Differences

This shows you the differences between two versions of the page.

--- juice_jacking [2026/10/13 11:02] – ultracomfy
+++ juice_jacking [2026/10/16 10:20] (current) – ultracomfy
@@ Line 10: / Line 10: @@
 <fs xx-large>Juice Jacking</fs></WRAP>
-<WRAP box right 30%>
+Juice jacking is a theoretical type of compromise of devices like smartphones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data. Allowing data transfer between the phone and whatever it is connected to can expose it to bad actors. The phone uses quite a bit of logic for USB communication and if any of that has a vulnerability that allows, for example, for remote code execution, this could be used to compromise the phone.
-{{::screenshot_20261013-124849.png?400|}}\\
-This was figured out by smart developers more than a decade ago.
-</WRAP>
-Juice jacking is a theoretical type of compromise of devices like smartphones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data.
+However, USB implementations in smartphones are widely deployed and are maintained by a lot of people for many years. While the risk of course is never zero, there is very little publicly documented evidence of widespread, opportunistic juice-jacking attacks against ordinary users (assuming the device is reasonably modern and up-to-date). Anyone who were to find such an exploit would not waste it on indiscriminately harvesting data of random public utility users. An exploit letting you freely access any significant number of phones (probably depending on OS, chipset, etc.) is the kind of stuff nation state actors dream of and would use on big, valuable targets. Spying on other nations, digging out megacorporations, a vulnerability like this is not worth deploying on a few random public charging stations for funs where it might get found.
-Many years ago, roughly in the year 2013 and before, phones connected to your computer via USB would immediately register itself as a removable drive. From the computer, you were immediately able to access the files stored on the device, copy, move or delete them. This was during a time of digital naivety when the physical restriction of needing to be physically at a place to plug in your phone. If you wanted to get that user's data, you needed to physically get ahold of their device, which at the time was very much enough protection for 99% of users, as users don't just give out their phones to strangers.
+<WRAP box>
+<WRAP group>
-But, times did change and various forces conspired to ensure that this wouldn't stay so for long. One of these was public charging. It was now becoming a real thing that users would routinely plug phones into unknown USB ports, and of course their phones weren't designed for that amount of trust. To skip any validation before a data transfer was done as a convenience thing because previously plugging phones into unknown ports was totally unheard of and it would have been really annoying to force millions of users to click through prompts they'd always answer with yes anyway. But, the solution was quite simple and was implemented rather rapidly by Android and iOS around 2012 and 2013: No data transfer by default.
+<WRAP half column centeralign>
+{{ ::screenshot_20261013-124849.png?200| }}\\
-Why? Well, the problem is that allowing data transfer between the phone and whatever it is connected to can expose it to bad actors. The phone uses quite a bit of logic for USB communication and if any of that has a vulnerability that allows, for example, for remote code execution, this could be used to compromise the phone. However, this not only requires fatal vulnerabilities in code developed and used by millions of people each day, it would also require such serious vulnerabilities be known to all public USB charging operators((Of course not "everyone" would have to know, but a lot of people across the globe would have to know that you personally run a genuine risk of happening to find one that is compromised.)) //without// also being known to anyone working in cybersecurity.
+This was figured out by smart developers more than a decade ago.
+</WRAP>
-<WRAP box right 30%>
+<WRAP half column centeralign>
-{{::screenshot_20261013-124830.png?400|}}\\
+{{ ::screenshot_20261013-124830.png?200| }}\\
-The reason why you're not meant to plug USB devices into computers at work is because Windows, and most computers at work, do not work on a zero-trust architecture. Especially if Autoplay is enabled, these computers do indeed accept incoming USB connections by default (at least to some degree, certainly much of this could be configured).
+The reason why you're not meant to plug USB devices into computers at work is because Windows, and most computers at work, do not use a zero-trust architecture. They are quite open systems that aren't nearly as locked down as mobile phones.
+</WRAP>
+</WRAP>
 </WRAP>
-The reality is that a USB port may send whatever it wants into your phone. It can send electricity in particular frequencies to send any combination of ones and zeroes it chooses to, but that is entirely irrelevant if your phone just doesn't choose to even read them out. Unless you somehow manage to mess up programming a logic that is specifically meant to do nothing, it is <del>practically</del> impossible to get access to your phone. This is reflected in the numbers: There is not a single real-world incident worldwide of a phone getting juice-jacked, //unless// of course you then open your phone and click "Allow Access".
+====== USB Data Blockers ======
-====== Placebo ======
 <WRAP box right 30%>
 {{ ::willmycelltowerbecomeobsolete-900x1200-1.webp |}}\\
@@ Line 38: / Line 33: @@
 </WRAP>
-There are products sold online that are meant to mitigate the risk of infection from public charging ports. These devices often come in the form of USB cables with the data transfer pins removed, making it physically impossible to transfer any data. Protection at the software level is not inherently weaker, and as long as the device doesn't send or read out incoming data (it does not), it is essentially doing exactly what the physical privacy product does.
+There are products sold online that are meant to mitigate the risk of infection from public charging ports. These devices often come in the form of USB cables or adapters with the data transfer pins removed, making it physically impossible to transfer any data. The benefit of this approach is that it sets the risk of being targeted by an attack to zero. The problem is that this comes from people who think that this meaningfully increases their cybersecurity.
+For a comparison, it is useful to know that phones receive information from the outside world in several ways. One is through electrical signals sent over a USB cable, where changes in voltage encode data. Another is through radio waves, which the phone's wireless hardware receives and interprets as data. In both cases, the device's hardware and software determine how incoming information is processed and what it is allowed to do.
-Please, do not buy these products, you're making yourself look like an idiot. You don't buy a lead box for your phone just because you don't trust your phone to not transmit to the nearest cell tower despite airplane mode being on, right? Cell tower connection is literally the same thing, just without a physical wire. When you turn on airplane mode, your phone decides to stop transmitting and no longer reads out information that comes in. Technically, a cell tower could try to infect or steal your data as well. Wifi routers could do that too. But we've been just fine without sticking our phones into lead boxes to prevent the signal from reaching the phone.
+Neither interface is inherently immune to malicious input. Vulnerabilities in the code that processes incoming data can theoretically be exploited, whether that data arrives through a cable or wirelessly((Disabling WiFi and Bluetooth, and turning on Airplane mode reduces exposure, but doesn't fully stop data processing either.)). But unlike data blocking USB cables, we do not store phones in Faraday cages, because the risk of actually being targeted that way for an ordinary end user is extremely low (though examples of past attacks like this do indeed exist!). The point here is that attacks like this exist //theoretically//, but theoretical attacks should not be conflated with attacks that can reasonably happen in the real world.