The FBI Denver office recently made a tweet warning people about the
dangers of public USB ports, like for charging, and how they can be used to
spread malware onto devices. But how much do you really need to worry about this,
and what can you do to protect yourself if you do need to use one of these ports?
That's what I'll talk about today. This type of attack has actually been talked about for
a while - years. And the term it's called is "juice jacking." A stupid name, but that's
what we got. And the idea is that the attacker will modify a USB port that's out in public,
and attach some kind of malicious device to it, so that when you go and plug your device into it,
then it will install malware or do some other kind of hack.
And first I want to point out that yes, this type of attack is definitely possible in the right
circumstance. However, at the same time, a lot of modern phones, and the latest versions of Android
and iOS, do have protections built in to mitigate this risk. But as I'll demonstrate in a minute,
even these protections don't necessarily protect you 100% against all types of attacks.
That being said, it is extremely easy to protect yourself against all USB attacks
by simply using your own AC charging adapter and your own cable. And while it is extremely
unlikely that the charging cable will be compromised as opposed to the USB port,
it is still possible. And there is actually a product for sale right now called the OMG
Cable that looks almost indistinguishable from any other genuine cable, and it has
hardware in the charging plug itself that is designed to be used potentially maliciously.
However, as you can see, this is very expensive. So in public it makes way more sense to attack
the port, not the cable. But if you do have a job that puts you at high risk of espionage,
like a government official or something like that, then it is really good to know
about this type of attack. And I could imagine if you are traveling overseas,
maybe a government spy could swap out your cable with this one without you knowing.
Maybe when you step out of the hotel room or whatever. That's probably not a risk for
most people, but you never know. But just like security in real life, you should be protecting
yourself online, which is where today's sponsor comes in, Guardio. Guardio is a browser extension
that provides real-time protection from all sorts of threats while browsing the web.
For example, it blocks malicious sites using in-house, custom-developed methods
for detecting phishing and malware content, all before those threats even have a chance to do any
harm. Guardio also has download protection to block malicious files even if you accidentally
click to download them, like from fake sites for popular software, or even malicious game mods.
One of my personal favorite features is that it will warn you if a website's domain has
been registered very recently, which is a major red flag. Guardio also scans your other browser
extensions and alerts you if there are any disguised malicious extensions installed.
And they've actually published research about a brand new type of attack involving a fake chat GPT
extension that steals your Facebook account, which Guardio of course can protect against.
You can scan your browser for threats for free by visiting guard.io/ThioJoe and installing
the extension, and you'll also get a free 7-day trial to the premium features such as real-time
threat removal. So if you want a clean and secure browsing experience, again go to guard.io/ThioJoe,
link in the description, and also check out their affordable premium plan for full protection.
And with all that being said, let's get back to how to protect yourself against
Juice Jacking. Now if you absolutely must use a public USB charging port,
there are little devices such as this one which can protect you by disconnecting the data wires
and only connect the charging pins. So this completely eliminates the risk of juicejacking.
There's no way any malware can communicate with your phone. And these are not very expensive
either, so I'll put a link in the description to Amazon for the ones that I bought here if
you want to check them out. Do keep in mind though that I believe if you use one of these,
you won't be able to use fast charging on your phone, because that requires the
phone to negotiate the charging speed with the charger, but probably better safe than sorry.
But what actually will happen if someone does accidentally plug their phone into a malicious
USB port without realizing? Like I mentioned, iOS and Android do have protections built in,
but it's not 100%. For Android how it works, and has worked at least as early as 2016 based on a
question on Stack Overflow, when you plug in a USB device to the phone, it will default to charging
only mode, and you need to actually go to the notification and manually set it to data transfer.
And for iOS, if you plug it into a computer or something, it will ask if you want to
trust the device or not, so you just want to make sure you don't accidentally hit Trust
there. For both though, interestingly, they will still show up on the computer, even if
you have the Android phone in charging mode, and even if you don't hit trust on the iPhone.
It doesn't let you actually see any of the internal storage, but it still shows that the
device is connected. So there is some kind of data connection there. So theoretically,
if there was some kind of zero day exploit or something that a
hacker knew about that could bypass this, then that might be a risk.
However, if that was the case, if a hacker did have a very valuable zero day exploit,
they probably wouldn't be using it on random people out in the public. They probably use
it on high profile targets because they wouldn't want to risk it getting out there and then being
patched. Keep in mind though, if you don't keep your phone up to date and install the latest
security patches, your risk goes up dramatically because usually if a patch gets released,
companies talk about what they patched and then hackers know how to do that thing.
And they're going to go after the people who don't update their phone regularly. And there's usually
a window between when most people update and when it's a viable attack. Also for iPhone though,
there is a feature called "USB Restricted Mode," which has been in there since iOS
11.4.1. And with this, if the phone has been locked for more than an hour,
the phone will completely disable the data part of the lightning port.
So like before, you saw how it did show up even if I didn't hit trust, with this,
if it's in restricted mode and the phone's locked, it won't show up at all. Like the computer doesn't
see that anything is connected. It's only the power. In reality though, it probably
is likely that you would have unlocked your phone in the last hour after plugging it in somewhere.
So instead what you can also do to manually activate restricted mode is to hold the power
and volume up button until this screen comes up and that deactivates Face ID until you type in
your password manually. And in that state where Face ID is disabled or your fingerprint sensor,
then it also completely disables the data of the lightning port.
So you can do that manually if you want. And I actually think that doing that would be an option
for if you did have to use a public charging port, because again, it wouldn't connect any data. So
theoretically, unless there's some incredible exploit out there, you should be safe. But again,
if you want to be a hundred percent sure, just use your own or use a physical disconnector.
At this point, you might be thinking, "Wait a minute, if the phone makes you
approve a device before it can connect to the hardware, what's the risk?" Well, phones don't
actually make you approve all types of devices. There's another type of attack called an HID
attack. It stands for Human Interface Device, and that's something like a keyboard or mouse.
Here's a demonstration. I have a really basic USB keyboard. And if I connect it
to the iPhone with an adapter, it immediately lets me send key
presses to the phone without asking. It never asked me to approve this. And this
is even if the phone is locked. There's not even a warning that a keyboard is attached.
Though again, this wouldn't work if the lightning port was disabled. And the same goes for Android.
I can press keys and it responds even on the lock screen. Though I'm just not sure
what button brings up the pin entry, but if it is open, it still lets me try a pin. Though it does,
at least on Android, mention that you have a keyboard attached by an icon at the top,
and it usually shows a notification to ask you to configure the keyboard.
So at least you'll have a hint. To be fair, this does not mean an attacker
could brute force your password. Because both iOS and Android have delay features built in,
where if you type in the password too many times wrong, I think on Android it's
five [times], it'll delay it by 30 seconds. And on iOS, it gradually increases the delay.
So even brute forcing a four digit pin would not be feasible within any
kind of amount of time. But if your phone is already unlocked,
they could very well have macros programmed into whatever hacking device they're using
that could be scripted to do whatever. So for example, here with a couple of key presses,
I can bring up Safari and go to any website, or also I can use it to open apps, who knows.
Now, because this type of attack is probably going to require your phone
to be unlocked to work, then the risk is going to be significantly lower than some kind of exploit,
because you're probably going to be actively using the phone and you would notice. But it's
very possible that the hacker could remotely be controlling the hacking device and just wait for
you to be distracted for a second, and then run the macro real quick and do whatever it wants.
For example, that OMG cable does actually have remote control capabilities. Still,
using a macro is a pretty rudimentary type of attack. But because phones apparently do
connect to keyboards and stuff without any kind of authentication, I could see it possible that there
are hidden exploits out there yet to be discovered that would be able to take advantage of that.
Now, as for the probability of this attack actually happening, even though the FBI tweeted
about it, they didn't really cite their source or say that this actually was happening. And I don't
think I've ever heard or read about an instance of this actually going on in the wild and being used.
I'm sure it could be used for specific targets, high value, like spies and stuff might use.
But I don't think hackers are just doing this at an airport or something. It seems
like a lot of risk and a lot of work for probably not that much reward. But still,
you never know in the future, and better to be safe than sorry. So let
me know what you think. Did you ever consider this as a possible attack?
And will you be changing your behavior because of it? Maybe you'll start using
your own charging cables no matter what from now on. And thanks again to Guardio
for sponsoring this video. Again, go to guard.io/ThioJoe to install the extension
and scan your browser for threats for free. The link is also in the description.
If you want to keep watching, the next video I'd recommend is one I made talking about a
bunch of hidden menus in Google Chrome that not a lot of people know about. So I'll put
that link right there. So thanks so much for watching and I'll see you in the next one.