
Should you fear your USB cable? - Osiris
http://www.cnet.com/news/usb-type-c-cable-problems/
======
dingo_bat
I remember plugging in a damaged mouse into my old Win XP desktop and it
displayed a nice notification saying "Your device tried to draw too much
current and so the USB port has been disabled." I fail to understand how such
basic stuff has eluded USB C port manufacturers, specially on high end devices
like Macbook and Pixel.

>When you connect your USB-C-equipped Nexus 6P phone to a MacBook Air port
designed to only provide 1.1A ... the phone can pull too much power ... and
potentially destroy internal components.

This is just nonsense, as far as I know. No device can "pull" more current
than you can provide. Even if you short the pins, the port will just be shut
down, as noted later in the article itself.

>But Saunders, chairman of the USB-IF standards body, says he's not aware of
any protection against a completely miswired cable like the one that struck
down Leung's Chromebook Pixel. "That was something that the circuits of his
notebook can't protect against," he says.

I highly doubt that. What's the worst that can happen? You deliver 20V to the
pin expecting GND. Trivial to protect against. And this is also only for
things like chargers. If it is any peripheral device, the voltage drop will
never exceed ~5V I'm guessing. All this just comes down to bad engineering on
the part of laptop manufacturers. Bad cables, bad devices, reverse polarity
chargers have always been present. And our computers have always had
protections against them. And that is how it should be. A completely miswired
cable should simply not work.

Now if you're talking about differentials of >100V, then I would understand.
But we're nowhere close to those levels. Google and Apple: Your ports are
badly designed and you should feel bad!

~~~
zurn
PC hardware often (including Macs) often have self-resetting fuses on USB
ports that make the port look dead but come back to life after some time. Some
fuses take longer than others. So it's sometimes easy to think your USB device
killed the port. A friend had this with a Macbook and a USB charged bike
torch.

Apparently polyfuses can take days to properly un-trip.

~~~
bravo22
Polyfuses are temperature driven and will reset within a few seconds. USB
ports on non-cheap bare-minimum laptops use a chip in monitoring the current
draw and can block that port. The OS can re-enable the port right away but I
believe OS X requires you to reboot.

~~~
manarth
OS-X (Yosemite + El Capitan) has displayed the message to me: "Your device
tried to draw too much current and so the USB port has been disabled".

When I took the offending cable out, and tried with a different device, it
worked straight away, no reboot required (not sure about earlier
versions/alternative scenarios though, it's possible they do require a
reboot).

------
Animats
USB-C has too many pins.

USB started with four pins - GND, Vcc, Data+, and Data-. USB-C has 24. Yes, 12
of them are just the other side of the connector flipped over. And there are
two ground and two power lines on each side, for heavier current. But there
are 10 different pins, with 3 differential pairs for data (the original
bidirectional pair, plus two unidirectional pairs), and the SBU line, which is
used to tell the ends that some lines are not being used for USB, but for some
other protocol, such as DisplayPort or PCIe. (Coming soon to an airport near
you - power outlets with enough smarts to load exploits through these
features.)

A true USB-C cable is simple - it's just wires. It's the ones that are
adapters to other connectors that give trouble. Here's a USB-C to DisplayPort
connector.[1] There's far more in those devices than a programming resistor.

Controlling USB-C ports is so complicated that Cypress's IC has a 32-bit ARM
processor just to operate the port.[2] Either end can be the master, and
either end can be the power source. (These need not be the same.) If all the
complicated setup fails, the interface drops back to USB 2.0 and pretends to
be a "Billboard device", which gives diagnostic info.

The scary part is that USB-C can potentially deliver 100 watts, as 20V at 5A.
USB-A was rated for 5V at 0.5A. Botch the power handshake and Bad Stuff is
likely to happen.

[1] [http://www.ecnmag.com/product-release/2015/05/adapter-
soluti...](http://www.ecnmag.com/product-release/2015/05/adapter-solution-
includes-usb-billboard-device-class) [2] [http://www.cypress.com/products/ez-
pd-ccg2-type-c-port-contr...](http://www.cypress.com/products/ez-pd-ccg2-type-
c-port-controller)

~~~
cnvogel
> Controlling USB-C ports is so complicated that Cypress's IC has a 32-bit ARM
> processor

...it's a Cortex-M0, 4k RAM, 32k Flash. By today's standards, this is a very
small controller. For the Arduino-Crowd, it's roughly equivalent to the
ATmega32u4 on the Arduino Leonardo, but with a Cortex-M0 instead of the 8-bit
AVR. Both, by the way, run 16bit opcodes. -- But I get your point, it's
nevertheless a lot of "brains" for what people wish would be a dumb cable.

> Either end can be the master, and either end can be the power source.

Unfortunately, this is what people expect from a USB device these days. The
poor little "ID" pin on micro-USB was overloaded with functions already: There
are interface chips that can distinguish 40 or so different resistor
combinations on various lines (see the ancient TSU6721, which was used in the
Galaxy-SII). So, I think requiring some intelligence at least for the more
complicated combinations really makes sense.

Regarding the number of pins, I don't think it's that bad: USB2+/\- has stayed
the same, just bridged to two pins each. USB3 Tx/Rx is still two differential
pairs, with two extra differential pairs for "future use", Display-Port, ...
The ID-pin with resistors to Gnd/Vcc just has been massively upgraded to a
serial protocol spoken on the CC1/CC2 pins.

So, for me, after reading a little bit about it, I now see USB-C as Micro-USB3
plus upgraded ID-Pins plus two spare differential pairs... But I was very
skeptical at first, too.

~~~
Animats
The power negotiation alone takes 15 pages in the developer's guide.[1] One
can see how an adapter cable with a botched power negotiation protocol could
screw this up. Also, statements such as "Should the USB specifications change,
then a new firmware will be updated and released" are kind of scary when
applied to power negotiation. Especially since you can load new firmware from
the connector side of the port. Someone is going to develop an attack based on
this, with a USB "power outlet". The OS can't even see this level.

[1] [http://www.cypress.com/documentation/application-
notes/an965...](http://www.cypress.com/documentation/application-
notes/an96527-designing-usb-type-c-products-using-cypress-s-ccg1)

------
EwanG
Short version - If you tend to use a USB-A to USB-C cable it's probably worth
a second or third look. USB-C straight through is probably less of a concern
after some research.

~~~
narsil
A little off-topic, but I've come across 3 of your tl;dr summaries on front
page stories in the past half hour. Thanks EwanGbot!

~~~
EwanG
Yeah, I should probably program a bot to do this eventually. It's more that I
get tired (personally) of seeing an article on the front page with no
discussion, and from some of the titles wondering what it could be about. So
figured the easy answer was to read and share for folks like myself :-)

~~~
narsil
I definitely appreciated it.

------
awakeasleep
This is the second article on these cables that I've read saying the charging
device "pulls too much power"

>When you connect your USB-C-equipped Nexus 6P phone to a MacBook Air port
designed to only provide 1.1A ... the phone can pull too much power ... and
potentially destroy internal components.

Does anyone know what the hell they're talking about? There is no electrical
force to 'pull' power. The source 'pushes' power at a certain voltage, and can
supply a certain manufacturer-set amount of current. If the charging device
can use more current, nothing happens. There is no way to pull "unsupported"
amounts of current out of something.

~~~
aidenn0
The limit to how much power you can pull is just the ESR of the power source.
Don't take a car battery and connect the two terminals together with large-
guage wire, unless you want to see some impressive fireworks.

With purely passive loads, the power "pulled" from a fixed-voltage power
supply is related to the impedance of the load, and can be calculated with a
fairly simple formula.

Phones, however, are active, and can regulate how much they draw to charge the
battery.

Perhaps a simpler explanation: if you plug a night-lite and a vacuum into an
identical outlet, they will clearly pull different amounts of power.

~~~
awakeasleep
Does that explain things when you're talking about a DC power supply? Isn't
that what we're talking about?

~~~
aidenn0
DC and AC don't matter for generalities (though there are significant
differences in how a given device will draw power from an AC or DC source, the
underlying principle is the same).

A DC power supply can still largely be modeled as a DC voltage plus some small
amount of resistance, capacitance and inductance. This will give it a
characteristic impedance for a short-circuit which is the only limit on how
much power can be drawn from it.

Aha! I found where the confusion is in this sentence:

> If the charging device can use more current, nothing happens. There is no
> way to pull "unsupported" amounts of current out of something.

This is wrong. If you draw too much current, then something bad will happen.
The UL just makes sure that "something bad" isn't "will start a fire or
electricute someone" it could very reasonably be a component of the DC power
supply that fails with an open-circuit, which would then need replacing for
the power supply to work again. In some cases it may be a part specifically
designed to be a fuse, in other cases they may just take a diode, MOSFET or
resistor that they needed anyway and choose a part that will die if too much
current is drawn.

Dell is claiming that their USB ports will not die permanently in this case,
but will shut-down temporarily, more like a self-resetting circuit breaker
than a fuse.

------
digi_owl
At least when it comes to the Chromebook Pixel, it could happen even with a
A-to-A cable. Heck i have fried thumbdrives because of a very similar mistake
to the one in the cable that fried the pixel.

Basically it had the data and power pins switched, thus feeding high amps
where it should not be.

For myself, i managed to crosswire a case port (the supplied wire required me
to attach individual pins rather than socket a fixed block).

The only major difference would be the amount of As bouncing around (the
Chromebook, hooked up to a dumb wall wart, would get some 2-3As rather than
the .5A my thumbdrive got).

Anyways, there also exist a proof of concept "badthumb" out there that is
basically a capacitor that will reverse the polarity of the USB connection
after having built up a sizable charge. This will likely take out at least the
controller, if not more.

------
xorcist
Don't buy cheap crap off ebay or amazon and plug into your laptop if you care
about it. It was always so for chargers, now it's cables as well.

(I once bought a noname car charger, "it's for 12V so how bad can it be?".
Turns out "very" is the answer as that phone never took charge again.)

~~~
nommm-nommm
Don't buy cables or chargers off Amazon or eBay at all, regardless of price.
Unless they are shipped and sold by Amazon - not a third party seller. There
is more fakes on those two sites than the real deal.

~~~
kbart
I always warn the ones I care about the same thing. The worst thing about
fake/cheap electronics is not that they don't simply work, but that they might
work 99 times out of 100, but the 100th time burn your house down due to
failed/non existent surge protection or whatnot. It's easy and cheap to
convert AC/DC to nominal rates, but protection from burning down is the hard
and expensive part.

------
jen729w
I've blown the USB bus on my old Mac Mini by plugging in a crappy USB hub.
IIRC (the machine is no longer with me), some of the ports no longer worked
but at least one did which was enough for me to plug a "real" hub in to. Still
a PITA.

Edit: that was a 12V powered hub, not "a cable", so maybe that's why.

~~~
jon-wood
I once accidentally used a charger rated for much more than the hub I was
plugging it into and it fried half the things plugged into it.

------
uptown
A different concern entirely, but I've often wondered about the risks of
plugging some of those impossibly-cheap USB devices you can buy from overseas
from eBay and other sites. Seems like an attack vector that could easily be
exploited to compromise the device of the buyer.

------
coin
Apple designed their product to isolate damage to just the USB circuitry,
whereas the bad cable seemingly tookout the entire Chromebooo laptop.

~~~
smbarber
The failure modes are completely different. The MacBook went overcurrent when
a bad cable told an attached phone it could draw more current than it should.
Detecting overcurrent due to a badly behaved device or a short in the cable is
fairly common.

The cable attached to the Chromebook was totally miswired and flipped Vbus and
ground, supplying -5V where 5V was expected. As the article said, nothing is
really designed to handle this kind of failure because it should be blatantly
obvious to the cable manufacturer if there were any sort of quality control.

~~~
X-Cubed
That's not entirely true.

Reverse polarity protection is very common, and often only requires a single
diode in series with the +V line, so that current can only flow in one
direction.

~~~
marshray
A diode will drop about 0.5-0.6 volts, which could eat 10% of your energy, so
reverse polarity protection is usually used in devices where someone could
plausibly install the batteries backwards. I think it's probably rare on
something on a highly controlled standard connector like USB.

~~~
rrmm
It's fairly easy to do it without the diode drop if you use a mosfet, but you
do incur the cost of a more expensive part.

