Nessel: beware ‘juice jacking’ at public charging stations | Michigan

(The Center Square) – Michigan Attorney General Dana Nessel is warning consumers about another method hackers use to steal their personal data.

The FBI calls it “Juice Jacking,” a cyber-theft tactic that occurs when an electronic device is plugged into a public charging station like those found in airports or hotel lobbies.

Bad actors can secretly install malware into public charging stations, such as at an airport or a small business. When unsuspecting consumers plug in their devices, the malware gains access to the device being charged. The malware can lock the device or export personal data and passwords.

Juice jacking can happen by plugging a device into a public USB port with the user’s own charging cable, or by using an infected cable provided by someone else. The Federal Communications Commission has even reported incidents of infected cables being given away as promotional gifts. In some cases, hackers will install and hide a skimming device inside the USB ports of the kiosk.

“This is yet another nefarious way bad actors have discovered that allows them to steal and profit from what doesn’t belong to them,” Nessel said in a statement. “Consumers typically don’t think twice before plugging into a public charging station. But knowing the risks and alternatives will allow them to protect themselves and their personal information.”

Nessel suggested the following tips to avoid becoming a Juice Jacking victim.

• Avoid using a public USB charging station. Use an AC power outlet instead.
• Bring an AC outlet charger, car chargers, and your own USB cables with you when traveling.
• Carry a portable charger or external battery.
• Consider carrying a charging-only cable (which prevents data from sending or receiving while charging) from a trusted supplier.
• If you plug your device into a USB port and a prompt appears asking you to select “share data” or “charge only,” always select “charge only.”

“Be vigilant when charging your devices in public because you never know who or what is waiting to snatch your data when you least expect it,” Nessel said.