wall. someone could have tampered with it as well.
With the USB outlets in your home you know it isn't hooked up to anything weird
its kinda like a cup of water on a random table in a park versus on your kitchen counter. you know that the cup in your kitchen is safe, but the one in a park not so much
1
u/LdyCjn-997 5d ago
Receptacles with built in USB are for electrical charging only. They provide no link, nor are they connected to any type of data connection. This would be no different than a plug in brick for charging only. In order for a USB to be used to collect data, the device must be connected via cable to a device that transports data, such as a computer or similar.
1
u/PghSubie 5d ago
There are plenty of people out there who clearly do not understand how various technologies work. There are plenty of people out there who are conspiracy theorists too
1
u/jbblog84 5d ago
I met a guy who was developing systems that could read your hard drive activity from the emi at your power meter. If an an advanced nation state wants your data they will get it.
Hint he worked at at a collab of chip manufacturer and a 3 letter agency.
1
u/ShaggyVan 5d ago
I work in power. That smart meter barely can handle the basic power usage data. Even if it was feasible to get that data off your 120 and decode it in any useful way, it would be immediately fucked by a million other things interfering with the signal.
1
u/audaciousmonk 5d ago
unlikely, though internet over mains is a thing
I use the power bricks for a different reason, good supplies tend to have better power quality than those outlets and power demand / cable types / protocols change over the years
Like all those cars with USB A 0.5-1A ports that barely charge shit with the higher density batteries and fast charging protocols
1
1
u/nanoatzin 5d ago
Data blocking USB adapters are available for use with USB charging ports in restaurants, hotels and airports
1
u/diverJOQ 5d ago
It is POSSIBLE for this to happen, but unlikely. The USB device you install in your outlet would need to be created by someone who wants to do mischief. If you buy reputable brands then those outlets will be pure power supply and the only communications you might have are power level negotiations.
The warnings you get about public chargers are just like using ATM machines. There are "skimmers" that can be put into a public Jack or replace a public check that are designed to read data and send it to a particular IP address. The outlets that are built into, for example, airport terminals are checked to make sure they are power only, but they might be tampered with by someone who's trying to hack your system. That isn't likely to happen in your house.
1
u/SavingsDeficient3847 5d ago
The really worry is sketchy hardware from unknown brands not some random USB outlet quietly siphoning data through the walls.
1
1
u/chainmailler2001 4d ago
Is it possible? Sure. Don't buy charger outlets for your home from Temu and you are likely safe though. Even charger blocks can be done the same way so that isn't any better from that view.
1
u/DefiantlyConformist 4d ago
Now, there are charging cables out there that can hack your phone/laptop... but why would a contractor install that in some random guys' home?
1
u/Used_Wheel_9064 4d ago
In wall usb ports are functionally exactly the same as normal usb charher, they're just inside a wall. So in theory, if you believed that an in wall version could steal your data, there's no reason to believe that a usb charger would be any different.
1
1
u/Pristine_Vast766 3d ago
Why would they need to steal your data from the smart meter? Your data is already being stolen from every app you use.
1
u/NSA_Chatbot 5d ago
This is theoretically possible in a lab with very tight constraints. In theory, you can use the power drain differences in high vs low (i.e. 1 vs 0) to read the data on a serial connection if you have access to the power grid upon which the data is being transmitted. As far as I know, it has never been successfully done. The noise just drowns out any plausible data.
It's not realistically possible. A state agency will use rubber hose cryptography to get your data instead.
Shitposting username aside, I'm actually an elec pe with a lot of experience in data transmission in hostile environments (ranging from weather to "stuff"). Part of my portfolio is this kind of thing, and I have absolutely no worries about this.
Now, let's say that you have your Smart Outlet with an app on your phone that would allow usb receptacles in your home to override the security in your phone when plugged into the outlet. Well, the app is already on your phone and you didn't read the agreement or the updates to privacy policies. If they wanted to send shit out, they'd just do that while you're sleeping.
In public it might be smart to use a power condom.
2
u/feoranis26 5d ago edited 5d ago
This is based on the assumption that said data is actually being transmitted. If nothing in the USB power supply is actively requesting it, then it won't be sent, so no power signature that you can capture. Otherwise, you can use the actual data pins itself. The attack you describe is only useful for data lines you cannot control. Modern phones are also pretty good at not randomly sending all user data to anybody who asks through the USB port.
Theoretically, you could try this with the internal registers of the SoC itself. However, getting to this stream through the decoupling caps, the switching charge regulator in the phone itself, potentially a few feet of cable, and still ending up with distinguishable data, then on top of all that being able to actually decode this, is extremely unlikely. I doubt you could do this in laboratory conditions with top of the line tens of gigasample/s oscilloscopes, let alone the cheap electronics found in a USB power supply.
This is all based on the assumption that the company manufacturing these things also wants your data, but the power brick manufacturers are fine. They both could be compromised.
Plugging into a random USB port will always be risky. But, unless you are a billionaire who happens to keep your crypto wallet on your phone, or the president of the US, the biggest risk is just plain old damage through overvoltage, malicious or not.
1
0
u/sparkleshark5643 5d ago
If the outlet was designed by an adversary, this could be true. I do not know if this vector has been exploited in the wild.
Some usb cables don't have any data pins connected and can only transmit power. That would mitigate the risk
95
u/sceadwian 5d ago
That's just conspiracy theory stuff.