Can computer virus be spread through a power bank?

August 2, 2022 8:37 AM

I have a power bank that is used for charging electronics, like cellphones and laptops. I use it because my phone is old and the battery drains fast. One month ago, I lent it to someone whom I did not know well. Right now, I'm too afraid to use it because I think their phone might have a virus and I don't know how power banks and computer viruses work, so maybe the power bank has the virus and will spread it to my phone if I plug it in. More specifics below ...

I'm asking if a power bank can get and spread computer viruses because its a really nice power bank, my mum gave it to me and it has a lot of sentimental (and actual) value, so I don't want to throw it away. And I don't want to plug my phone into it and see what happens because its a very nice phone and I use it for everything.

I tried googling it and got nothing relevant. I think it might require some special-ist knowledge of computers.

posted by Didnt_do_enough to Computers & Internet (17 answers total)

It's *technically* possible, but exceedingly unlikely. (think "technically possible" in the same way as "technically there's nothing stopping a bear from learning to tap-dance, but your odds of meeting one in a forest are low")

I wouldn't be concerned about the possibility, myself.
posted by CrystalDave at 8:41 AM on August 2, 2022 [9 favorites]

I also think it's unlikely but also,consider that USB cables carry both power and data, but you only need the power parts to charge from a power bank. You can buy power only USB cables, these can not transmit viruses etc and are good to have for plugging phones into unknown sources to charge them
posted by RustyBrooks at 8:49 AM on August 2, 2022 [6 favorites]

Yeah, "technically possible" in the sense of a malicious actor disassembling your power bank, installing some weird custom electronics and then returning it to you.

I would 100% use the power bank.

Now, something I don't do, is charge my phone from random people's computers.
posted by gregr at 8:50 AM on August 2, 2022 [10 favorites]

This is not anything you need to worry about.
posted by jonathanhughes at 8:51 AM on August 2, 2022 [2 favorites]

Best answer: I am an information technology professional with responsibilities that include national networking infrastructure and I would be fine with using the power bank. Having said that - if you'd like additional peace of mind, there are power-only adaptors that just don't have the data transfer pins connected. Example. This can be useful if you want to use other, untrusted charge points.
posted by buxtonbluecat at 8:53 AM on August 2, 2022 [12 favorites]

Power does not transmit viruses. The data connection part of a USB cable could transmit a virus, but the virus would need to be stored somewhere - there would need to be a computing device inside the power bank itself to become infected, in order for the virus to stay in the power bank after your friend unplugged their phone.
posted by Lady Li at 8:55 AM on August 2, 2022 [1 favorite]

As others have said - it'd be possible to have a power bank that could transmit a virus but it's very unlikely.

Also - iOS and I think Android will pop up a dialog when plugging into anything transmitting data that will ask if you want to trust the device. I'd expect that - unless you have a really rare, zero day or state-level exploit, any device that was capable of transmitting data to the phone would trigger that.

I'd use the power bank. As others have said, if you want to practice really good safety hygiene, you can buy power cables that don't transmit data.

The avenues you really need to worry about are message attachments, untrusted wireless networks (e.g., connecting to a public hotspot), bluetooth, and downloads. Also malicious apps -- be very careful about "sideloading" apps onto Android if you're not really certain about the provenance of the application and any third-party app store you might consider using.
posted by jzb at 9:50 AM on August 2, 2022 [2 favorites]

What's been posted above seems entirely correct, to pull off the kind of trickery you're concerned about is basically spycraft. Since I don't know much about you, I'll only add that if you have reason to believe that someone would have reason to install viruses on you personally: that is, if you are an investigative journalist, or you have a stalker ex, or you're someone who organizes political protests, or someone who accesses valuable corporate/financial information using your cellphone and laptop, then I would think twice about reusing the power bank.

For example, my cousin works for a bank, and when he was doing international travel before the pandemic, his bank flat-out refused to let him carry his work laptop or his work cell phone on the trip. He was issued brand new equipment before he flew out, and as soon as he returned the equipment was collected before he could even have an opportunity to connect to the company intraweb. When he came back from a trip to China, he was told that the laptop would be essentially "tossed into a shredder" because it was taken for granted that undetectable spyware had been installed.
posted by The Pluto Gangsta at 9:54 AM on August 2, 2022 [3 favorites]

There were reports of people getting malware from airport charging stations, so your concern is well-founded. But, they were purpose-built devices, and the power bank would not likely have enough computing resources or know-how to receive and transmit a virus.
posted by theora55 at 9:55 AM on August 2, 2022 [2 favorites]

What people are telling you is that the cable and port you use to charge your phone carry data as well as power. This could be considered efficient design, or bad security or both. Humans eat and breathe through the same tube, which is terrible design and can cause all kinds of issues. Phones charge and receive data through the same tube, which is usually fine but in very limited circumstances can also cause issues.

If you want to be paranoid/smart you can buy one of these for six bucks and stick it in your bag. Whenever you plug in your phone to charge off something you're at all unsure about, just put that on the end of the cable. It physically blocks the data part and only lets the power through. Your phone doesn't want lunch. It just wants to breathe. This little guy is a . . . tracheotomy, I guess?

Your power bank is almost certainly fine, but I carry one of these for airport charging jacks and the like. Why not?
posted by The Bellman at 10:01 AM on August 2, 2022 [5 favorites]

If you once heard about USB devices infecting things you were probably hearing about “Bad USB”: Bad USB (what it is and how to protect against it).

This requires that the USB device either be
a) purpose built by badguys (or physically modified)
b) have accessible firmware for the BAD USB to infect and take control of. That means the firmware of the type found on USB memory sticks, there is no similar firmware that is accessible over the power cable of your USB battery.

So, unless you have reason to believe that your friend or that you personally are being targeted by nation-state actors, there’s no way that your battery pack could be effected by this. Even a more then usually paranoid person would be fine using this battery pack. If you work for the NY Times, the CIA, or Amnesty International then you already know the answer and shouldn’t be using ANY USB device without a USB condom that you know to be good.
posted by tiamat at 10:10 AM on August 2, 2022 [5 favorites]

If you reasonably believe you are the target of nation-state level surveillance, I would toss the power bank. Otherwise, it's fine.
posted by so fucking future at 10:46 AM on August 2, 2022

You do not need to be worried about this. It is possible for USB devices to spread malware, but those are typically only used in extremely targeted attacks (see Stuxnet, etc), because other vectors of attack are much, much easier to exploit.

BTW, data-only USB cables that people here are recommending do not really work with USB-C, since that fundamentally requires negotiation (thus data transfer) of charge rate between the devices. You can use a USB condom type device on the USB-A side of a USB A-to-C cable, but it will likely make charging much slower.
posted by wesleyac at 10:48 AM on August 2, 2022 [4 favorites]

Power pins do not transmit data, but virtually anything you connect with data pins can be programmed to transmit data, including malicious payloads like viruses or spyware.

However, unless there is motivation for a state-level actor or a company assisted by a state to eavesdrop on you, it is highly unlikely your power bank has had its firmware programmed to crack your devices upon connection.

Unless you are a journalist or free-speech activist whose activities interest the security apparatus of a fascist state, you are safe.
posted by They sucked his brains out! at 10:48 AM on August 2, 2022 [1 favorite]

No. An advanced attacker such as the NSA could make something that looks like a power brick that could potentially infect phones that were plugged into it, but there is no mechanism with even the slightest plausibility that would allow a virus on a phone to infect a power bank and then cause it to affect other phones.
posted by Candleman at 10:54 AM on August 2, 2022

USB-C Power Delivery, as is commonly used in laptops and cell phones, requires the USB data line to negotiate voltage/current. If you use a device that removes the USB data lines (so that the USB plug is power only), you'll likely find that the power bank will not charge your laptop at all and may charge your cell phone extremely slowly.

As a professional involved in consumer product design, I am not worried at all about a USB power bank being used for malware transmission. It is certainly possible, but the level of effort to make that happen would be generally reserved for folks targeted by intelligence agencies. In that case, there are significantly simpler ways to extract information - like kidnapping or torture - that I'd be more worried about.
posted by saeculorum at 11:19 AM on August 2, 2022 [2 favorites]

If you are really concerned, there are things called "USB data blockers" that you can buy cheaply that will only allow power transmission without data.
posted by roaring beast at 7:45 PM on August 3, 2022