Why is ‘juice jacking’ suddenly back in the news?
krebsonsecurity.com
krebsonsecurity.com
Maybe the FBI came across some foreign actor that talked about doing this or maybe they did come across it in real life and we'll have to wait for some future trial/operation to learn about it (if ever).
Still that $180 USB cable is really interesting. Fortunately it's expensive, although it's designed for professional red teaming.
> “The FBI replied that its tweet was a ‘standard PSA-type post’ that stemmed from the FCC warning,” Snopes reported. “An FCC spokesperson told Snopes that the commission wanted to make sure that their advisory on “juice-jacking,” first issued in 2019 and later updated in 2021, was up-to-date so as to ensure ‘the consumers have the most up-to-date information.’ The official, who requested anonymity, added that they had not seen any rise in instances of consumer complaints about juice-jacking.”
Because you can't chemically detect a circuit based on its use case, but those two items have a low false-negative detection rate?
I've learned never to say never, but ...
If the usb charger outlets being sent to a very federally regulated airports and installed without detection for many years are compromised at the factory, how am I to trust the USB charger I buy at a gas station or Amazon?
As for the professional shampoo confiscators I wouldn't factor them at all.
edit: I like the assertion below, too, that the ports may just be factory compromised and unsafe from the start.
Because quiet infiltration is of more value than a violent attack.
For some of these outlets, you need a screwdriver, a compromised replacement outlet, and 30 seconds. Maybe a friend and some luggage to block cameras.
I have no knowledge into the internal workings of airport security, but I doubt this is a threat they're worried about or looking for. No amount of cameras help with that.
The infeasiblity mostly seems targeting and monitization. You have no clue who or what will plug in, so it's barely useful for directed attacks. And actually getting value (intel or money) when all you know to expect is "a smartphone will connect" is quite hard.
“Security” is not one big umbrella.
The specific people and organizations tasked with protecting air travel are not tasked with protecting the cell phones of the passengers traveling.
Or maybe I toss an orange maintenance vest in my carryon, put it on past security, and rip the fucker apart on the spot. It's hilarious that just below this is a long thread about the impossibility of stopping somebody from installing a tainted outlet. What's to stop me from uninstalling it?
Risk vs reward? Even if you find the right charge station and remove the juicer, your only reward for removing it is knowing that you're stopping someone else from getting juiced. But if you get caught, you face getting charged for vandalism or theft - and might even get blamed for installing it since you'll have it in your possession when you're caught. The value of a charging kiosk probably puts you in the realm of felony charges and maybe there's some upgrade of the charges for doing it within an airport secure zone.
(PD uses the data lines to negotiate power capabilities and requests, so you can't just cut them. Instead you have to implement a little bidirectional firewall. I'd bet you could sell a lot of them, but probably not enough to justify the effort)
https://www.allaboutcircuits.com/technical-articles/introduc...
On the other hand, you don't see power cables with no data transfer capabilities. For phones, the obvious solution would appear to be the fact that when you plug your phone into a power source that also has data capabilities, it defaults to "USB is for power only", and you'd have to manually switch it to data transfer if you actually wanted data transfer.
For laptops... how often do USB-C-charging laptops accept data through the charging port?
To avoid this kind of problem, you need to add an adaptor or cable with the data pins disabled. https://www.amazon.com/dp/B082WDHS22/ref=vp_d_cpf-substitute...
Another advantage of the battery pack is that I'm a lot less worried about leaving a $15 battery pack unattended while I go pick up some food than my $500 phone.
https://www.amazon.com/dp/B082WDHS22/ref=vp_d_cpf-substitute...
[1] https://www.pcmag.com/news/android-tv-box-sold-on-amazon-com...
[2] https://youtu.be/1vpepaQ-VQQ (Youtube)
Of course, that depends on the data blocker itself not being compromised. :-)
The fact that you allow a data connection may be enough to zero-click you.
It’s like putting your computer on the internet and opening ports.
You might think you are fine if you are up-to-date, but the reality is we don’t know about all of the current vulnerabilities and potential buffer overflows until much later.
If what you said is indeed what they meant, then I'd respond that warning the general public of airport charging stations that have been tampered with by some powerful organization potentially burning 0days on randos is a tad overblown.