Don't use public USB rechargers (says FBI)

Portable recharging battery packs: the simplest way to avoid being 'juice-jacked'.

Image © Alistair Dabbs

The Federal Bureau of Investigation issued a public service announcement via Twitter on 6 April telling US citizens to "avoid using free charging stations in airports, hotels or shopping centres".

Apparently unaware of the irony, the FBI's tweet goes on to explain: "Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices."

Why irony? Privacy campaigners might point out that the FBI itself is no stranger to using underhand methods to spy on its own citizens. But the organisation has a point. And it's a piece of advice that travelling journalists would be wise to observe.

So-called "juice jacking" involves installing malicious code into public charging stations. This code transfers itself onto devices that are plugged into the sockets. Personal information and authentication keys can then be stolen, and in some cases the phone may even be tracked.

The issue arises from the way the USB standard was designed. The "Universal Serial Bus" standard specifies connectors that deliver a small amount of power as well as fulfilling their original principal function of transferring data between devices. Over recent years, the former function has almost completely eclipsed the latter, as far as the general public is concerned. Ubiquitous USB cables are commonly regarded as simple power supply conduits rather than a potential data-transfer risk.

In principle, it is easy to avoid being juice-jacked. Not all USB cables are wired to carry data: many are intended exclusively for powering or recharging. Simply use one of these "non-data" or "power-only" USB cables when recharging on the go, and you should be safe.

Even if you use the wrong cable, a message should normally appear on your device's display that asks how you want to connect. If you plug into a public recharging station and it requests your permission to allow data transfers - something a recharging station has no business doing - then it's a bit of a giveaway.

To be on the safe side, Tim Collins, chief technical security advisor at Technical Risk Control, recommends using data blocker gadgets while travelling. "I keep a few in my travel kit and use them to isolate the power charging lines in public USB charging ports at hotels, airports and so on."

A data blocker looks like a small USB-key storage drive and is essentially a dumb USB sleeve that allows power to pass through but lacks any wiring to carry data. So even if you use a data cable, there is literally nowhere for data to go. This is a pure hardware solution without any sneaky hackable backdoors.

USB data blockers cost around £6 to £12 each, or less if you buy them in multipacks, from tech and electrical retailers including Amazon.

Better still, do as the FBI suggests and entirely avoid using public recharging stations, or indeed those in hotel rooms. Instead, buy a portable recharging battery pack and always recharge from that. Ensure the battery pack itself is only charged from a power source that you have good reason to believe has not been interfered with, such as a power socket in your own home.

Note that the days of cheap phone rechargers the size of disposable cigarette lighters are long gone, unless you still do business on a Nokia 3310. Be prepared to invest in something at least similar in size to your mobile phone. Buy a bigger and heavier one and it may keep your laptop going for an extra half an hour too.

My portable battery pack, pictured at the top of this article, can even be recharged by solar power on sunny days. Doing so is much slower than plugging it into the mains but at least I can be 100 per cent sure that nobody has hacked the sun.

Not yet, anyway.

© Alistair Dabbs