Wait! Don’t Plug That In!

By Gennifer Biggs, Exigent Technologies
​
As we head into summer vacation season, let’s talk about the hidden dangers of “juice jacking,” a silly name for stealing data from a device such as a laptop or mobile phone while it’s being charged using a public USB or USB-C charging station. Cybercriminals load malware onto those public USB ports, turning a charging stop in an airport, hotel room, or restaurant into an opportunity for hackers to lock your device or steal personal data!

Juice jacking isn’t the only threat when it comes to traveling. Most people overlook the vulnerability of USB and USB-C ports on their laptops, mobile phones, and tablets. Plugging any of those devices into a charger via USB/USB-C ports exposes your device to malware, as does connecting to public Wi-Fi networks and sharing data via flash drives—all actions that tend to happen when we’re traveling for work or pleasure. Let’s talk about simple tips to avoid these risks.

Don’t Fall Prey to Juice Jacking

Silly as the name sounds, the impact of using a public USB/USB-C outlet for charging any device can be devastating. Not only does this open your device to malware, but that bad code can then be transferred to other devices, such as home PCs or your employer’s network.

To avoid juice jacking:
• Carry your charging cables and adapters, and search out wall outlets instead of public USB charging stations
• Use a portable charger or power bank to recharge your devices on the go
• Use a USB data blocker or "charge only" cable that enables secure mobile charging without exposing your data
• Regularly update your device's operating system and security software
• If you plug your device into a USB port and a prompt appears asking you to select "share data" or "trust this computer" or "charge only," always select "charge only"

The Risks of Public Wi-Fi

Additionally, while we are all guilty of hopping on public Wi-Fi, using those networks is risky. Be watchful for “open” networks; instead, use a secure connection, such as a password-protected hotspot you carry with you.

If you travel often, you also want to set your mobile devices so they won’t automatically connect to available networks. Instead, make sure you thoughtfully review and choose secure network options before your devices leverage Wi-Fi.

Sharing USB or USB-C Drives

External storage devices, such as USB and USB-C drives, can carry various threats that can slip onto personal mobile devices and even infiltrate your employer’s business network via your laptop or phone, potentially leading to cyber attacks. Some USBs can even be used as a remote controller, taking over devices and executing commands. No one intends to create an open door by using a thumb drive that a friend or family member shares—you are likely just trying to swap vacation photos. But malicious code doesn't expire, and it can infect laptops and other devices repeatedly. Older storage devices often use outdated software that opens the door to modern hackers, so consider your USB a "legacy solution" and therefore, vulnerable.

Beware of "gift" USBs that can be giveaways at conferences or sent as "incentives" from hackers who are impersonating reputable vendors. Protect your devices by making it a rule to never plug in any storage device that you haven't been in control of since it was acquired (and that means purchased). Don't share or swap USB storage devices, regardless of whether they seem "safe" or not. USB/USB-C

Safeguards for Businesses

If your organization has employees who frequently travel, it’s best to establish corporate policies that advise employees on secure mobile charging best practices, stress public USB port safety, and offer preventative measures to avoid juice jacking. Those policies should also address the ways public Wi-Fi networks are used, since those are another common opening for cybercriminals targeting remote or traveling employees. As your family hits the road this summer, keep vigilant with your chargers and flash drives. Enjoy those vacations safely!

​Interested in learning more about cybersecurity best practices? Check out Exigent’s TechWise blog. [https://www.exigent.net/techwise-blog]