How Serious Is the Security Threat of ‘Juice-Jacking’?

On April 6, 2023, FBI’s Denver office issued a warning about “juice-jacking,” a form of cyber attack in which information is stolen by installing malware on a person’s phone or other portable device via a public USB port.

“Avoid using free charging stations in airports, hotels or shopping centers,” warned the FBI’s Denver office wrote in a tweet. “Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices. Carry your own charger and USB cord and use an electrical outlet instead.”

(FBI Denver/Twitter)

Five days later, the Federal Communications Commission (FCC) did the same. “Think twice before using public charging stations,” the FCC tweeted on April 11, 2023. “Hackers could be waiting to gain access to your personal information by installing malware and monitoring software to your devices. This scam is referred to as juice jacking.” The FCC also provided a link to its page about the warning.

The warnings were carried widely by the news media. 

But neither the FBI nor the FCC provided any figures about how widespread the threat was. Nor did they explain why they thought it fit to reissue the warning. Snopes did a fact-check on a similar warning from the Los Angeles County District Attorney’s Office in 2019 and found no evidence that the cyber threat was widespread at that time. 

Snopes reached out to both the FBI and the FCC to request data about how widespread the threat of juice-jacking is in 2023. The FBI replied that its tweet was a “standard PSA-type post” that stemmed from the FCC warning. An FCC spokesperson told Snopes that the commission wanted to make sure that their advisory on “juice-jacking,” first issued in 2019 and later updated in 2021, was up-to-date so as to ensure “the consumers have the most up-to-date information.” The official, who requested anonymity, added that they had not seen any rise in instances of consumer complaints about “juice-jacking.” 

Sources