FBI warns of ‘juice jacking’ at public USB charging stations

The FBI office in Denver is warning consumers against using free public charging stations, saying bad actors can use USB ports at juice stops to introduce malware and surveillance software to devices.

“Bring your own charger and USB cord and use an electrical outlet instead,” the agency recommended in a recent tweet.

Juice jacking has been around for a decade, although no one knows how widespread the practice has become.

“There was a lot of talk about him being in the public eye, but not a lot in the public eye,” observed Brian Markus, CEO of Aries Security, a security research and education company in Wilmington. , Of the. Markus, and his colleague Robert Rowley first demonstrated juice jacking in 2012.

“Jacking juice chargers are like ATM skimmers,” Markus told TechNewsWorld. “We hear a lot about them but we don’t necessarily see them.”

Avoid using free charging stations at airports, hotels or shopping malls. Malicious actors have found ways to use public USB ports to introduce malware and surveillance software to devices. Bring your own charger and USB cord and use an electrical outlet instead. pic.twitter.com/9T62SYen9T

— FBI Denver (@FBIDenver) April 6, 2023

He explained that someone who wants to tamper with a legitimate electric charging station could change the station’s cable to a tampered one, which contains the chip that can install a remote access trojan, or backdoor, on a phone. Then the phone can be attacked at any time on the Internet.

“It’s especially prevalent with Android phones running older versions of the operating system,” Markus said. “That’s why it’s important for users to keep their devices up to date.”

Differing opinions

There seem to be conflicting opinions within the security community on the significance of a threat to consumers.

“It’s not very common in general because using a remote charging facility is not something that people do very often,” observed Bud Broomhead, CEO of Viakoo, a software solutions developer. cybersecurity and physical security in Mountain View, California.

“However, if someone is using a charging system beyond their control, the warning issued by the FBI should cause them to change their behavior, as cases are on the rise,” he told TechNewsWorld.

ADVERTISEMENT

Decode your future with an online computer science degree from Drexel
Drexel University’s online computer science programs are designed to prepare you to work at the cutting edge of technology. The program is designed for students of any level of experience or prior knowledge. Information required “

Aviram Jenik, president of Apona Security, a source code security firm in Roseville, Calif., argued that juice jacking is “extremely common.”

“We don’t have numbers because devices tend to be in places where people don’t stay long, so it’s easy to plant a malicious device and then take it back,” he told TechNewsWorld. .

“It’s been happening for years now, and the appearance of charging stations infected with malware is almost regular,” he added.

“As charging becomes more and more sophisticated — that is, data travels over the same wires that carry a charge — it’s going to get worse,” he said. “When the target has a higher value – for example, an electric vehicle versus a mobile phone – the stakes will be higher.”

Jenik added that another future development would be wireless charging, which would allow attackers to perform an attack without anyone seeing the physical device used for the breach.

Two-way communication problem

Juice jacking is likely more likely to occur in areas frequented by people of interest – politicians or employees of intelligence agencies, said Andrew Barratt, general manager of solutions and investigations at Coalfire, a provider of cybersecurity consulting services based in Westminster, Colorado.

“For a juice jacking attack to be effective, it would have to deliver a very sophisticated payload capable of bypassing common phone security measures,” he told TechNewsWorld.

“Frankly,” he continued, “I’d be more worried if the outlets were used so heavily that they damaged my cord or the phone jack.”

Juice jacking exploits USB technology for malicious purposes. “The problem is that USB ports allow two-way communication, not only for power charging, but also for data transmission. This is how your USB device can send images and other data when you plug it in,” explained Roger Grimes, a defense evangelist at KnowBe4, a security awareness training provider in Clearwater, Florida. .

“The USB port was never designed to prevent advanced malicious commands from being sent over the data channel,” he told TechNewsWorld. “There have been many USB port security improvements over the years, but there are still other avenues of attack, and most USB-enabled devices allow the charging port to declare itself an older version of the USB port standard, so some of the new protection features are no longer available.

Will electric vehicles be next?

JT Keating, senior vice president of strategic initiatives at Zimperium, a mobile security solutions provider in Dallas, warned consumers to beware of free solutions posing as “public” services.

“When hackers trick people into using their fake Wi-Fi networks and fake power stations, they can compromise devices, install malware and spyware, and steal data,” he told TechNewsWorld.

“This trend will continue and evolve as more and more people connect to charging stations for their electric vehicles,” he continued. “By compromising an EV charging station, attackers can wreak havoc by stealing payment information or creating a ransomware variant by disabling stations and preventing charging.”

ADVERTISEMENT

Coalfire’s Barratt noted that electric vehicle charging stations have been a concern for some time, but the issues have been stealing charges or getting free use of the stations.

“Longer term,” he said, “I suspect there is concern that we will continue to see more attacks on these chargers as the world moves to EV chargers.”

“When we had payphones, there were attacks on them,” he continued. “There are regular attacks on ATMs and gas pumps. Anything of much-needed value in an unattended environment, there is earning potential for a cyber thief to exploit.

Avoid becoming a victim of Juice Jacking

Since Markus and Rowley introduced the world to juice jacking, conditions have improved for attackers. Wireless connectivity has been added to charging ports, for example.

“When we first did this, we had an entire laptop tucked away in the charging station, and it was doing a lot of work,” Markus noted. “The amount of computing power to do the same thing now is significantly less.”

The FBI isn’t the only ABC agency to sound the alarm about juice jacking. The FCC in the past has also warned consumers against this practice. To avoid falling victim to juice jackers, he recommends:

• Avoid using a USB charging station. Use an AC outlet instead.
• When traveling, bring your own AC, car chargers and USB cables.
• Bring a portable charger or power bank.
• Consider carrying a charging-only cable, which prevents sending or receiving data while charging, from a trusted provider.