Our smartphones are powerful computers, as they pack capable hardware and sophisticated software. But because they're designed to be mobile devices, they need to run on some sort of mobile power source.
Also called 'batteries', these things are meant to last.
Typical battery technologies that power our devices, are still fundamentally the same as they were decades ago. With more and more capable devices, most modern smartphones can only be 'unplugged' for a day, more or less, before they need to be recharged.
Fortunately, fast charging has become common, meaning that people can quickly charge their phones a lot faster than ever before. And since many people carry their cables around, there are many public places that offer free charging.
This is certainly convenient given that in the modern days of technology, phones matter more than wallets.
But unfortunately, those USB charging ports that can be found on the side of seats, free charging stations, or at public transportation among a few, can be taken advantage by hackers to launch their cyber attack.
Known as 'juice jacking', hackers can utilize charging ports that double as data connection, typically via USB, to install malware or retrieve sensitive data from whatever smart devices plugged into them.
The method was first made public when The Wall of Sheep, an event at Defcon, created and allowed public access to an informational juice jacking kiosk, each year since 2011.
The intention is to bring awareness to the public about this method of cyber attack.
Each of the kiosk has hidden CPU unit. The first informational juice jacking kiosk included a screen which would change from "Free charging station" to a warning message that the user "should not trust public charging stations with their devices", when a device is plugged into it.
One of the researchers who designed the kiosk gave public presentations to notify people about how data theft can happen even on the most unsuspecting place.
The first person to coined the term 'juice jacking', was Brian Krebs from Kerbs on Security.
Juice jacking works like this:
When your smartphone is plugged into a computer or a laptop for whatever reason, your device will open up an option to transfer files back and forth between the two devices. This is possible when the cable in use can transfer data (which apparently most cables are)
USB cable connector only needs one pin to transfer power to a device. The rest of the pins can be used for data transfer.
Unless you have made changes in your phone’s default settings, the data transfer mode is disabled by default. But when it is enabled, anytime your device is connected to a USB port to charge, your device is at risk.
Hackers can simply juice jack by opening up the pathway for data transfer.
Knowledgeable hackers can abuse this to:
Steal Data
While the device is charging, hackers can use the moment to establish a connection with the device, and hack their way in to copy user data.
The hackers don't have to be present near the charging port, as the process can be done automatically.
To juice jack, the hackers need to first hack their way into an unsecured charging station using malware. After that, they can put additional payload on the system in order to steal information from any device that is plugged into the compromised charging station.
Using the malware, the hackers can scan connected phones for account credentials, financial data and more.
Malware Installation
The second juice-jacking attack involves hackers installing malware onto the user’s device through the same USB connection.
In this case, data theft may not be the goal. But instead, the hacker want to gain access to the plugged device, and remain there even after the device is unplugged.
This way, hackers could gather even more and varied data, such as user’s GPS locations to determine physical addresses and commute schedule, social media interactions, images and videos, call log details, and some other ongoing processes that include personal information as well.
This juice jacking can be more damaging since hackers can also plant adware, spyware, cryptojacking miners, ransomware or other malicious software.
The malware can remain on the device until it is identified and removed by the user.
Read: The '40-80 Rule' Battery Charging: Dealing With Lithium-Based Chemical Problems
Preventing Juice Jacking
Typically, people use charging cables shipped with smartphones (their own or others) to charge their smartphones.
Because these cables allow data transfer, the best way to prevent juice jacking is by using a USB condom. This small and unobtrusive dongle effectively turns any USB cable into a secure 'charge-only' cable to allow safe recharging from untrusted USB ports.
You can also prevent juice jacking by charging your phone via the AC adapter, a battery backup device, or using a dedicated USB cable with only power pins and no data pins present. There are vendors that sell specialized USB adapters which remove the data pins.
But if you cannot do all the above, and/or rely on only your default charging cable, you need to:
- Never use a free USB port or charging cable. Instead, use your own charging adapter or power bank.
- Switch your phone off. Even if the port can juice jack your phone, it is impossible USB hijack a phone that is off, since there is no flow of data..
- If ever your phone shows a request to allow the cable to be used for data transfer, deny the request and unplug your device.
Generally, Apple iOS devices are more secured than Android when dealing with juice jacking.
iPhones for example, have reduced the attack surface from USB significantly by no longer allowing the device to automatically mount as a hard drive whenever it is plugged over USB. What's more, if malware do get inside an iOS-powered device, the malware cannot do anything because each and every app installed in the device runs inside their own sandbox, meaning that malware cannot go beyond its container.
This is why there is no 'antivirus' app for the Apple product.
But as for Android devices on the other hand, they commonly prompt users for permission when plugged via USB, making them more vulnerable to juice jacking.