You get off a flight and realize your phone is almost out of battery, which will make getting an Uber at your destination a bit challenging. Then you see it — a public charging station at the next gate like a pot of gold at the end of the rainbow. As you run rom-com style to the USB port, you may briefly wonder if it’s actually safe from a cybersecurity perspective to plug in your phone.
The answer is technically no; it’s not safe. It is very possible for a cyber criminal to load malware into a charging station with a USB cord. This man-in-the-middle attack is referred to as juice jacking. The malware can then steal data, infect your phone with malware or totally disable your phone. It can happen at any public charging station — in the airport, mall, hotel or event venue. Another variety of juice jacking is plugging an infected cord into a charging station for someone to use.
While much of the publicity centers around iPhones, juice jacking can happen to any model phone, including Androids. In fact, any device that plugs into a charging station, including tablets and smartwatches, is also vulnerable. The issue isn’t the type of device but the fact that it uses a USB cord to plug into a charging station that a cyber criminal can tamper with and infect with malware.
However, neither I nor other journalists were able to find any recent documented cases of juice jacking. Yes, it’s been in the news a lot lately after the Denver FBI tweeted about juice jacking from a 2019 FCC warning. But it appears to be a general warning, not a heightened threat based on a rash of recent attacks. According to Slate, the FCC reported releasing the original statement four years ago due to customer complaints.
Prevent juice jacking
Because the stakes are high if you are a victim of juice jacking, many consumers and businesses take a few (easy) steps to prevent attacks. It’s much easier to take precautions than deal with the effects of an attack, which can be damaging.
Here are some ways to keep your phone and your data safe:
- Use a portable charger. The easiest way to prevent juice jacking is simply not to use a public charging station. Since low batteries strike at the least convenient times, consider keeping an emergency charging block with you, especially when traveling. Be sure that your portable charger is charged before leaving and that you have the correct cords for your devices.
- Carry your own USB cable and outlet plug. If you don’t have a portable charger with you, you can also bring your own cord and outlet to plug into a wall socket, which avoids the risk. If you can’t find an outlet, then in an emergency, you can use your own USB cord at a public charging station, which reduces some of the risk.
- Use a USB cable without a data wire. USB cables typically have one wire that transmits power and another that sends data. The juice jacking occurs through the data wire. You can purchase a USB port that does not have a data wire, which prevents juice jacking. However, there are many cases where you need a USB cable with data capabilities, such as backing up your devices to the cloud. Using this strategy means you need multiple cords and must keep track of which cord has data transfer capabilities.
- Use a data blocker. You can also plug a data blocker into the charging station and then plug your cord into the data blocker, creating a barrier between your device and the charging station. The data blocker disables the data pins in your USB cable so data cannot transmit. However, power still travels over the wire. Similar to cables without a data wire, the malware or data cannot transmit, which prevents juice jacking.
- Do not trust “the computer”. If you plug your device into a public charger and get a message asking if you “trust the computer” or accept “sharing data”, immediately unplug. iPhones have a mechanism that detects data being sent from a device. Getting this message indicates that something is amiss and juice jacking may be in process.
Juice jacking and corporate devices
While juice jacking can cause significant damage to personal devices and information, the risks are multiplied for corporate devices. In theory, a major data breach for a company could start from a juice-jacking incident. If an employee plugs a work device into a public charging station and is a victim of juice jacking, cyber criminals may have access to the employee’s corporate accounts.
Here are ways for employers to reduce the risk of juice jacking:
- Educate employees on juice jacking. As part of creating a culture of cybersecurity and cybersecurity training, discuss how juice jacking occurs. Many employees may not be aware of the risks and unknowingly plug into a charging station.
- Provide employees who travel with data blockers. By giving employees the equipment needed to safely use public charging stations, you can reduce the likelihood of them directly plugging a work device into an infected port.
- Require employees to report suspected juice jackings. If employees use a public charging station and suspect malware, they should immediately report the incident. IT can then remotely wipe the phone to reduce the risk of infection of other corporate apps and devices as well as data breaches. By explaining to employees the importance of reporting even though they broke a policy, you can prevent further damage.
It’s taking one of two extremes when learning about juice jacking — either thinking it’s happening all the time or assuming it will never happen to you. Instead, taking the middle ground is the smartest move. Because juice jacking is possible, it’s important to assume it may happen. By taking reasonable precautions, you can make sure that you and your employees have the ability to safely charge your devices.
The post Juice jacking: Is it a real issue or media hype? appeared first on Security Intelligence.