Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way?

Oh yeah, those comments you quoted seem to be to be woefully ignorant (and rather disrespectful since you have a legitimate question).

Welcome to the world of tin-foil-hattery!

Your fear that the battery pack may be more than a battery pack seems perfectly reasonable to me.

The comment is of course correct that the direction is reversed relative to the traditional BadUSB attack: USB Stick --> PC vs USB Power Pack <-- Phone, so your phone will not automatically install drivers supplied by the device. So BadUSB doesn't apply directly, but that by no means rules out the possibility of it exploiting a buffer overflow or similar vuln on the phone's USB packet parser.

It seems perfectly reasonable to be that the USB power pack could have a chip that exploits some unknown and unpatched vulnerability in the Android or iOS USB drivers (aka "a 0-day attack") potentially leading to full compromise of your phone. With both OSes trying to get increasing functionality out of that USB port, there's bound to be new code in their USB stacks, and as with all new code, there's bound to be some 0-days floating around.


As for mitigation

Apply the same reasoning you'd apply to plugging a USB stick into your CP: if you don't trust the device, don't connect it. Don't buy devices from dubious manufacturers, and always buy electronics in person rather than online for mail-delivery since the NSA has a proven history of doing this (and if the NSA is doing it, then they're surely not the only ones).

The NSA Actually Intercepted Packages to Put Backdoors in Electronics


Removing the data pins from the USB plugs should be enough. Better yet, just buy a syncstop.

http://syncstop.com/

You could have one plugged into whatever device you charge your battery from and then another from the battery to your phone. Only power being passed that way.

You can also make them, just search for "make USB condom" online.