Why is ‘Juice Jacking’ Out of the blue Again within the Information? – Krebs on Safety

KrebsOnSecurity acquired a pleasant bump in visitors this week because of tweets from the Federal Bureau of Investigation (FBI) and the Federal Communications Fee (FCC) about “juice jacking,” a time period first coined right here in 2011 to explain a possible menace of information theft when one plugs their cell machine right into a public charging kiosk. It stays unclear what could have prompted the alerts, however the excellent news is that there are some pretty basic items you are able to do to keep away from having to fret about juice jacking.

On April 6, 2023, the FBI’s Denver workplace issued a warning about juice jacking in a tweet.

“Keep away from utilizing free charging stations in airports, inns or procuring facilities,” the FBI’s Denver workplace warned. “Unhealthy actors have found out methods to make use of public USB ports to introduce malware and monitoring software program onto gadgets. Carry your personal charger and USB twine and use {an electrical} outlet as an alternative.”

5 days later, the Federal Communications Fee (FCC) issued an analogous warning. “Assume twice earlier than utilizing public charging stations,” the FCC tweeted. “Hackers may very well be ready to realize entry to your private data by putting in malware and monitoring software program to your gadgets. This rip-off is known as juice jacking.”

The FCC tweet additionally offered a hyperlink to the agency’s awareness page on juice jacking, which was initially printed prematurely of the Thanksgiving Vacation in 2019 however was up to date in 2021 after which once more shortly after the FBI’s tweet was picked up by the information media. The alerts have been so broadly and breathlessly lined within the press {that a} point out of juice jacking even made it into this week’s Late Late Show with James Corden.

The time period juice jacking crept into the collective paranoia of gadget geeks in the summertime of 2011, because of the headline for a narrative right here about researchers on the DEFCON hacker conference in Vegas who’d arrange a cell charging station designed to teach the unwary to the fact that many cell gadgets linked to a pc would sync their information by default.

Since then, Apple, Google and different cell machine makers have modified the way in which their {hardware} and software program works in order that their gadgets now not mechanically sync information when one plugs them into a pc with a USB charging cable. As an alternative, customers are introduced with a immediate asking in the event that they want to belief a linked pc earlier than any information switch can happen.

Alternatively, the expertise wanted to conduct a sneaky juice jacking assault has turn out to be way more miniaturized, accessible and low-cost. And there at the moment are a number of merchandise anybody can purchase which can be custom-built to allow juice jacking assaults.

In all probability the most effective identified instance is the OMG cable, a $180 hacking machine made for skilled penetration testers that appears roughly like an Apple or generic USB charging cable. However contained in the OMG cable is a tiny reminiscence chip and a Wi-Fi transmitter that creates a Wi-Fi hotspot, to which the attacker can remotely join utilizing a smartphone app and run instructions on the machine.

The $180 “OMG cable.” Picture: hak5.org.

Brian Markus is co-founder of Aries Security, and one of many researchers who initially showcased the menace from juice jacking on the 2011 DEFCON. Markus stated he isn’t conscious of any public accounts of juice jacking kiosks being discovered within the wild, and stated he’s uncertain what prompted the latest FBI alert.

However Markus stated juice jacking continues to be a threat as a result of it’s far simpler and cheaper nowadays for would-be attackers to supply and construct the mandatory tools.

“Since then, the expertise and parts have turn out to be a lot smaller and really simple to construct, which places this within the arms of much less subtle menace actors,” Markus stated. “Additionally, now you can purchase all these things over-the-counter. I believe the danger is presumably larger now than it was a decade in the past, as a result of a a lot bigger inhabitants of individuals can now pull this off simply.”

How severely ought to we take the latest FBI warning? An investigation by the myth-busting web site Snopes suggests the FBI tweet was only a public service announcement primarily based on a dated advisory. Snopes reached out to each the FBI and the FCC to request information about how widespread the specter of juice jacking is in 2023.

“The FBI replied that its tweet was a ‘customary PSA-type submit’ that stemmed from the FCC warning,” Snopes reported. “An FCC spokesperson informed Snopes that the fee wished to guarantee that their advisory on “juice-jacking,” first issued in 2019 and later up to date in 2021, was up-to-date in order to make sure ‘the customers have essentially the most up-to-date data.’ The official, who requested anonymity, added that that they had not seen any rise in cases of shopper complaints about juice-jacking.”

What are you able to do to keep away from juice jacking? Carry your personal gear. A basic rule of thumb in safety is that if an adversary has bodily entry to your machine, you may now not belief the safety or integrity of that machine. This additionally goes for issues that plug into your gadgets.

Juice jacking isn’t potential if a tool is charged through a trusted AC adapter, battery backup machine, or by means of a USB cable with solely energy wires and no information wires current. In the event you lack this stuff in a bind and nonetheless want to make use of a public charging kiosk or random pc, at the very least energy your machine off earlier than plugging it in.