Ramblings

This is an old revision of the document!

Juice jacking is a theoretical type of compromise of devices like smartphones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data.

Many years ago, roughly in the year 2013 and before, phones connected to your computer via USB would immediately register itself as a removable drive. From the computer, you were immediately able to access the files stored on the device, copy, move or delete them. This was during a time of digital naivety when the physical restriction of needing to be physically at a place to plug in your phone. If you wanted to get that user's data, you needed to physically get ahold of their device, which at the time was very much enough protection for 99% of users, as users don't just give out their phones to strangers.

But, times did change and various forces conspired to ensure that this wouldn't stay so for long. One of these was public charging. It was now becoming a real thing that users would routinely plug phones into unknown USB ports, and of course their phones weren't designed for that amount of trust. To skip any validation before a data transfer was done as a convenience thing because previously plugging phones into unknown ports was totally unheard of and it would have been really annoying to force millions of users to click through prompts they'd always answer with yes anyway. But, the solution was quite simple and was implemented rather rapidly by Android and iOS around 2012 and 2013: No data transfer by default.

Why? Well, the problem is that allowing data transfer between the phone and whatever it is connected to can expose it to bad actors. The phone uses quite a bit of logic for USB communication and if any of that has a vulnerability that allows, for example, for remote code execution, this could be used to compromise the phone. However, this not only requires fatal vulnerabilities in code developed and used by millions of people each day, it would also require such serious vulnerabilities be known to all public USB charging operators¹⁾ without also being known to anyone working in cybersecurity.

The reality is that a USB part may send whatever it wants into your phone. It can send electricity in particular frequencies to send any combination of one's and zeroes it chooses to, but that is entirely irrelevant if your phone just doesn't choose to even read them out. Unless you somehow manage to mess up programming a logic that is specifically meant to do nothing, it is practically impossible to get access to your phone. This is reflected in the numbers: There is not a single real-world incident worldwide of a phone getting juice-jacked, unless of course you then open your phone and click “Allow Access”.

There are products sold online that are meant to mitigate the risk of infection from public charging ports. These devices often come in the form of USB cables with the data transfer pins removed, making it physically impossible to transfer any data. Protection at the software level is not inherently weaker, and as long as the device doesn't send or read out incoming data (it does not), it is essentially doing exactly what the physical privacy product does.

Please, do not buy these product, you're making yourself look like an idiot. You don't buy a lead box for your phone just because you don't trust your phone to not transmit to the nearest cell tower despite airplane mode being on, right? Cell tower connection is literally the same thing, just without a physical wire. When you turn on airplane mode, your phone decides to stop transmitting and no longer reads out information that comes on. Technically, a cell tower could try to infect or steal your data as well. Wifi routers could do that too. But we've been just fine without sticking our phones into lead boxes to prevent the signal from reaching the phone.