World getting more complex - CERT security vulnerability in a battery charger

[sidney]

Who woulda thunk it? CERT announces a security vulnerability in a battery charger. Well, at least it is a USB battery charger and it is yet another Windows vulnerability.

Energizer DUO USB battery charger software allows unauthorized remote system access (http://www.kb.cert.org/vuls/id/154421)

[Jeff]

Who woulda thunk it? CERT announces a security vulnerability in a battery charger. Well, at least it is a USB battery charger and it is yet another Windows vulnerability.

Energizer DUO USB battery charger software allows unauthorized remote system access (http://www.kb.cert.org/vuls/id/154421)

There's enough power behind a USB port to charge a battery? gawdallmidget!

[sidney]

There's enough power behind a USB port to charge a battery? gawdallmidget!

Slowly. A USB port is spec'd to provide up to 500 mA to a connected device, 400 mA in all to an external USB hub. That would take about four or five hours to fully charge one dead 2000mAH NiMH AA battery.

There is a spec that came out last year for USB charging that requires a USB port that is designed to power chargers to provide 1.5A, and allows a manufacturer to let it provide more than that. The charger spec allows for backwards compatibility, so plugging a compliant charger into an older USB 2.0 port would work, just limited to 500 mA.

[Jeff]

Slowly. A USB port is spec'd to provide up to 500 mA to a connected device, 400 mA in all to an external USB hub. That would take about four or five hours to fully charge one dead 2000mAH NiMH AA battery.

There is a spec that came out last year for USB charging that requires a USB port that is designed to power chargers to provide 1.5A, and allows a manufacturer to let it provide more than that. The charger spec allows for backwards compatibility, so plugging a compliant charger into an older USB 2.0 port would work, just limited to 500 mA.

Ok. Why? To what purpose? With wall power you don't need it, and with laptop battery power you're robbing one to charge the other. And in either case real already fully charged AA's are available everywhere on the planet. This was a spec engineer with too much time on his hands?

[sidney]

Ok. Why? To what purpose?

The purpose for the spec or the purpose for the battery charger?

For the spec, consider an ipod, for example. You connect it to your computer's USB port to copy files to it and to charge it up. It doesn't need a separate power port or a separate power adaptor, reducing size, cost, and complexity.

The ipod could be designed this way because USB is spec'd such that a port provides power to a device.

After USB powered devices with rechargeable batteries became popular, manufacturers came out with USB chargers, which are AC adaptors with a USB compatible socket that provides power without a data connection, so you can charge up your ipod or similar device without plugging it in to your computer.

The USB 2.0 standard contains specifications for currents, voltages, socket and plug sizes, etc., that devices must meet in order to be certified as compatible USB 2.0 devices. The standard was expanded to add a category for USB 2.0 charging-only ports and USB 2.0 data ports with charging capabilities, that specifies somewhat higher current capabilities, specifies some required behavior and limits for USB devices that contain rechargeable batteries, and also specifies behavior of the device and the charging port when, for example, a device with a dead or missing rechargeable battery is plugged into the port.

As for why you would want a USB powered battery charger when you have a wall socket sitting next to you anywhere that you have a USB port on a computer and you aren't running the computer off of its own battery? I dunno, but I guess people who buy the chargers have their reasons :)

[ndebord]

Who woulda thunk it? CERT announces a security vulnerability in a battery charger. Well, at least it is a USB battery charger and it is yet another Windows vulnerability.

Energizer DUO USB battery charger software allows unauthorized remote system access (http://www.kb.cert.org/vuls/id/154421)

Sidney,

Saw that one! <VBG>

Or you could be driving a Toyota (we swear, it's not the fly by wire steering, gas or brakes). (I drive a Toyota Corolla, but its 2003, good old-fashioned mechanical linkage everywhere.)

[Judy G. Russell]

Who woulda thunk it? CERT announces a security vulnerability in a battery charger.Good. Grief. That's ridiculous. What next? Radio waves causing Windows to blue screen???

[Mike]

Good. Grief. That's ridiculous. What next? Radio waves causing Windows to blue screen???
You mean you haven't experienced this yet?

[Judy G. Russell]

You mean you haven't experienced this yet?Ulp...