Moralo je i ovo da se desi...
https://www.zdnet.com/article/officials-warn-about-the-dangers-of-using-publ...
Officials warn about the dangers of using public USB charging stations
Travelers should use only AC charging ports, use USB no-data cables, or "USB condom" devices.
https://www.zdnet.com/meet-the-team/us/catalin.cimpanu/ Catalin CimpanuNovember 14, 2019 -- 19:44 GMT (11:44 PST)
See also
* https://www.techrepublic.com/resource-library/whitepapers/10-dangerous-app-vulnerabilities-to-watch-out-for-free-pdf/?ftag=CMG-01-10aaa1b 10 dangerous app vulnerabilities to watch out for (free PDF)
Travelers are advised to avoid using public USB power charging stations in airports, hotels, and other locations because they may contain dangerous malware, the Los Angeles District Attorney said in a security alert published last week.
USB connections were designed to work as both data and power transfer mediums, with no strict barrier between the two. As smartphones became more popular in the past decade, security researchers figured out they could abuse USB connections that a user might think was only transferring electrical power to hide and deliver secret data payloads.
This type of attack received its own name, as "juice jacking."
Across the years, several proofs-of-concept were created. The most notorious is https://media.blackhat.com/us-13/US-13-Lau-Mactans-Injecting-Malware-into-iOS-Devices-via-Malicious-Chargers-WP.pdf Mactans, presented at the Black Hat 2013 security conference, which was a malicious USB wall charger that could deploy malware on iOS devices.
Three years later, in 2016, security researcher Samy Kamkar took the concept further with https://samy.pl/keysweeper/ KeySweeper, a stealthy Arduino-based device, camouflaged as a functioning USB wall charger that wirelessly and passively sniffs, decrypts, logs, and reports back (over GSM) all keystrokes from any Microsoft wireless keyboard in the vicinity.
Following Kamkar's release of KeySweeper, https://news.softpedia.com/news/fbi-warns-against-wireless-keystroke-loggers-disguised-as-usb-chargers-504435.shtml the FBI sent out a nation-wide alert at the time, warning organizations against the use of USB chargers and asking companies to review if they had any such devices in use.
Also, in 2016, another team of researchers developed another proof-of-concept malicious USB wall charger. This one could record and mirror the screen of a device that was plugged in for a charge. The technique become known as " https://krebsonsecurity.com/2016/08/road-warriors-beware-of-video-jacking/ video jacking."
The LA District Attorney's warning [ http://da.lacounty.gov/sites/default/files/pdf/110819_Fraud_Friday_USB_Charger_Scam_ENGLISH_FLIER.pdf PDF] covers many attack vectors, because there's different ways that criminals can abuse USB wall chargers.
The most common way is via "pluggable" USB wall chargers. These are portable USB charging devices that can be plugged into an AC socket, and criminals can easily leave some of these behind "by accident" in public places, at public charging stations.
There are also USB chargers encased directly inside power charging stations installed in public places, were the user only has access to a USB port. However, LA officials say criminals can load malware onto public charging stations, so users should avoid using the USB port, and stick to using the AC charging port instead.
But the LA DA's warning also applies to USB cables that have been left behind in public places. Microcontrollers and electronic parts have become so small these days that criminals can hide mini-computers and malware inside a USB cable itself. One such example is the https://mg.lol/blog/omg-cable/ O.MG Cable. Something as benign as a USB cable can hide malware nowadays.
Taking all these into account, LA officials recommend that travelers:
* Use an AC power outlet, not a USB charging station. * Take AC and car chargers for your devices when traveling. * Consider buying a portable charger for emergencies.
But there are also other countermeasures that users can deploy. One of them is that device owners can buy USB "no-data transfer" cables, where the USB pins responsible for the data transfer channel have been removed, leaving only the power transfer circuit in place. Such cables can be found on Amazon and other online stores.
There are also so-called "USB condoms" that act as an intermediary between an untrusted USB charger and a user's device.
Two such devices are http://syncstop.com/ SyncStop (formerly known as USB Condom) and https://www.chargedefense.com/product/juice-jack-defender-turbo/ Juice-Jack Defender. Many others also exist, and at one point, even Kaspersky researchers tried to build one -- called https://www.kickstarter.com/projects/1554074090/purecharger Pure.Charger -- but their Kickstarter fundraiser failed to raise the needed funds.
https://zdnet2.cbsistatic.com/hub/i/r/2019/11/14/f9ff0e79-b651-4665-8562-5e472deabdd4/resize/370xauto/814d469ff752bee256aff80daa07441b/charge-defender.png Image: ChargeDefense LLC
Security
* https://www.zdnet.com/article/bluekeep-exploit-to-get-a-fix-for-its-bsod-problem/ BlueKeep exploit to get a fix for its BSOD problem * https://www.zdnet.com/article/major-asp-net-hosting-provider-infected-by-ransomware/ Major ASP.NET hosting provider infected by ransomware * https://www.zdnet.com/article/apple-mail-on-macos-leaves-parts-of-encrypted-emails-in-plaintext/ Apple Mail on macOS leaves parts of encrypted emails in plaintext * https://www.youtube.com/watch?v=EOgWXyo0Y6o Fixing data leaks in Jira (ZDNet YouTube) * https://www.cnet.com/how-to/the-best-home-security-systems-of-2019/?ftag=CMG-01-10aaa1b Best home security of 2019: Professional monitoring and DIY (CNET) * https://www.techrepublic.com/article/how-to-control-location-tracking-on-your-iphone-in-ios-13/?ftag=CMG-01-10aaa1b How to control location tracking on your iPhone in iOS 13 (TechRepublic)
Sent from my iPad 2018