Intro We’ve all been there - you’re travelling,
maybe you’re at an airport or a train station, and you realise that your phone could do with
a bit of a charge. Luckily for you, right by where you’re sitting, potentially even built
into the seats where you’re sat, there’s a free, public charging station. All you have to do is
plug your own cable in, and charge your device. But right before the Easter weekend this year,
the FBI tweeted, warning travellers NOT to use these free charging stations.
So what’s the danger? And if using these charging stations isn’t an option, what should you be doing
instead? Stick with me until the end of this video, because that’s what I intend to find out.
What’s the problem?
On the 6th April, the Denver branch of the FBI tweeted the following tweet,
advising travellers who would be heading out of town for the weekend to “avoid using free charging
stations in airports, hotels or shopping centers”. They went on to say that “bad actors have figured
out ways to use public USB ports to introduce malware and monitoring software onto devices.”
So that we’re clear, we’re talking about any situation where USB ports are being offered for
public use as a method of charging your devices. And whilst that could theoretically be anywhere,
including places like on planes or buses, the most likely places where this is going to be high-risk,
are high foot traffic places like Airports, shopping malls, food courts, anywhere where a
lot of people are likely to be coming and going, and needing to charge their phones and tablets.
And while the issue is significantly more likely to impact Android owners,
iPhone owners aren’t entirely in the clear.
The issue that we’re talking about here is something known as Juice Jacking. In this phrase,
‘juice’ is of course referring to the power that you, the user, are trying to
use to charge your phone, by plugging into the free USB port. And to better understand this,
it’s worth taking a moment to better understand how a USB cable works. If you take an old style
USB cable like this one here, and glance inside, you can see 4 pins. Two of these
are related to power - you’ve got a VCC pin, which is essentially the power connector,
and a GND or Ground pin, serving as a reference point for the device’s electrical system,
and providing a path for current to return to the source. The other two pins are data pins,
a Data Minus and a Data Plus pin, and these are used for the two-way transmission of data along
the cable. And the problem with USB, is that when you plug into a USB port, all 4 pins are
connected. USB is all or nothing in this respect, you either connect entirely, or not at all.
To give you an idea of why this is a problem, think about what happens when a Tesla owner
charges their vehicle at a Tesla supercharger. While Teslas and chargers can exchange some
limited information, such as the state of charge, charging speed, and battery temperature,
this communication is separate from the charging cable itself and is facilitated
through a different protocol. In other words, you can plug your car in, safe in the knowledge that
the only thing being transferred to and from your car is electricity, and nothing more. But that
isn’t the case with a USB cable connected to a USB port. Connecting to a USB port opens up the chance
for not only power, but also data to be passed from your phone, to whatever is on the other
side of that USB port. And that’s the key issue - these charging terminals are often unmonitored,
and rarely checked for signs of tampering. I’m not going to scaremonger here and say
that the chances of a public USB port being tampered with are high, because that wouldn’t
be true, but it’s high enough that you are technically gambling each time you use one.
PDF Shoutout By the way, if you
prefer to have content like this in a written format, there’s a PDF to accompany this video,
and you can access it by joining my membership programme, where for a small monthly fee,
you’ll get access to all video PDFs moving forward, plus the growing library of old
ones. Just follow the link in the description of this video that says ‘Become a Channel Member’.
Why is a compromised USB port a problem? So a logical next question then, is why,
or how does a compromised USB port pose a problem? Typically, the threat comes from someone modifying
the charging station, without the security staff of the venue realising. This could be something
as simple as swapping out a USB faceplate for their own modified faceplate that contains a
mini computer, which automatically attempts to install malware on any devices that are
connected to it. That malware could be spyware, ransomware, adware, a remote access trojan,
a keylogger or even a banking trojan, but regardless of the malware, the end goal is
to access your data, which as you can imagine, is something you want to avoid at all costs.
Oh and, whilst you might be thinking that this mainly impacts Android owners, and you would
be correct, iPhone owners aren’t immune to this. Malware can either exploit vulnerabilities in iOS,
so yet another reason to keep your iPhone up-to-date, or use social engineering to
trick you, the owner, into allowing the computer the access that it needs. If you plug your iPhone
into a Mac computer or a PC, you’ll get a prompt asking you if you “trust this computer”. All it
takes is for you to tap the Trust button, either deliberately or by accident, and you’ve granted
the hackers access to your phone. In a recent article in the Washington Post, Ritesh Chugh,
an associate professor and technology and society expert at Central Queensland University,
said that a compromised charging station could identify the websites you’ve been browsing on
your phone in less than 10 seconds, and entirely compromise a user’s phone in less than a minute.
Consider how long you’re likely to leave your phone plugged in at these charging stations,
and you can see why this can be devastating for those impacted.
How would I know if I’ve been compromised? Knowing if your phone has been compromised
would really depend on the kind of malware that’s been installed. Some are designed to be seen,
others are not. Ransomware for example would make itself known, as the installers want you
to pay a ransom to gain access to your phone again. A keylogger or spyware would want to
run quietly in the background, so you’d be looking for other signs of your phone being compromised. A
slowdown in the running of the phone, your phone losing battery life more quickly or overheating,
text messages being sent without your knowledge, the phone storage filling up too quickly for how
you’re using the device, all of these could be signs of a phone that’s recently been compromised,
although just to balance out the argument, they could also be normal wear and tear signs of a
phone, with the exception of the text messages example. If you’re concerned,
definitely reboot your phone, but also consider a factory reset if you still think you’ve got an
issue. Keep an eye on all bank accounts, credit card statements for anything you don’t recognise.
The Proper Weekly By the way,
if you’re enjoying the content here, why not consider signing up to my newsletter,
the proper weekly. I include some tech news from the week, a behind the scenes of what’s happening
here on the channel, as well as a tip for an item in the Apple ecosystem. The newsletter goes out
each Friday, it’s free to join, and I’ll include a signup link in the description of this video.
So what should you do instead? You’re still going to need to
charge your phone while you’re on the go, so how do you go about it,
whilst keeping safe? The good news is that, so long as you prepare ahead, you do have options.
First of all, like I mentioned earlier, the threat here is associated with USB ports only,
and not power sockets. So if you carry both a USB charging cable, and a charging brick,
and the charging station that you’re wanting to use offers power sockets, that’s your most obvious
solution. Connect your charging brick to the power socket, and charge just like you would at home,
safe in the knowledge that you’re not at risk. Whilst it will mean buying one, modern charging
bricks are small enough to easily fit into a bag, can usually charge a couple of devices at once,
and typically offer much faster speeds than you’d get at a public USB port.
If for whatever reason this isn’t something you can do,
consider carrying around a powerbank. These are readily available from pretty much everywhere,
from supermarkets to electrical stores or the shops at airports and train stations,
and they usually come pre-charged, so you can use them immediately, right out of the box to
charge your phone. Some offer wireless charging, but most will simply involve
you plugging in your USB cable and charging your phone up from the powerbank’s own battery. And
once you’ve used it, you can charge it up and use it again, as many times as you need to.
Another option is to carry around something known as a USB data blocker. This small
device is typically a cable that your cable then connects to, allowing you to access
the power element of the USB port you’re connecting to, but not the data element,
it essentially isn’t physically able to transfer data, so cuts the feed before
it gets to your phone. It’s probably my least favourite of all the methods mentioned here,
as it still involves you plugging into these USB ports, but it’s a small, low-cost option.
One final option, if it’s available to you, is to make use of free wireless charging.
Wireless charging pads are often now installed into benches and tables,
allowing people to simply place their phones down and charge them wirelessly. My only
concern here is that you’re leaving your phone out in public, so depending on where you are,
you’re potentially making it easy for a thief to snatch it and run off.
But one thing that I would absolutely insist you do, is keep the software on your phone up to date,
installing updates as soon as they become available to you. This is one of the most basic,
yet most effective things you can do to keep hackers at bay,
especially if you own an iPhone, as the vulnerabilities that these people will
attempt to exploit usually get patched quickly, giving you greater security
if you do ever find that your phone has been plugged into a compromised USB port.
End So there you go, that’s Juice Jacking.
Like I mentioned earlier in the video, this isn’t a case of every public USB port out there being
compromised and ready to be used against you, but because of how easy this is for criminals to do,
you do need to be aware of the risks involved before you connect, especially when you’ve got
the FBI tweeting about it. The good news is that the chances of you connecting to a compromised USB
port aren’t high, but they’re high enough that it’s worth taking the simple steps I mentioned
in this video, especially as the impact of being hacked could be pretty catastrophic.
What do you think? Have you or anyone you know ever fallen victim to anything like this? Any
other hacks we should talk about here on the channel? Drop me a comment and let me know.
And as ever, if you found this video useful, do please consider leaving me a like,
and subscribing to my channel for more content like this in the future.
See you on the next video.