Juice Jacking: Don't plug into public USB charging stations at airports and malls, officials warn

[TexasTowelie]

If your cellphone battery is running low, don’t plug it into a USB charging station at the airport or mall, officials are warning consumers as the busy holiday season gets under way.

Those convenient USB charging stations in public places could be loaded with malware by criminals looking to steal your money and identity, warned the Los Angeles district attorney in a recent Twitter post.

This growing cyber threat, known as Juice Jacking, poses serious risks to smartphones, tablets and computers. In as little as one minute, a virus can be transferred to unsuspecting users’ devices. Then, the virus begins exporting sensitive data and passwords directly to the scammers.

Instead, use your own charging cord to plug directly into an electrical outlet, experts say.

Read more: https://www.sun-sentinel.com/features/fl-fea-usb-charging-scam-juice-jacking-20191115-aagiam3hf5hjzo2vaxbs4jcwzu-story.html
(South Florida Sun-Sentinel)

[Quackers]

2. Maybe I'm not familiar with the type of charging station they're talking about

A USB charging station is just a power supply plugin. My surge protector has two USB ports as well as standard plugs. I could understand it if there was a computer on the other end, but that’s not what this is. I watched the video and most of the images shown were people plugged into regular outlets.

[rampartc]

3. at some public venues there are coin operated charging stations.

I've never seen one in use but wondered about malware when I saw one recently.

[smb]

6. Also, The Phone Should Have USB Setting Options

Set it for charging, not data transfer, and it won't accept inputs even if somebody figures out some way to inject data into a simple power socket.

[Ms. Toad]

9. That video was not helpful

I believe only one of the images was of a charging station. The rest were images of people doing exactly as the alert urges them to: p!ugging directly into an outlet with your own power cord.

[Quackers]

4. Ok, I did a little more digging. I'm starting to think this is more fear mongering than anything.

When questioned about the threat, the DA admitted they have never had a case of this to happen. They also said that this is a known problem on the east coast. When asked where these cases were, they said they didn’t know. I also found this excerpt from Snopes.



But the county’s chief prosecutor’s office told TechCrunch that it has “no cases” of juice-jacking on its books, though it said there are known cases on the east coast. When asked where those cases were, the spokesperson did not know. And when asked what prompted the alert to begin with, the spokesperson said it was part of “an ongoing fraud education campaign.”

https://www.snopes.com/fact-check/juice-jacking-real-security-issue/

[smb]

5. How The Hell Do You Plant Malware In A Power Outlet? nt

[TexasTowelie]

7. In the video that is at the Twitter link

they show a cable being plugged in directly to a USB port that would be providing the current to charge the phone. It is not malware in a power outlet.

Link to tweet

Click on the bit.ly link for the video.

Note that some cell phone chargers allow you to disconnect the cord from the portion that plugs into the electrical outlet. I frequently disconnect the two parts of the charger so that I can plug one end into the USB of my laptop if I need to transfer pictures from the phone.

[KY_EnviroGuy]

11. Best to not look at it as a power outlet, but instead as a data port.

USB is specifically designed for transmitting data, with a side-order of 5V DC power for convenience for portable devices.

Industry adulterated the connector as a power supply only port to avoid multiple connectors on devices such as phones. So now it's use is stolen to charge all sorts of batteries and to power all sorts of gadgets the Chinese throw our way like little cooling fans and essential oil vaporizers.

This leads people to plug all sorts of shit into computer ports that should not be there since these ports are power limited and since such junk devices can cause weird thing to happen to your computer.

Very simple solution:



......which one can share with a friend!

[smb]

12. So Why Are Public Power Ports Not Designed As Pure Power Outlets?

The innards of a properly designed power port should basically be the same as those gizmos, only without the pretty casing except for the consumer-facing front plate. Did the idiot designers actually install full power-and-data USB ports for some stupid reason?

[KY_EnviroGuy]

16. I think the point of the article is that.....

you don't know what you're plugging into. If the people supplying these charging station have evil intent, they certainly would include the data pair and connect it to a computer somehow and they certainly would not label the jacks indicating their intent.

Regardless, everyone should be encouraged to have security software on all devices to prevent intrusions just in case one plugs into a port that has evil intent to steal data.

Someone somewhere probably makes a power-only charging cables for typical devices like phones that do not have the data wires included in the cable. That would eliminate any worry about data theft.

[edhopper]

8. In Android phones

disable "Unknown Sources" in settings.

[MineralMan]

10. While anything is possible, I doubt this is a major threat to cell phone users.

Personally, I don't plug anything into USB outlets other than the ones on my charger or in places I'm sure of, like my car, for example. Not because of malware threats, but because I don't know how the USB outlet is powered or configured. Just because my cable will fit in the outlet does not mean that the outlet has the proper voltage or current limitations.

There are USB outlets on just about everything these days. But, who knows how they are configured or what components are used to prevent voltage surges? My phone and other devices have some protection built-in, but it's not really foolproof.

Since I can't inspect the circuitry of USB outlets at an airport or wherever, I simply don't use them. Instead, I plug a USB charger into a conventional 120v outlet and plug my USB cable into that.

[smb]

13. I've Heard Of Cables Sold As "Power Only"

The catch is that I'm not sure whether that means "the cables are built with no data line at all" or "the data line in this one is kind of funky and unreliable, so only use it for power". Obviously, only the former would be a reliable protection against a suspect USB socket.

[MineralMan]

14. Yeah, I don't know.

Our 2020 KIA Soul connects to cell phones via a USB tether to use Apple Car Play or Android Auto. The cable has to be data capable for that to work. The KIA dealer gave us a cable for my wife's iPhone when we got the car. Since then, I've switched to a Samsun A10e phone. The USB cable that came with it is uselessly short, so I bought a couple of new cables on Amazon. The A10e uses a USB C connector, which is cool since you can plug the cable in either way. I made sure that the cables I bought were data capable.

I use one with the phone's charger, which is plugged in next to the bed. The other one is in the car so I can tether the phone to the car's system. When I travel by air, I'll take the one from the car with me for use on the trip.

On the other hand, a guy can buy a usb cable almost anywhere these days. Even if it has a USB C connector. Lots of Samsung phones out there.

In an ideal world, my new 2020 Soul would have a low-power wifi connectivity capability so I wouldn't need to tether the phone, but it doesn't. the 2021 models probably will, though, but I'll have this one for five years, so tethering will be part of my life.

It's all a non-issue, really.

[Proud Liberal Dem]

15. So

How is this happening in airports and other public areas? They're the ones responsible for installing and maintaining the charging ports, etc., right? Or contracting out to other companies but are those companies shady? I don't get this.

[question everything]

17. One more link

https://www.forbes.com/sites/suzannerowankelleher/2019/05/21/why-you-should-never-use-airport-usb-charging-stations/#3ac5be1f5955

Those oh-so-handy USB power charging stations in the airport may come with a cost you can’t see. Cybercriminals can modify those USB connections to install malware on your phone or download data without your knowledge.

“Plugging into a public USB port is kind of like finding a toothbrush on the side of the road and deciding to stick it in your mouth. You have no idea where that thing has been,” says Caleb Barlow, Vice President of X-Force Threat Intelligence at IBM Security. “And remember that that USB port can pass data.”

It’s much safer to bring your regular charger along and plug it into a wall outlet or, alternatively, bring a portable power bank to recharge your phone when you’re low on bars.

If you insist on using public USB ports, Barlow recommends investing $10 for something called a Juice-Jack Defender. “It's a little dongle you can put in front of your charging cord that basically blocks any data from passing down the cord. It only passes the voltage,” says Barlow.