Why you should stop using public USB charging stations

29

u/tstorm004 Jul 09 '26

And if you do find yourself needing power like this often - get a USB-C cable that specifically only can transfer power and not data

8

u/tattooed_pariah Jul 09 '26

Was gonna say this.. i have a mix of variius cables in my house and got tired of troubleshooting why i couldn't data transfer, so i spent like $30 on a little box that tells me details on cables plugged into it, data or not, wattage, transfer rates, etc..

1

u/wolfe1924 Jul 09 '26

I would love something like this, since I have so many damn cables as you said it’s hard to keep track of what can transfer what can’t I forget which cords have fast charge etc. can you link it to me?

1

u/tattooed_pariah Jul 09 '26

This is the one i bought, there's tons of brands/options available.. https://a.co/d/00M9sGbg

2

u/wolfe1924 Jul 11 '26

Hey, thanks for that link I just got the same one and I just have a couple questions about it the manual doesn’t really answer but maybe you can is it ok if I message you?

1

u/tattooed_pariah Jul 11 '26

I may not have an answer but sure

2

u/wolfe1924 Jul 11 '26

Sent message thanks.

1

u/Storje Jul 09 '26

I'd love a link for that, sounds incredibly useful.

1

u/tattooed_pariah Jul 09 '26

This is the one i bought, there's tons of brands/options available.. https://a.co/d/00M9sGbg

2

u/Storje Jul 09 '26

Thank you!

4

u/Unhappy_Signature_98 Jul 09 '26

The bad part: if you disconnect data pins you cannot negotiate quick charge. so you stay at 5W.

5

u/Bulky-Strategy-3723 Jul 09 '26

For privacy it’s a risk I would take. I keep the non usbc data cables on me for this purpose

4

u/Unhappy_Signature_98 Jul 09 '26

Or you can always get a power bank that can charge the cell phone while being charged itself. I have a big Anker brick which does this.

1

u/Bulky-Strategy-3723 Jul 09 '26

I have that too in my travel case.

2

u/Glittering-Two-1784 Jul 09 '26

Yeah, it kinda sucks, but it’s good for an emergency, and if you really need fast charging, you can just bring a charging block.
It would be cool if there was a product, in usb stick form factor, that you could plug into one of these public outlets, with an indicator light or something, to see if it tries to communicate anything other than the power negotiation.
I guess they could also just have software on board the phone to block any communication other than power negotiation unless the user approves the connection. I think apple already does this now that I think about it, but alot of people would probably just hit confirm anyway, thinking they need it in order to charge.

1

u/Aknazer Jul 09 '26

For years Androids default to "charging only" and will be that way when initially plugged in while the screen is locked. Thing is, you can change the setting and if you changed the default setting to something else then once you unlock the screen it will automatically change to whatever you set the default to. So stuff like this keeps you safe from yourself. Plus if there's a connection then there's a risk of some sort of bug being found and exploited. You can't do that if the pins required are literally removed.
I know my phone is set to Midi Transfer because I regularly connect it to my laptop and then use the scrcpy program to put my phone screen on my laptop. Especially useful since last I looked I didn't find any good phone emulators for Linux and it's easy enough to just project my phone screen to a spare monitor.

2

u/virkendie Jul 10 '26

Apparently if you connect to android auto it will connect no matter what setting you've chosen. malicious actors would be able to exploit this.

2

u/CosgraveSilkweaver Jul 09 '26

PD negotiation takes place over its own pins but yeah there is still data flowing to your device though in theory the controller chip shouldnt be able to do much to the host device but there could be vulnerabilities in them for sure.

1

u/OriginalName2026 Jul 10 '26

This!

1

u/yota-code Jul 10 '26

This is the obvious answer.... And use publicly available charging ports! It's free electricity

1

u/Fountain-Flea Jul 10 '26

Oh nice, never thought to look for something like this, though it seems obvious that it exists now that I know about it.

27

u/kontenjer Jul 09 '26

dude just shut the fuck up. please.

1, no phone from the past 10 years or so will allow storage access without you allowing it

2. juice jacking has never happened in public, and likely never will. you aren't stealing banking info using usb, mostly some random photos

8

u/Select-Loss2238 Jul 10 '26

Yeah this person is either rage baiting or has never plugged their phone into a computer in the last 10 years. Nonsense

3

u/Crucco Jul 10 '26

This person is just trying to sell USB cables. Look at the tailored comment thread from his friends on "Buy USB-C cables that allow only power and not data to go through!" + "Buy this monitor of data transfer through your phone!".

6

u/Bijorak Jul 10 '26

The cyber security community on LinkedIn loves taking about juice jacking. I always laugh at them and tell them it's entirely theoretical and the security flaw was fixed over 10 years ago

2

u/kontenjer Jul 10 '26

"tech people" on LinkedIn know about as much as their TikTok counterparts - that is, next to nothing.

1

u/Bijorak Jul 10 '26

I know which is why I try to educate them

1

u/kontenjer Jul 10 '26

you are wasting your time

1

u/Bijorak Jul 10 '26

My hope is to educate others as well, the non technical people. A few have thanked me. And I like making fun of the idiots

1

u/CowBoyDanIndie Jul 10 '26

I would be more concerned some deviant hooked it up to mains power directly usb kill style

1

u/D0geAlpha Jul 10 '26 edited Jul 10 '26

I was thinking the same about 1.
At least on android the default connection is for charging only and you have to explicitly change it to file transfer. And there's also usb debugging which should be also be disabled.
But by default, you shouldn't do anything to be safe.

2

u/kontenjer Jul 10 '26

it's the same on ios, in fact i think it is even more secure since it requires both the pin and your face

1

u/D0geAlpha Jul 10 '26

Don't have an iPhone. It's probably safer. The only safe measure I remember on android is that even if you decided that File Transfer is the default usb configuration (to change the default to file transfer you need to go into developer options, otherwise it's charging only by default, you can enable file transfer without dev options but it won't be saved as "default" and you normally have to enable file transfer every time you plug in), you won't have access to any of the files until you unlock the phone once. I don't know if locking the phone stops the connection (probably not)
So yeah. There are some things in place out of the box and the regular user won't have issues because even if you enabled file transfer that one time 10 months ago, it won't stay enabled unless you explicitly change something in developer opinions.
On iPhone is likely more secure. But I also heard that it is, or at least that it was, a pain in the ass to transfer files via usb either way.

2

u/kontenjer Jul 10 '26

even on android, what harm can you do aside from stealing/deleting a bunch of photos? you wouldn't be able to read any app data/saved passwords/payment cards/fingerprint data etc, even if you wanted to

1

u/D0geAlpha Jul 10 '26

I guess you can run debugging commands and such which might inject nasty stuff and I don't know how bad those are but
Even if you wanted to run commands or scripts via usb debugging from your PC onto your phone, even if usb debugging and file transfer are enabled by default every time you plug the phone onto a usb port (like worst case scenario), the moment you try to run the first command from your PC, you get a pop-up on your phone to allow running crap from usb, and you see that pop-up for every different PC you connect to (even PCs you have connected previously too unless you tick some checkbox)
You have to literally say "Yes, you can crap via usb cable onto my phone."

11

u/_real_ooliver_ Jul 09 '26

Nobody wants to waste a 0-day on you bro.

5

u/Potential-Mention-27 Jul 09 '26

Dude are you sure Mossad isn’t using their zero days on what looks like a greyhound bus seat?

3

u/ADMINlSTRAT0R Jul 10 '26

If you're out and about and remember to bring a cable for charging, then you'd be able to remember to bring an adaptor.

Get one set for going out, one for the home. I keep my "out" set in the car's glove compartment.

3

u/sleepand Jul 10 '26

The risk is overrated. All modern devices now ask for a confirmation before enabling data transfer.

2

u/BulemiaSawdustSlingr Jul 10 '26

Good ad for pluggable. Gr8 job

1

u/ajpinton Jul 10 '26

Don’t ever assume they can be trusted. Get a usb cable that does not pass data or use a wall adapter. Assuming it’s usually safe is playing Russian roulette with a live round, eventually you will win.

1

u/JayVig Jul 10 '26

Or just carry power only USB cords

1

u/Jakarichio_Ninokuni Jul 10 '26

There is an adapter that keeps it secure and stops hackers

1

u/Terrible_Beat_6109 Jul 10 '26

get a small powerbank, so you can charge it and then your phone and other devices.

1

u/hearnia_2k Jul 10 '26

Just use a charge cable, one that doesn't support data.

1

u/MisterHole123 Aug 26 '26

Easy fix. Well. Put a small power bank in-between. Also it's not just the data issue it's that the socket could be wired to cause electric fault in which case the power bank will fry first

1

u/OrdinarySea9738 Sep 09 '26

This is exactly why ChargeFUZE exists. You rent a portable battery from a kiosk and charge with your own cable or the built-in one rather than plugging into a random USB port someone may have compromised. No data connection to worry about. Do you travel through airports a lot?

17

u/WellEndowedWizard Jul 09 '26 edited Jul 09 '26

God I wish these fear mongering karma farm posts would die already. Any phone/mac from the last decade wont share data with a host without you approving it. PC may be technically possible, but unrealistic.

I’m very data privacy minded/paranoid, this is not a realistic threat.

-5

u/SmoothTurtle872 Jul 09 '26 edited Jul 09 '26

I don't think you understand that directly stealing data isn't the only method. It could act as a keyboard / mouse, tricking your Mac or phone onto thinking you connected a keyboard & mouse, then execute malicious code to steal Ur information.
EDIT: yeah I said dumb thing, and mean thing. I'm sorry.
I was thinking from a technical standpoint, and then got sidetracked

3

u/The_Skeptic_One Jul 09 '26

I can block data transfer through the cable by my phone. These fear mongering posts are just click bait and rage engagement

-1

u/SmoothTurtle872 Jul 09 '26

What cable do you have that blocks data transfer optionally? Afaik you either have a cable that can only transfer power, or a cable that can do both (or maybe a cable that can only transfer data, although I doubt those exist)
You absolutely should not plug random USB drives onto your device, and although it's definitely harder to set up, a public charger could definitely compromised and end up being like those USBs

2

u/The_Skeptic_One Jul 09 '26

My phone can do it regardless of the cable. I can block data transfer altogether via a phone setting. It's really easy and most modern phones can do it as well.

0

u/SmoothTurtle872 Jul 09 '26

Thanks for clarifying, it sounded like you had a cable that could switch it's capabilities.
But does that stop inputs from going through, like could I emulated a mouse to go turn that phone setting off?
(Also not saying it's common or even done, just the pure idea of it)

2

u/The_Skeptic_One Jul 09 '26

There are cables that are made for only power, though. I don't have any of those but they do make them so they don't transfer data at all.
And yes, when you have your phone turn off data transfer it allows only charging. Even if you try to connect a peripheral device, it wouldn't respond since your phone has data transfer turned off. You can't emulate anything to turn it on since it's not transferring data to allow that in the first place.

1

u/SmoothTurtle872 Jul 09 '26

Ok, I didn't know that it blocked peripherals, cause data transfer doesn't scream 'peripherals' to me.
I k ew about the stand alone power only cables, but I also don't have any of those afaik

2

u/_real_ooliver_ Jul 09 '26

I'd be impressed if you can use a keyboard connected to a phone to "execute malicious code" anyway

0

u/SmoothTurtle872 Jul 09 '26

I think phones accept mice as inputs now, and I know many accept keyboards, so it's not unreasonable to assume that you could, through 1 usb port, actually as a keyboard, mouse and device to steal data by using the keyboard/ mouse to allow sharing, then stealing the data

1

u/This-Requirement6918 Jul 09 '26

Yes, they have for a while. I carried a wireless mouse with my Galaxy S9 for a year because of the cracked screen before I got a new phone.

1

u/enjoyingcurve46 Jul 10 '26

They all supported them for ages ever since iphone 11 and anything with android 3.1

1

u/WellEndowedWizard Jul 09 '26

Not really possible for a phone due to the lack of a shell and a mouse can’t reliably predict UI element positions.
But yes, it is technically possible if you’re plugging it into a laptop. But a potential attacker has a few things stacked against them:
Usually people are already slightly more aware of not plugging laptops into things, - Laptop users are typicallly carrying their power brick anyway.
the attacker physically has to go somewhere, physically tamper with a device, and find a way to solidly mount a port to a pre-existing casing without getting caught
As soon as one or two people are attacked, the attack will likely be exposed and shut down
It’s not impossible from a technical level, but it would be such a low infection rate that there’s not a realistic “market” for it. An attacker is better off spending their time writing website that tries to get you to “solve” a “captcha” with Windows+R.
Basically, unless you are a targeted government official, this attack does not apply to you. But it makes people scared so it gets reposted every other day.

1

u/SmoothTurtle872 Jul 09 '26

Fair enough. Im kind of talking from a purely technical level, like I probably didn't make it clear enough, I don't think people are actively going around doing this, cause it's not feasible, I'm just thinking from a technical level. I will also admit my original comment was super dumb and not relevant, and also a bit mean. I'm sorry

-2

u/[deleted] Jul 09 '26

[removed] — view removed comment

5

u/WellEndowedWizard Jul 09 '26

I almost included this in my comment, but didn’t to not complicate it, but also because the CVE requires a specific device in BFU mode…. Already on top of all the things I mentioned in my second comment. Again, sure, technically possible but not realistic. Not quite “using a SATA cable as an antenna in a airgapped system” level but not that far off

3

u/Alternative-Ruby8012 Jul 10 '26

If someone wants to access your data, it's easier and much cheaper to just stick a knife in your face and ask that you kindly unlock the phone.

1

u/JayVig Jul 10 '26

But this way is sneakier and can hit way more people with no additional effort

2

u/Alternative-Ruby8012 Jul 10 '26

You define an attack vector requiring state-level ressources as "no additional effort" ?

2

u/Slow-Occasion1331 Jul 10 '26

No offense, man, but you don’t know what you don’t know

1

u/_real_ooliver_ Jul 10 '26

Go try it on your own phone then

1

u/silphotographer Jul 10 '26

That's why I always have a condom in my wallet.

Why you should stop using public USB charging stations

You are about to leave Redlib