Juice Jacking - phone data theft

[F150HD]

Considering how careful most BHs are using password managers to strengthen passwords etc and avoiding 2 factor authentication via text.....apparently another way to have your phone hacked is afoot.

LA officials issued the warning amid the rise of the scam known as "juice jacking."

In the scam, scammers load malware directly onto the public charging station or the cables that are left plugged in at stations. When you plug your device into the station, the malware would infect your smart phone, laptop or other device.

The malware could export your data or passwords directly to the scammer, putting you at risk.

Tech experts warn of 'juice jacking' ahead of busy holiday travel season

[livesoft]

So why not use a power-only-no-data USB cable?

[lazydavid]

So why not use a power-only-no-data USB cable?

Yup, that works perfectly. There are also "USB Condoms" that achieve the same result with any standard power cable.

I've been telling our employees not to use public charging stations for close to 10 years now. Humorously enough, when I set one up at the office for general use, several people asked me if it was a trick.

[3-20Characters]

This potential threat has been around a while and has been greatly mitigated with security updates and other changes on both android and iOS. If you’re worried, just use the AC adapter and cable. In fact, just do that anyway. Very low on my worry list.

[GAAP]

This has been around for a long time. Plugging anything not yours into one of your devices is risky -- that includes "freebie" thumb drives, borrowed chargers, public charging stations, etc. There's a reason that many companies prohibit (and/or block) sharing data on flash drives...

Just don't do it.

[whodidntante]

What phone/tablet/abacus are y'all running that has this issue? This is not a concern for my devices because they will not expose any private data until I say so.

[privateer79]

What phone/tablet/abacus are y'all running that has this issue? This is not a concern for my devices because they will not expose any private data until I say so.

a lot still do.... many intend not to, but that doesn't mean their implementation achieves that goal.

that doesn't mean this attack is actually happening in the wild... I actually haven't heard of a case of this actually happening.

[livesoft]

I confess that I read a different article about the LA DA's tweet on the same subject.

[F150HD]

Issue isn't about 'using a flash drive' or the like.

So loading malware onto a public USB charging station has been around for "a long time". Where I live, few if any places have had public USB charging ports until more recently, if at all.

[Millennial]

So why not use a power-only-no-data USB cable?

did you even actually read the article? as based upon your response, its clear you did not.

I read the article, and I think livesoft's suggestion makes sense. What about his response made you think he didn't understand the problem?

[Katietsu]

Amazon: $6.99

https://www.amazon.com/gp/aw/d/B00QRRZ2 ... B00T0DW3F8

Personally, when traveling, I carry an Anker Power Pack that can recharge my phone fully twice. Small enough to fit in my pocket if needed.

[lazydavid]

So why not use a power-only-no-data USB cable?

did you even actually read the article? as based upon your response, its clear you did not.

First, you posted two articles (three, actually, if you include the one on 2FA). Which of the three are you accusing livesoft of not reading?

Also, which of the three mentions the use of power-only USB cables? I read both of the relevant articles, and the answer to that question is neither. So your attitude is totally unwarranted.

In fact, cables like the ones that livesoft suggested are an excellent and completely foolproof solution to this problem, which is useful information you would have learned if you had read his/her post with an open mind.

[student]

Amazon: $6.99

https://www.amazon.com/gp/aw/d/B00QRRZ2 ... B00T0DW3F8

Personally, when traveling, I carry an Anker Power Pack that can recharge my phone fully twice. Small enough to fit in my pocket if needed.

Thanks. I did a search and came up with the same item. I am buying this. Also, even without this gadget, I guess one can plug the phone to a power pack and plug the power pack to the socket. This should stop data flow

[lazydavid]

Thanks. I did a search and came up with the same item. I am buying this. Also, even without this gadget, I guess one can plug the phone to a power pack and plug the power pack to the socket. This should stop data flow

It would, but many power packs do not support being charged and charging a device simultaneously. All 10 of the regular ones I own are like this, while the 2 that are also wifi routers can do both. You would have to make sure yours does not have this limitation. But you could certainly, for example, charge the battery pack using the USB port at the airport, then use the battery to recharge your phone on the plane.

[suemarkp]

Why do these charging stations even have a data capability? I would think they only need the power wires and not the data ones (or just block the data if they are common wires). I could perhaps see one plugged in device affecting others if it is a common power bus, but that isn't uploading things into the charger it is device to device. So you would be safe if you are the only one plugged in. Or perhaps they are sticking a tainted memory stick into one of the ports.

I wish these articles would provide a bit more technical data to help those that understand some of the mechanisms. I believe the usb wall outlets in my house have no storage capability.

[Millennial]

Why do these charging stations even have a data capability?

Only for malicious purposes. They don't need any data transfer capabilities. The bad guys make devices that look like the power devices, but also transmit data, in an effort in to tricking people into plugging in to them.

[lazydavid]

I wish these articles would provide a bit more technical data to help those that understand some of the mechanisms. I believe the usb wall outlets in my house have no storage capability.

You should not be concerned about ones you installed in your own home. The risk is that for the public ones, you don't know their provenance. They could be wholly fraudulent (bad guy set the charging kiosk up himself), with a laptop or raspberry pi built in to attack any device that gets connected. Or they could be compromised, either by surreptitiously installing hardware behind the ports or compromising the hardware already present.

[Kenkat]

This potential threat has been around a while and has been greatly mitigated with security updates and other changes on both android and iOS. If you’re worried, just use the AC adapter and cable. In fact, just do that anyway. Very low on my worry list.

This is what i do as well. Added plus is that the AC adapter usually charges your phone more quickly than USB.

[student]

Thanks. I did a search and came up with the same item. I am buying this. Also, even without this gadget, I guess one can plug the phone to a power pack and plug the power pack to the socket. This should stop data flow

It would, but many power packs do not support being charged and charging a device simultaneously. All 10 of the regular ones I own are like this, while the 2 that are also wifi routers can do both. You would have to make sure yours does not have this limitation. But you could certainly, for example, charge the battery pack using the USB port at the airport, then use the battery to recharge your phone on the plane.

I did not know that some will not do this. I tried one of mine before I posted the message. After seeing your message, I tried a few more and have a 50% success rate.

[Small Savanna]

I've wondered if malware could be lurking on the entertainment system of a rental car. When you plug your phone into the rental car for charging, is it too paranoid to use a 12V "cigarette lighter" adapter rather than the built-in USB port?

[Trader Joe]

Considering how careful most BHs are using password managers to strengthen passwords etc and avoiding 2 factor authentication via text.....apparently another way to have your phone hacked is afoot.

LA officials issued the warning amid the rise of the scam known as "juice jacking."

In the scam, scammers load malware directly onto the public charging station or the cables that are left plugged in at stations. When you plug your device into the station, the malware would infect your smart phone, laptop or other device.

The malware could export your data or passwords directly to the scammer, putting you at risk.

Tech experts warn of 'juice jacking' ahead of busy holiday travel season

I never use a password manager. Therefore, I have no concerns here.

[Flyer24]

Topic is now locked. Thread has run its course.