Those scary warnings of juice jacking in airports and hotels? They’re nonsense
arstechnica.com
arstechnica.com
Get a power bank. They are cheap and even the large ones weigh no more than a pound. They have enough juice to get any phone through a day or 2 of use. You bring it with you everywhere and you never have to think about the battery level in your phone. Notice it's low (single digit percent battery) while out and about, plug in the powerbank and carry on being out and about.
The idea that I would use a public charger attached to a garbage can that I would then need to sit next to for an hour is crazy.
A few years back there was a startup that had kiosks in grocery stores to charge while you shopped (locked into a little cubby hole), but those seem to have disappeared too.
You're anyway stuck in your seat and chances are good that you're low on juice during a day of traveling.
Same goes for trains. Alas, they usually have power outlets.
Given that my boarding passes, train tickets and other vital information is on my phone having power is essential.
As a light traveller I don't want to schlepp an additional gadget.
To each his own, I suppose.
If you let the phone display the prompt, you might infect a couple people but somebody will soon tell the shop staff, or even the police.
If you have a zero day then you are probably targeting some particular people, let's say diplomats, protestors or attendees of an important international conference. The chances of the average person being a victim of these attacks because they charged their phone at a cafe are negligible.
Many airports, planes, and other public areas have these USB charging ports. Either people are using them, or a lot of money is being spent for no reason.
IDK about Android, but iPhones are now randomly generating passwords and storing them in Keychain, which has its own user-friendly 2FA. Solves the password-sharing problem. There's also authentication via Apple. Yeah it's first-party proprietary stuff; there are third-party solutions too, but they're harder for regular people to deal with.
While an incredibly uncommon mode of attack, it's hardly nonsense.
If you're a non-tech savvy but high-risk user who travels quite a bit, it's probably worth taking the precaution of using your own charger and cord. That way you don't have to worry about accidentally approving something on your phone that's going to hijack it.
https://krebsonsecurity.com/2023/04/why-is-juice-jacking-sud...
I wouldn't say it's "nonsense", but it's also not worth worrying about, either. There are tons of these PSAs that are in that same category, and not just for tech stuff.
"Currently they're probably nothing to worry about, but in the future someone is likely to find a way to implement some kind of attack in these things at a scale that matters, so might as well as get in the habit of being careful now."
As someone who rarely has a need for data connection while traveling this would be a real option.
> it’s likely that viable juice jacking attacks are possible, but they’re largely out of reach for the vast majority of hackers
When is hacking such a specialized thing when there are tons of instructions on the darknet for these type of things?
> There are some major limitations, however, that make the O.MG Cable and similar hacking tools unsuitable for the kind of opportunistic juice jacking the FCC and FBI warnings envision. First, the script must be tailored to the specific model of hardware being attacked.
So target the largest common denominator? Even just 5 out of 1000 individuals compromised is a "good day", slurp up that data and sell on the darknet.
> That means it’s infeasible, if not impossible, to create a malicious charging station that could hack more than a very small number of phones in use today.
But a small number is some number. It doesn't matter if it's infeasible, just that it's possible. Target the largest base case - this being the Samsung Galaxies and specific iPhone/iOS versions.
> Additionally, the O.MG cable works only on Apple devices equipped with a USB-C connector.
Android, laptops, etc. Still viable attack vectors. As more and more devices move to USB-C (thanks to the EU) and more devices becoming slimmer - these charging stations are going to look like attractive targets. Surface Pro is now USB-C, and a number of laptops charge via USB-C.
> They create unneeded anxiety and inconvenience that run the risk of people simply giving up trying to be secure.
This is the "low hanging fruit". By conditioning the public to avoid these , they can eliminate this kind of attack almost entirely. It's kind of how we eliminated a large body of diseases by teaching people to wash their hands when they come and go from places. Good hygiene is still good hygiene.
I feel like Ars journalist want people to fall victim to these, just so they can write easy articles.