Travelers are advised to avoid using public USB power charging stations in airports, hotels, and other locations because they may contain dangerous malware. The latest official advice on this longstanding debate comes from the Los Angeles County District Attorney’s Office, which has cautioned that “criminals load malware onto charging stations or cables they leave plugged in.” The “dangerous” malware, the officials say, “may infect the phones and other electronic devices of unsuspecting users.”
USB connections were designed to work as both data and power transfer mediums, with no strict barrier between the two. As smartphones became more popular in the past decade, security researchers figured out they could abuse USB connections that a user might think we’re only transferring electrical power to hide and deliver secret data payloads.
The LA District Attorney’s warning [PDF] covers many attack vectors because there are different ways that criminals can abuse USB wall chargers.
The most common way is via “plug-able” USB wall chargers. These are portable USB charging devices that can be plugged into an AC socket, and criminals can easily leave some of these behind “by accident” in public places, at public charging stations.
There are also USB chargers encased directly inside power charging stations installed in public places, where the user only has access to a USB port. However, LA officials say criminals can load malware onto public charging stations, so users should avoid using the USB port, and stick to using the AC charging port instead.
But the LA DA’s warning also applies to USB cables that have been left behind in public places. Micro-controllers and electronic parts have become so small these days that criminals can hide mini-computers and malware inside a USB cable itself. One such example is the O.MG Cable. Something as benign as a USB cable can hide malware nowadays.
Taking all these into account, LA officials recommend that travelers:
- Use an AC power outlet, not a USB charging station.
- Take AC and car chargers for your devices when traveling.
- Consider buying a portable charger for emergencies.
But there are also other countermeasures that users can deploy. One of them is that device owners can buy USB “no-data transfer” cables, where the USB pins responsible for the data transfer channel have been removed, leaving only the power transfer circuit in place. Such cables can be found on Amazon and other online stores.
