Charging your phone using a public port is dangerous
<p>Have you ever used a public charging station to charge your mobile phone when it runs out of battery? If so, watch out for “juice jacking”.</p>
<p>Cybercriminals are on the prowl to infect your mobile devices such as smartphones and tablet computers and access your personal data, or install malware while you charge them.</p>
<p>Specifically, <a href="https://dl.acm.org/doi/pdf/10.1145/2732198.2732205">juice jacking</a> is a cyber attack in which criminals <a href="https://securelist.com/wired-mobile-charging-is-it-safe/74804/">use publicly accessible USB charging ports or cables</a> to install malicious software on your mobile device and/or steal personal data from it.</p>
<p>Even a <a href="https://media.blackhat.com/us-13/US-13-Lau-Mactans-Injecting-Malware-into-iOS-Devices-via-Malicious-Chargers-WP.pdf">60-second power-up</a> can be enough to compromise your phone’s data. This is because USB cables allow the transmission of both power and data streams simultaneously. Victims can be left vulnerable to identity theft, financial fraud, and significant stress.</p>
<p>USB charging stations are a common sight in shopping centres, airports, hotels, fast-food restaurants, and even on public transport. While juice jacking is neither <a href="https://securelist.com/wi-fi-security-and-fake-acdc-charges-threaten-your-data-at-the-2014-world-cup/63759/">new</a> nor particularly widespread so far, it was recently highlighted by <a href="http://da.lacounty.gov/about/inside-LADA/juice-jacking-criminals-use-public-usb-chargers-steal-data-ff">Los Angeles County District Attorney’s Office</a> as a significant threat, especially to travellers who can easily find themselves caught short and in need of a battery boost.</p>
<p><strong>How does it work?</strong></p>
<p>First, the attackers tamper with the charging stations or cables in public areas, and install malicious software on them. This software then infects the phones of unsuspecting users who subsequently plug into the tampered charger.</p>
<p>The software can invade, damage or even disable your phone. It can also steal or delete data from your phone and possibly spy on your usage activity, to the extent of transmitting your personal information such as account numbers, usernames, passwords, photos, and emails to the perpetrator.</p>
<p><strong>How can I tell if I’ve been juice jacked?</strong></p>
<p>Hacked mobile devices will often go undetected. But there are a few telltale signs that your device may have been hacked. These include:</p>
<ul>
<li>
<p>a sudden surge in battery consumption or rapid loss of charge, indicating a malicious app may be running in the background</p>
</li>
<li>
<p>the device operating slower than usual, or restarting without notice</p>
</li>
<li>
<p>apps taking a long time to load or frequently crashing</p>
</li>
<li>
<p>excessive heating</p>
</li>
<li>
<p>changes to device settings that you did not make</p>
</li>
<li>
<p>increased or abnormal data usage.</p>
</li>
</ul>
<p><strong>How do I protect myself?</strong></p>
<p>The tampering of USB charging stations or USB cables is almost impossible to identify. But there are some simple ways to guard against juice jacking:</p>
<ul>
<li>
<p>avoid USB power charging stations</p>
</li>
<li>
<p>use AC power outlets rather than USB ports</p>
</li>
<li>
<p>use a portable battery power bank (your own, not a borrowed one!)</p>
</li>
<li>
<p>carry your own charging cable and adaptor</p>
</li>
<li>
<p>use a data-blocker device such as <a href="http://syncstop.com/">SyncStop</a> or <a href="https://www.amazon.com.au/Juice-Jack-Defender-Security-purchased-employees/dp/B00XYTQ4Q8">Juice-Jack Defender</a>. These devices physically prevent data transfer and only allow power to go through while charging</p>
</li>
<li>
<p>use power-only USB cables such as <a href="https://www.4cabling.com.au/portapow-fast-charge-micro-usb-cable-300cm.html">PortaPow</a>, which don’t pass any data.</p>
</li>
</ul>
<p>And finally, if you must use a charging station, keep your phone locked while doing so. USB ports typically don’t sync data from a phone that is locked. Most mobile phones will ask your permission to give the USB port access to your phone’s data when you plug in. If you’re using an unknown or untrustworthy port, make sure you decline.</p>
<p><strong>I think I might have been juice jacked – what can I do?</strong></p>
<p>If you suspect you have fallen prey, there are several things you can do to protect your device’s integrity:</p>
<ul>
<li>
<p>monitor your device for unusual activity</p>
</li>
<li>
<p>delete suspicious apps you don’t recall installing</p>
</li>
<li>
<p>restore your device to its factory settings</p>
</li>
<li>
<p>install anti-virus software, such as <a href="https://play.google.com/store/apps/details?id=com.avast.android.mobilesecurity&hl=en_AU">Avast Antivirus</a> or <a href="https://play.google.com/store/apps/details?id=com.antivirus&hl=en_AU%22">AVG AntiVirus</a></p>
</li>
<li>
<p>keep your mobile device’s system software up to date. Developers continually release patches against common types of malware.</p>
</li>
</ul>
<p>A lot of data is stored on our mobile devices these days, and protecting our privacy is crucial. While juice jacking may not be a widespread threat, it is important to ensure the safety of our mobile devices. So, the next time you consider using a public USB charging station or cable, ask yourself if it is worth it, particularly as your personal information is at stake.<!-- Below is The Conversation's page counter tag. Please DO NOT REMOVE. --><img style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important; text-shadow: none !important;" src="https://counter.theconversation.com/content/130947/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /><!-- End of code. If you don't see any code above, please get new code from the Advanced tab after you click the republish button. The page counter does not collect any personal data. More info: http://theconversation.com/republishing-guidelines --></p>
<p><em><a href="https://theconversation.com/profiles/ritesh-chugh-162770">Ritesh Chugh</a>, Senior Lecturer/Discipline Lead – Information Systems and Analysis, <a href="https://theconversation.com/institutions/cquniversity-australia-2140">CQUniversity Australia</a></em></p>
<p><em>This article is republished from <a href="http://theconversation.com">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/charging-your-phone-using-a-public-usb-port-beware-of-juice-jacking-130947">original article</a>.</em></p>
