Ramblings

Introspective narcissism since the 2000s.

User Tools

Site Tools


juice_jacking


It's not religion if it's true
Science

Objective inquiry


History
Philosophy
Inclusion
Doppler Effect

Falsified Hypotheses


Science Says

Technology/Computers/Cybersecurity/
Juice Jacking

Juice jacking is a theoretical type of compromise of devices like smartphones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data. Allowing data transfer between the phone and whatever it is connected to can expose it to bad actors. The phone uses quite a bit of logic for USB communication and if any of that has a vulnerability that allows, for example, for remote code execution, this could be used to compromise the phone.

However, USB implementations in smartphones are widely deployed and are maintained by a lot of people for many years. While the risk of course is never zero, there is very little publicly documented evidence of widespread, opportunistic juice-jacking attacks against ordinary users (assuming the device is reasonably modern and up-to-date). Anyone who were to find such an exploit would not waste it on indiscriminately harvesting data of random public utility users. An exploit letting you freely access any significant number of phones (probably depending on OS, chipset, etc.) is the kind of stuff nation state actors dream of and would use on big, valuable targets. Spying on other nations, digging out megacorporations, a vulnerability like this is not worth deploying on a few random public charging stations for funs where it might get found.


This was figured out by smart developers more than a decade ago.


The reason why you're not meant to plug USB devices into computers at work is because Windows, and most computers at work, do not use a zero-trust architecture. They are quite open systems that aren't nearly as locked down as mobile phones.

USB Data Blockers


This thing connects just as far into your device as an USB cable plugged into your phone. In airplane mode, your phone has to actively refuse to communicate or do anything as a result of anything it may be sent by the tower. If it works for cell towers, it works for USB connections too.

There are products sold online that are meant to mitigate the risk of infection from public charging ports. These devices often come in the form of USB cables or adapters with the data transfer pins removed, making it physically impossible to transfer any data. The benefit of this approach is that it sets the risk of being targeted by an attack to zero. The problem is that this comes from people who think that this meaningfully increases their cybersecurity.

For a comparison, it is useful to know that phones receive information from the outside world in several ways. One is through electrical signals sent over a USB cable, where changes in voltage encode data. Another is through radio waves, which the phone's wireless hardware receives and interprets as data. In both cases, the device's hardware and software determine how incoming information is processed and what it is allowed to do.

Neither interface is inherently immune to malicious input. Vulnerabilities in the code that processes incoming data can theoretically be exploited, whether that data arrives through a cable or wirelessly1). But unlike data blocking USB cables, we do not store phones in Faraday cages, because the risk of actually being targeted that way for an ordinary end user is extremely low (though examples of past attacks like this do indeed exist!). The point here is that attacks like this exist theoretically, but theoretical attacks should not be conflated with attacks that can reasonably happen in the real world.

1)
Disabling WiFi and Bluetooth, and turning on Airplane mode reduces exposure, but doesn't fully stop data processing either.
juice_jacking.txt · Last modified: by ultracomfy

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki