Definition
Juice jacking is a type of cyber attack that exploits USB charging cables or chargers to compromise devices with USB ports, especially mobile phones.
Charging cables don't just power your phone's battery. They also facilitate data transfer, like when importing photos to a computer. Some cables can be altered to steal your data or plant malicious apps on your device.
History
The term "juice jacking" first gained attention in August 2011. Brian Krebs discussed it at the DEFCON hacker convention's "Wall of Sheep". He later penned the first article on this subject on his website, Krebs on Security.
By the end of 2012, the NSA cautioned its government employees against juice jacking. It recommended only using personal devices for charging and avoiding public stations or other people's computers.
In March 2014, the "Android Hackers Handbook" was published, addressing the risks of juice jacking. Today, with the rise in public USB charging stations—such as in buses, stations, and airports—the threat looms larger.
How It Works
The process involves using a tampered cable or charger to breach the devices it powers. This can be executed in various ways: breaking in and replacing chargers, gifting altered chargers to a company, or bribing someone to do the replacement.
High-risk spots include public charging stations in trains, airports, etc., especially when the attacker isn't picky about their target. It's a broad-spectrum attack due to the randomness of public users. Companies also fall prey when malicious actors send tampered chargers disguised as promotional gifts.
Consequences
Once a device is compromised, attackers might gain access to the company's network, threatening its operations. Data theft is a significant risk, including personal information, login details, and banking data. Additionally, various malware types can get installed:
- Adware: Displays unwanted ads and might harvest your data.
- Spyware: Stays hidden and can remotely control your device, record audio, video, keystrokes, and even access messages, emails, and browsing history.
- Ransomware: Encrypts your data, demanding a ransom for decryption.
- Crypto-miners: Uses your device's resources to mine cryptocurrency, draining the battery.
Protection Tips
To guard against juice jacking:
- Use a USB condom, which protects data.
- Choose a "power only" cable that prevents data transfer.
- Pick cables with a data switch to shift between charging and data transfer.
- Always use your own USB charger.
- Set default settings for USB connections to either allow or disallow specific actions.
- Turn off your device while charging at public stations. While it's not the most convenient, it's harder to hack a turned-off device.
- Educate colleagues about the risks of unfamiliar chargers and cables.