Could there be a hidden danger lurking in those public USB chargers?
Sometimes these can be your only option if you're in a pinch somewhere like an airport,
an arena, or a hotel. But as you know, USB doesn't just provide
much needed power to your dying phone. It also sends data, which is where concerns
about juice jacking have come from recently.
The idea is that whenever you connect your phone or laptop to a USB outlet that leads God knows where,
you're taking a chance that your device could be hacked or infected with malware.
The American FCC has even gone so far as to warn people
that a free USB charge could wind up draining
your bank account. So how exactly would an attack like this work
and how prevalent are they? The basic idea is pretty simple.
A hacker modifies a public charging station or just sets one up on their own
and when a hapless victim connects their phone, the compromised charger will simply get around
the phone's built-in protections and starts sucking down private data
like a digital big gulp.
Blue raspberry. And it's important to note that these kind of attacks
have been demonstrated to be possible rather than a purely hypothetical risk.
They can be executed by everything from tiny computers the size of a raspberry pie,
hiding inside charging stations, to special cables that allow attackers
to inject keystrokes wirelessly. But get this, despite the hysteria around juice jacking,
no cybersecurity firms have ever reported a single case of it happening out in the wild.
Why is this? And does that necessarily mean that you're safe from juice jacking?
One major reason modern phones are relatively safe from juice jacking is that phone manufacturers know
that attacks through the USB port or Lightning port, if you're an iPhone user, are indeed possible.
And as we've gotten more and more accustomed to using our phones as a gateway to critical private data,
they've hardened their mobile devices against these attacks in a way they weren't just 10 years ago.
The fact that we very rarely use the ports on our phones
for anything other than charging has made it easier for phone manufacturers
to beef up security. Most phones these days automatically treat data exchange
over a cord as kind of suspicious. So on both Android and iOS,
you have to go through a bunch of menus to approve a corded data connection.
Something that should immediately raise red flags for most people should a public charging station
request access. But beyond protections built into the phones intentionally,
it's also difficult to quickly hack the average phone, even if you're trying to remotely punch in the keystrokes
to bypass all those warnings we just talked about. Most attacks that would allow significant access
to a phone require complex codes specifically written
for a small range of devices. So an attacker would have to hope someone
with a very specific model of phone plugs into their very specific fake charging station.
In fact, tools that are used by actual law enforcement
to crack phones as part of criminal investigations sell for tens of thousands of dollars.
And even these can take days to actually unlock the target device.
So even if a hacker has lots of money at their disposal,
it doesn't make sense to try to deploy such a tool at a public charging station
that a user might only be connected to for a matter of minutes.
Any method that could quickly hack a modern phone would likely be sold in the dark web
for a large amount of money to someone trying to go after
a specific high value target, meaning not anyone like you and me.
What the heck does that mean, John? But of course, I don't mean to say you, our dear viewer, aren't valuable.
I'm just saying that juice jacking really isn't something you need to worry about.
But if you're paranoid, just carry around a charging brick if you don't mind having awkwardly protruding
and very warm pockets. And thank you for warming my pockets
by watching this whole video. Hey, like the video if you liked it, dislike it if you disliked it,
check out our other videos and comment below with video suggestions. And don't forget to subscribe and follow.
But no hacking.