Attackers Using Public USB Outlets to Spread Malware, FBI Warns

The FBI has warned that charging your phone via a USB cable from a free charging station could be the worst decision you ever make regarding security.

We often advise people to avoid free Wi-Fi networks or at least use a VPN solution when connecting to an unknown Wi-Fi, as attackers can control wireless networks to capture all traffic from the victims' devices. But connecting your phone to an unknown outlet that supposedly provides free charging is infinitely worse.

Some businesses, such as airports, hotels or shopping centers, provide clients with free charging stations, which sounds excellent. Unfortunately, such interfaces can prove an ideal hunting ground for hackers. Imagine how much effort criminals put into compromising ATMs, for example, a place with a lot more security.

"Avoid using free charging stations in airports, hotels or shopping centers," says the FBI. "Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices. Carry your own charger and USB cord and use an electrical outlet instead."

The existence of cables modified to carry malware is nothing new, but attackers could also implement such attacks by compromising the USB outlet itself, especially given that these locations don't have the same level of security as a bank's ATM.

The attack, also known as "juice jacking," has been around for over a decade. The fact that anyone can simply buy a "malicious" cable and leave it lying around is worrying enough, and it falls into the same category as the attacks using a "lost" USB drive.

The bottom line is simple. Don't plug your phone into unknown charging ports; use your charger and USB cable. Since this type of attack has been known to affect iOS devices in the past, it's good to follow the same advice even if you don’t use an Android device.