USB hygene

[DeniseTr]

So a lot of people don't know that you should never plug your phone usb charger into a USB charger at the airport. That can lead to an infected phone. 

https://www.fcc.gov/juice-jacking-tips-to-avoid-it

 

it just occurred to me that can apply equally to hotels and cruise ships. 

 

Going to order something similar to the product below. Anyone have a product that they use?

 

PortaPow USB Data Blocker (Black) - Protect Against Juice Jacking https://a.co/d/cVugQbr

[angelsfort]

or you can save your money and just turn your phone off while you're charging it.  I'm pretty sure they can't install any sort of malware on your device if it's off

[mz-s]

Juice jacking is mostly theoretical at this point. Your phone will ask you if you trust what you just plugged in, and if you say no it will just charge and not allow any data transfer. However, if you want to be certain, just use a power brick plugged into the 120V socket, and don’t worry about it. 

Edited 13 hours ago by mz-s

[aborgman]

Just get (or make) a power only USB cable.

 

 

[Charles4515]

1 hour ago, DeniseTr said:

So a lot of people don't know that you should never plug your phone usb charger into a USB charger at the airport. That can lead to an infected phone. 

https://www.fcc.gov/juice-jacking-tips-to-avoid-it

 

it just occurred to me that can apply equally to hotels and cruise ships. 

 

Going to order something similar to the product below. Anyone have a product that they use?

 

PortaPow USB Data Blocker (Black) - Protect Against Juice Jacking https://a.co/d/cVugQbr

Despite all the police department and media hysteria no one has been juice jacked. It is theoretical. It would be difficult. Probably only a government could do it. Since I stay at hotels that have USB A ports and no USB C ports and all my devices use USB C now I travel with USB A to USB C adapters. I have the data blocking version but at this point it is overkill but the adapters are pretty cheap. The adapters are for convenience not really worried about juice jacking. Not at all likely on a cruise ship or a hotel. 

 

 https://www.amazon.com/gp/product/B0C5D5DP96/ref=ppx_yo_dt_b_asin_image_o03_s00?ie=UTF8&psc=1

Edited 12 hours ago by Charles4515

[aborgman]

53 minutes ago, Charles4515 said:

Despite all the police department and media hysteria no one has been juice jacked. It is theoretical. It would be difficult. Probably only a government could do it.

 

1) There is no evidence anyone has ever done it in the wild

2) The demonstrations of it being done have been by university researchers and regular old hackers, so it definitely doesn't require government resources.

 

Defcon has had a display called the "Wall of Sheep" since 2011 that has had juice jacking USB ports.

 

[totz808]

Personally I don't think it's much of a concern, but if it truly bothers you just use your own charger from a wall outlet.  If you need multiple USB ports bring your own USB charging station.  I don't use ship or hotel USB ports either really because they actually tend to be in terrible shape, so I just plug into my own devices.

[jdcml]

If it was an ongoing issue, it seems like the perpetrator would intentionally utilize a higher traffic area.  An airport could have 20+ people per day plugged in to an outlet.  A cabin with a device that changes out every 7 days isn't too awfully lucrative.  On top of that, can you imagine the lag in trying to collected any sort of data on the ship's wifi 🙂.  I feel pretty comfortable that the vast majority of CCL travelers don't meet the target market criteria if something like this actually existed.  

 

 

[BlerkOne]

You should be more concerned with people hijacking your credit card. Wifi in an airport or on a plane is far from secure.

[aborgman]

20 minutes ago, BlerkOne said:

You should be more concerned with people hijacking your credit card. Wifi in an airport or on a plane is far from secure.

 

That is presumably what they would be doing if juice jacking - pulling out stuff like stored credit card and ApplePay data from the phone/tablet.

 

Or potentially like about half of hackers - they aren't really trying to accomplish anything other than access for fun. Lots of hacks aren't folks trying to steal anything, just folks trying to screw with people for entertainment.

 

[BlerkOne]

1 minute ago, aborgman said:

 

That is presumably what they would be doing if juice jacking - pulling out stuff like stored credit card and ApplePay data from the phone/tablet.

 

Or potentially like about half of hackers - they aren't really trying to accomplish anything other than access for fun. Lots of hacks aren't folks trying to steal anything, just folks trying to screw with people for entertainment.

 

More likely with card skimmers, A mobile skimmer and a juice jacker occur with about the same frequency. Thread jacking is much more common.

[aborgman]

Just now, BlerkOne said:

More likely with card skimmers, A mobile skimmer and a juice jacker occur with about the same frequency. Thread jacking is much more common.

 

Juice jacking has basically never happened in the wild.

 

Card skimming is happening thousands of times per day, all over the world, and regularly get caught.

 

As for "mobile skimming", we know it happens  - using NFC enabled cell phone to grab credit card RFID data, car key fob codes, and garage door opener codes.

[BlerkOne]

20 minutes ago, aborgman said:

As for "mobile skimming", we know it happens  - using NFC enabled cell phone to grab credit card RFID data, car key fob codes, and garage door opener codes.

Only subset of those are credit cards. Yes, I know it happens. I had a debit card remotely read in the Buenos Aires airport and almost immediately started receiving alerts from the bank. i would have missed my flight waiting on hold for the fraud department but was able to shut the card down via the bank app and, of course, wifi - perhaps a bigger risk, but things were time critical.

[aborgman]

15 minutes ago, BlerkOne said:

Only subset of those are credit cards. Yes, I know it happens.

 

"A mobile skimmer and a juice jacker occur with about the same frequency"

Mobile skimmer frequency > 0.

Juice jacker frequency = 0.

 

[BlerkOne]

52 minutes ago, aborgman said:

 

"A mobile skimmer and a juice jacker occur with about the same frequency"

Mobile skimmer frequency > 0.

Juice jacker frequency = 0.

 

I don't believe juice jacking is impossible or that we actually know if there have been any occurrences.

 

About makes the time, number or quantity less specific and more approximate: …

See puffery

[ishap]

This is always a concern with public USB charging ports, but while the likelihood is very low at an airport, it is pretty much non-existent on a cruise ship.  The people that would be behind this type of attack would have to be someone working on the ship, otherwise how would they get the data out?  They wouldn't have persistent wi-fi to send the data, nor would they be able to easily get back to the device physically.

 

I would be more concerned with credit card skimmers at gas pumps.  Those actually do occur.

[aborgman]

11 minutes ago, BlerkOne said:

I don't believe juice jacking is impossible or that we actually know if there have been any occurrences.

 

About makes the time, number or quantity less specific and more approximate: …

See puffery

 

1) We know juice jacking isn't impossible - because researchers/hackers have been demonstrating it for about 15 years.

 

2) We know that we've never caught an example of juice jacking in the wild - doesn't mean it doesn't happen, but it has never been discovered.

 

3) We know that we have caught THOUSANDS of mobile skimmer cases in the wild.

 

We don't know if there have been any cases of juice jacking in the wild, we absolutely DO know that there have been thousands of mobile skimmer cases in the wild.

 

So - mobile skimming, 100% confirmed. Juice jacking - currently unconfirmed.

 

 

[aborgman]

13 minutes ago, ishap said:

TThe people that would be behind this type of attack would have to be someone working on the ship, otherwise how would they get the data out?  They wouldn't have persistent wi-fi to send the data, nor would they be able to easily get back to the device physically.

 

Bluetooth (most common for skimmers).

Xbee.

Built in WiFi on the microcontroller doing the jacking.

Infrared.
Nearlink.

NFC.

 

 

As for "wouldn't be able to get back to the device physically" - 70% of ATM skimmers don't use any wireless transmitters, and crooks have little problem getting those back - and they have much, much tighter security than any public USB ports.

 

A feed through overlay USB port held on with double sided tape could be installed/removed in a couple seconds.

[Charles4515]

24 minutes ago, ishap said:

 

I would be more concerned with credit card skimmers at gas pumps.  Those actually do occur.

Finally the gas station pumps I use have take Apple Pay. 

[BlerkOne]

3 hours ago, aborgman said:

 

"A mobile skimmer and a juice jacker occur with about the same frequency"

Mobile skimmer frequency > 0.

Juice jacker frequency = 0.

 

The beauty of English is that it is ambiguous. Trying to apply math to it is illogical.

 

About can mean anything. What it is least likely to mean is exactly the same.

[ishap]

1 hour ago, aborgman said:

 

Bluetooth (most common for skimmers).

Xbee.

Built in WiFi on the microcontroller doing the jacking.

Infrared.
Nearlink.

NFC.

 

 

As for "wouldn't be able to get back to the device physically" - 70% of ATM skimmers don't use any wireless transmitters, and crooks have little problem getting those back - and they have much, much tighter security than any public USB ports.

 

A feed through overlay USB port held on with double sided tape could be installed/removed in a couple seconds.

 

I was talking on the cruise ship.  Unless they were a cruise ship employee, how would they get physical access to a room to install a USB port that didn't look completely hokey?  and get back to it to remove it in order to get the data?

[SRQbeachgirl]

Most of the usb ports I have tried at hotels are so awful it my phone tells me it would take hours and hours to charge. Instead I just carry my own multi-port and plug it into a regular electrical socket.

[BlerkOne]

1 hour ago, ishap said:

 

I was talking on the cruise ship.  Unless they were a cruise ship employee, how would they get physical access to a room to install a USB port that didn't look completely hokey?  and get back to it to remove it in order to get the data?

I think that was, or should have been, obvious.