Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Hey there,
Speaker 1: and welcome to tech Stuff. I'm your host, Jonathan Strickland.
Speaker 1: How the tech are you? So I got got by that?
Speaker 1: I mean I regurgitated some tech news that I saw
Speaker 1: without actually taking the steps to make sure there was
Speaker 1: something substantial behind that tech news. And that's a failure
Speaker 1: on my part. And it shows that critical thinking is
Speaker 1: a skill that you have to actively practice. It's not
Speaker 1: something that just magically happens. So what got me? Well,
Speaker 1: recently in a tech News episode, I talked about how
Speaker 1: the FBI and the FCC, both official US government agencies,
Speaker 1: issued new warnings about using public charging ports for your
Speaker 1: mobile devices, you know, ports in places like hotels and
Speaker 1: airports and coffee shops, that kind of thing, and that
Speaker 1: hackers could have potentially compromised those ports so that while
Speaker 1: it appears that you're charging your phone or your tablet
Speaker 1: or whatever, some nefarious criminal, probably wearing a hoodie, sitting
Speaker 1: in the dark someplace in front of a monochromatic computer
Speaker 1: monitor that only can show green text, that person is
Speaker 1: actively hijacking your phone and stealing all of your moneys
Speaker 1: and stuff. In the parlance of cool security kids. This
Speaker 1: practice is called juice jacking. That you have jacked the
Speaker 1: charging station to spread malicious code. While this warning was recent,
Speaker 1: there have been multiple incidents of authorities warning people against
Speaker 1: using the these kinds of charging ports over the years.
Speaker 1: Back in twenty nineteen, the District Attorney's Office of Los
Speaker 1: Angeles County issued a similar advisory. Their warning red quote
Speaker 1: travelers should avoid using public USB power charging stations in airports, hotels,
Speaker 1: and other locations because they may contain dangerous malware end quote,
Speaker 1: and the office went on to suggest that people use
Speaker 1: AC power outlets and an adapter in order to charge
Speaker 1: their devices and to avoid the possibility of someone compromising them.
Speaker 1: And that wasn't the first such warning either. They go
Speaker 1: back quite a way. Is because there were demonstrations as
Speaker 1: far back as around twenty eleven twenty twelve at events
Speaker 1: like Defcon that showed how a hacker could potentially compromise
Speaker 1: a device using a malicious charging station. But here's the
Speaker 1: reason I say that I got got. There are no
Speaker 1: records of someone falling victim to juice jacking out in
Speaker 1: the wild. There are no cases in which hackers have
Speaker 1: taken over a public charging station, or created a fake
Speaker 1: charging station that looks like the real thing, and then
Speaker 1: use that to implant malware on devices in the general public.
Speaker 1: Such a thing is technically possible, but it's tricky on
Speaker 1: several levels. For one thing, a hacker would need physical
Speaker 1: access to the area, and they would also need to
Speaker 1: avoid notice while installing a malicious charging station. For stuff
Speaker 1: that's built into things like tables and seating areas, I'm
Speaker 1: thinking about like the long line of seats in an
Speaker 1: airport waiting area, where you typically will have a little
Speaker 1: station in between every couple of seats or so that's
Speaker 1: hard to do. If you're in a high traffic environment
Speaker 1: like an airport, it's tricky to get that access. It's
Speaker 1: not impossible with little social engineering. You might pose as
Speaker 1: like an IT maintenance person and you're there to repair
Speaker 1: or to upgrade a system, and maybe after a brief conversation,
Speaker 1: no one gives you much thought and you can go
Speaker 1: about doing it. So it's not like it's impossible. You
Speaker 1: could do it with a bit of effort. But that's
Speaker 1: the first barrier, and there are other challenges as well.
Speaker 1: Malware can spread via USB. That is true, like you
Speaker 1: could connect two devices via USB and send malware from
Speaker 1: one to the other. However, malware is not magically universal.
Speaker 1: It's not like a skeleton key that works on every device.
Speaker 1: This is one of those things that really gums up
Speaker 1: the plot to Independence Day. Right Like in the movie
Speaker 1: Independence Day, you have Jeff Goldbloom creating malware on a
Speaker 1: Mac of all things, and then using that malware to
Speaker 1: transfer over to the alien's computer systems to bring down
Speaker 1: the alien defenses. Well, without knowing how the alien computer
Speaker 1: systems work, and to build your own system that works
Speaker 1: exactly that way, you can't do this. You cannot create
Speaker 1: malware that just magically works to whatever hardware and operating
Speaker 1: system environment it encounters. Malware is not that adaptable. Of course,
Speaker 1: you could argue, and I have heard this argument that
Speaker 1: Mac computers are not actually the outpouring of work from Apple,
Speaker 1: but in fact trace their lineage back to the crashed
Speaker 1: Roswell alien ship, and that all computer systems were really
Speaker 1: just built on alien technology. But then, how did you
Speaker 1: figure out how the alien technology worked in the first place.
Speaker 1: We're going down a rabbit hole. I don't need to
Speaker 1: the point being that malware does not magically adapt to
Speaker 1: its environment. It needs to be designed for that environment.
Speaker 1: So for malware to work, a hacker has to design
Speaker 1: it for a particular operating system, and malicious code that
Speaker 1: works on Windows machines generally won't work on say, Android
Speaker 1: devices or iOS devices, So creating the back end that
Speaker 1: is responsible for injecting malware into the targets is also
Speaker 1: hard to do. Your average hacker isn't going to have
Speaker 1: access to the tools to build something that is effective
Speaker 1: against multiple platforms. Such things do exist, but they are
Speaker 1: expensive to develop and to deploy. We're talking like stuff
Speaker 1: that state backed hackers are getting paid tens of thousands
Speaker 1: or hundreds of thousands of dollars in order to develop
Speaker 1: and deploy. Your average hacker just doesn't have access to
Speaker 1: this kind of stuff. Now, maybe the hackers really just thinking, oh,
Speaker 1: most folks have an Android device, so I'm just going
Speaker 1: to build something for that, and I'm not going to
Speaker 1: worry about the IOA users. Or maybe they're thinking, my
Speaker 1: preferred targets are iPhone users because they're known to use
Speaker 1: their devices to do things like make purchases more frequently,
Speaker 1: and they might target iOS devices and not worry about
Speaker 1: the Android users, and so in other words, they're just
Speaker 1: narrowing their pool of targets from the get go. That's possible,
Speaker 1: but it gets more granular even than that, because a
Speaker 1: lot of attacks aren't just operating systems specific. They are
Speaker 1: hardware specific. For attacks that are really good at infiltrating
Speaker 1: and converting target devices into hacker devices. So let's say
Speaker 1: you have a Pixel phone and the person next to
Speaker 1: you has a Samsung Galaxy phone, and you both charge
Speaker 1: it into one of these compromised charging stations. Well, the
Speaker 1: malware might work on them, but not on you, because
Speaker 1: the malware needs to exploit specific quirks of the Galaxy
Speaker 1: phone the hardware itself that the Pixel just doesn't have.
Speaker 1: The can be really impressive in this case. There are
Speaker 1: examples of security experts who have created devices that can
Speaker 1: turn a particular model of phone into a hacker's plaything
Speaker 1: in just seconds, but only under those specific parameters. It's
Speaker 1: not like if you plugged it into a different phone
Speaker 1: it would still work. No, it only works in that
Speaker 1: one device, compromising or creating a public charging station in
Speaker 1: the hopes that someone with that specific model of phone
Speaker 1: plugs into that specific charging station. That's the sort of
Speaker 1: gamble that's just not likely to pay off. But there's
Speaker 1: even more technical challenges we need to talk about. Modern
Speaker 1: smartphone operating systems will alert users to a requested file
Speaker 1: transfer when you connect it to another device like a computer,
Speaker 1: and users then have to acknowledge and allow that file
Speaker 1: transfer to actually happen. So if you were to plug
Speaker 1: your device into one of these hacker controlled charging stations
Speaker 1: and their intent was to inject malware on your device, well,
Speaker 1: your phone would essentially say, hey, bud, listen that thing
Speaker 1: what you got me plugged into? It wants to send
Speaker 1: a file your way? You cool? And you just choose Nah,
Speaker 1: bra I ain't cool, and then boom, no malware gets
Speaker 1: pushed to your device. Now could hackers figure out a
Speaker 1: way to bypass this, Well, technically yes, there could be
Speaker 1: a zero day vulnerability that no one but the hackers
Speaker 1: know about. There are tools in the cybersecurity field that
Speaker 1: do this sort of thing, but they typically require an
Speaker 1: extended contact with the device, as ours technicup points out
Speaker 1: the security tool gray Shift, which is designed to access
Speaker 1: lock devices in order to pull data. It's the kind
Speaker 1: of thing that law enforcement agencies would end up purchasing
Speaker 1: and using. This tool can require up to three days
Speaker 1: with a device in order to actually be able to
Speaker 1: pull data from it. So unless you're posted up to
Speaker 1: this charging station for several days in a row, you're
Speaker 1: not likely to have that problem. Now, I will say
Speaker 1: that this does add more complexity to the operation. It's
Speaker 1: also really expensive. The gray Shift tool costs around thirty
Speaker 1: grand to use, plus security updates from companies like Google
Speaker 1: or Apple can shut down the methodology that gray Shift
Speaker 1: uses to pull data in the first place, which means
Speaker 1: it's back to the drawing board. This will only work
Speaker 1: as long as the vulnerability exists, and if the vulnerability
Speaker 1: is patched well, then that door is shut. Right. So,
Speaker 1: as operations get more complex and expensive, the likelihood of
Speaker 1: encountering them begins to approach zero. Okay, we're on the precipice,
Speaker 1: so we're going to take a quick break. When we
Speaker 1: come back, I will talk about why I say I
Speaker 1: got got okay. Before the break, I said that as
Speaker 1: the complexity and expense of an operation increases, the likelihood
Speaker 1: that you're going to encounter it approaches zero. As it
Speaker 1: turns out, zero is where we end up. At least
Speaker 1: that's where we are when it comes to hijacked recharging
Speaker 1: stations that are in the public there is a total
Speaker 1: lack of documented cases in which it has happened. Now,
Speaker 1: this was an article that I used for This is
Speaker 1: from Ours Technica I mentioned earlier. It was written by
Speaker 1: Dan Gooden. He went so far as to really look
Speaker 1: into this rather than do what I did, which was
Speaker 1: just repeat an advisory without looking into it further. So
Speaker 1: Gooden did the right thing. Then I screwed up. And
Speaker 1: when we look back at that twenty nineteen advisory that
Speaker 1: was issued in Los Angeles, we see a similar issue.
Speaker 1: So Gooden's talking about the more recent FBI and FCC
Speaker 1: joint advisory. But if we look at the Los Angeles
Speaker 1: one and you just do a quick search on it, well,
Speaker 1: it brings up a Snopes page. It has been so
Speaker 1: long since I've been on Snopes. I used to go
Speaker 1: to that website all the time. And the Snopes judgment
Speaker 1: comes down to this being a quote unquote mixture of
Speaker 1: truth and falsehood. So the Snopes page mentions that tech
Speaker 1: Crunch had previously reached out to the Los Angeles County's
Speaker 1: chief prosecutor to ask about any cases involving juice jacking.
Speaker 1: They said, well, how many instances have you encountered of
Speaker 1: this practice, and the office said that they hadn't, They
Speaker 1: had no documented cases. And so then tech Crunch said, so,
Speaker 1: what's up with pushing out an advisory for something that
Speaker 1: you don't even have evidence of happening, And they said, well,
Speaker 1: it is really part of an awareness building campaign for security.
Speaker 1: And again this gets back to the fact that it
Speaker 1: is technically possible to do, and maybe a user would
Speaker 1: even click through an acknowledgement of a filed transfer thinking
Speaker 1: it was just another step toward charging, and thus allow
Speaker 1: their phone to be compromised. But the fact remains there
Speaker 1: still are no documented cases of juice jacking out there,
Speaker 1: And when you think about the difficulty of the task
Speaker 1: and the small number of successful hits that you're likely
Speaker 1: to get as a hacker, you start to see why
Speaker 1: it's not really a thing. It could be a thing,
Speaker 1: but so far it's not. And let's take it from
Speaker 1: the hacker point of view. Let's say that your goal
Speaker 1: is to infect as many devices as possible for whatever reason.
Speaker 1: Maybe you're trying to get your malware to a specific target,
Speaker 1: but you don't have access to that target, so instead,
Speaker 1: you're thinking, well, I'll just infect as many devices as
Speaker 1: I can so that someone somewhere possibly passes this malware
Speaker 1: to my actual target. It's kind of a long shot,
Speaker 1: sort of a long play strategy, but it's also something
Speaker 1: that we have seen in the past, particularly with state
Speaker 1: backed malware attacks. Stucksnet was technically this kind of approach,
Speaker 1: although it was through secondary targets. We assume it was
Speaker 1: the United States and Israel targeting some specific companies that
Speaker 1: were supplying software to the Iranian nuclear power program, and
Speaker 1: that because they could not access the nuclear program itself,
Speaker 1: US and Israel we assume targeted the suppliers for that
Speaker 1: nuclear power program. That's all. They got the malware to
Speaker 1: the targeted destination. So that is something that does happen.
Speaker 1: But more likely the hacker's motive is just to infect
Speaker 1: devices in order to harvest data or perhaps get access
Speaker 1: to stuff like bank account information and that kind of thing.
Speaker 1: So how do you go about doing this if you're
Speaker 1: the hacker, Well, one thing you could do is run
Speaker 1: a really broad phishing campaign. You're casting a really wide net.
Speaker 1: This approach requires a little work on the back end,
Speaker 1: but not a whole bunch it's relatively light work compared
Speaker 1: to other methods, and it can touch a large number
Speaker 1: of people. Like you can't really predict who's going to
Speaker 1: see it necessarily, but you can target millions if you want,
Speaker 1: and all the people who encounter the effort, maybe only
Speaker 1: a few are likely to fall for it, but still,
Speaker 1: if your attack is seen by tens of millions of
Speaker 1: people and you get just a couple of percentage points
Speaker 1: worth of victims out of it, that's still a lot
Speaker 1: of victims. Another thing that you could do is you
Speaker 1: might set up at a public space and either compromise
Speaker 1: the local public Wi Fi or you create a hot
Speaker 1: spot of your own and you pose as public WiFi. Now,
Speaker 1: all the wireless traffic going through your hotspot is yours
Speaker 1: for the sniffing, and you don't have to tamper with
Speaker 1: any physical hardware in the area to do it. I mean,
Speaker 1: you could if you wanted to try and actually compromise
Speaker 1: the physical routers and such of the space, But if
Speaker 1: you wanted to just set up an alternative that looks official,
Speaker 1: you don't even have to touch any of the infrastructure
Speaker 1: that's already there. Now, the downside to this approach is
Speaker 1: that you are very location based, so your pool of
Speaker 1: targets is much smaller. But the good news is you're
Speaker 1: likely to have a much higher percentage of hits within
Speaker 1: that small pool, so your goal is still met. Both
Speaker 1: of those methods are lower risk and higher reward than
Speaker 1: hijacking a public charging station, and you don't have to
Speaker 1: worry so much about the devices themselves giving you away
Speaker 1: by alerting the user that something hinky is going on.
Speaker 1: So from a return on investment perspective, it makes way
Speaker 1: more sense to do a different approach than to rely
Speaker 1: on a physical connection between your malware injection system and
Speaker 1: target devices, unless, and this is a big exception, we're
Speaker 1: talking about targeting a specific person or specific group. So
Speaker 1: if you're the equivalent of James Bond, and it's your
Speaker 1: job how to figure out to you know you're going
Speaker 1: to compromise the phone that's belonging to, say, the ambassador
Speaker 1: of fre Donia, that's a made up nation in the
Speaker 1: Marx Brothers movie Duck Soup. Well, maybe you do install
Speaker 1: some hardware in an attempt to access that device. Maybe
Speaker 1: you do create some fake charging stations, you get access
Speaker 1: to a space that the Ambassador of Fredonia is going
Speaker 1: to be in and you put in these compromising devices
Speaker 1: in that space. So if we're talking about a potentially
Speaker 1: high value target like a politician or the CEO of
Speaker 1: a prominent company, or maybe really high profile journalists or
Speaker 1: something like that, well then they might encounter something that
Speaker 1: is similar to a fake charging station, but most of
Speaker 1: us won't because the trouble of making it and to
Speaker 1: keep it up to date as devices get security updates
Speaker 1: is just way too much work for way too little reward.
Speaker 1: So it sounds like the threat of juice jacking is
Speaker 1: similar to what we hear every year as Halloween rolls around,
Speaker 1: or at least I used to hear it that parents
Speaker 1: need to check every single piece of candy to make
Speaker 1: sure some malicious person hasn't hidden poison or razor blades
Speaker 1: in there. Now, in the case of poison, there's no
Speaker 1: documented evidence of that ever happening, but there have actually
Speaker 1: been a few cases of people putting pins or other
Speaker 1: sharp objects into stuff like apples at Halloween, though it
Speaker 1: often ends up turning out that it was a kid
Speaker 1: doing it purposefully to drum up drama. So in other words,
Speaker 1: the awareness campaign becomes a self fulfilling prophecy that convinces
Speaker 1: people to do the thing that the warning is about.
Speaker 1: So end result here, The type of attack mentioned in
Speaker 1: the FBI and FCC warnings is technically possible, but it's
Speaker 1: not practical. Not a wide deployment, and not as a
Speaker 1: way to create a wide spectrum attack that's going to
Speaker 1: hit a lot of targets. It's technically difficult to pull off.
Speaker 1: It requires access to infrastructure that isn't necessarily easy to get.
Speaker 1: As security patches go out, the methods become ineffective. It's
Speaker 1: expensive to develop and deploy. So is it possible someone
Speaker 1: could do this and that people could fall a victim
Speaker 1: to it? Yeah, but so impractical that it's extremely unlikely
Speaker 1: to happen. There are lots of other security threats that
Speaker 1: are far more pressing, so it's kind of weird that
Speaker 1: we even get these warnings. I'm actually not sure what's
Speaker 1: driving the push for that unless there is some top secret,
Speaker 1: highly classified document containing countless cases of juice jacking that
Speaker 1: for some reason are not allowed to be acknowledged. That's
Speaker 1: the only way I could figure that this is a
Speaker 1: real problem. It doesn't look like it actually is, so
Speaker 1: my apologies for being part of this machine of spreading
Speaker 1: a message that really isn't that important. I should have
Speaker 1: checked further into it. I could give you all excuses,
Speaker 1: like how I'm the only person writing and researching this show,
Speaker 1: but that's kind of lane. So instead, I'll just remind
Speaker 1: you critical thinking is important, even when I forget to
Speaker 1: do it myself. That's all. I hope you're all well,
Speaker 1: and I'll talk to you again really soon. Tech Stuff
Speaker 1: is an iHeartRadio production. For more podcasts from iHeartRadio, visit
Speaker 1: the iHeartRadio app, Apple Podcasts, or wherever you listen to
Speaker 1: your favorite shows.