Comment on this storyComment
Many of us know the fear of a 1 percent phone battery and the panic when the screen goes blank. However, according to a recent FBI warning, plugging your phone into a public charging station at a hotel, airport or coffee shop in a hurry could be risky.
“Malicious actors have found ways to use public USB ports to inject malware and surveillance software onto devices,” the Denver FBI wrote in a tweet. “Avoid free charging stations in airports, hotels or malls.” His advice: Bring your own charger and USB cable and instead use an outlet to power your device.
The FBI’s warning is just the latest government concern over so-called “juice jacking,” a cybercrime in which a hacker uses public USB ports to steal data such as credit card numbers or install malware on a user’s device. The term is said to date back to 2011, when researchers at DefCon created a charging kiosk that demonstrated the potential cybersecurity risks of such stations. Years later, in a world where our smartphones are increasingly acting as wallets, GPS, photo albums, and a constantly running log of our personal communications and browsing history, accessing someone else’s device can be practically as invasive as breaking into their home .
From airport wifi to juice jacking, 7 ways to protect your data while traveling
Ritesh Chugh, a staff member Professor and technology and society expert at Central Queensland University, wrote in an email that public charging stations pose a “significant privacy threat”. Research has shown that a malicious charging station can identify the web pages loaded in your phone’s browser in less than 10 seconds, he wrote, while “as little as a minute of loading time can be enough to compromise a user’s phone.”
Although it is unclear how common these attacks are and instances of victimization have not been widely reported, repeated warnings from security agencies around the world “clearly indicate the continuing danger posed by this attack vector,” Chugh wrote. Officials have expressed similar concerns California, India and Nigeria. The FCC’s website warns, “Don’t let a free USB top-up drain your bank account.”
Tony Coulson, executive director of the Cybersecurity Center at California State University at San Bernardino, says we should start thinking about phones the way we think about credit cards. “You don’t just go somewhere and stick your debit card in,” he says.
He compares juice theft to credit card skimming. Much like magnetic strips on credit cards, which leave them vulnerable to security threats, USB technology is old, Coulson said, and “didn’t have much security built in.” You can already see that in a USB plug: there are four connections in there; two are for power and two for data. “There’s no failover in between, and once you’re plugged in — if data talks, then data talks,” he says.
If you’ve been using public charging stations, experts say, beware your phone will lose battery life faster; a noticeable slowdown in operations; overheating; Settings are changed without your input; and unusually high data usage. If you think you’ve been affected, they recommend deleting any suspicious apps, installing antivirus software — and if you’re really worried, factory resetting the phone. You should also keep your phone software up to date.
To avoid becoming a victim in the first place, Coulson recommends adopting newer USB technologies (like USB-C) or purchasing charge-only cables that don’t allow for data extraction. Wireless chargers are a safer option, Chugh said, as instances of tampering with such devices are “nearly non-existent.”
When you connect a smartphone to a USB port, you may also be asked if you trust the device you’re connected to. That’s a signal that the USB could do more than just charge. If you haven’t connected to your PC, you should say no, say experts.
If you’re in a hurry and need a USB port, check if it has four or two ports inside – many are made with four, but if it has two, it’s only for charging. “But that’s not a 100 percent rule,” warns Coulson.
When it comes to his own device, “I only charge my phone with my own plug-in charger,” he says. “I’ve been doing that for years.”