Juice jacking is a security exploit in which an infected USB charging station is used to compromise connected devices. The exploit takes advantage of the fact that a mobile device’s power supply passes over the same USB cable the connected device uses to sync data.
Juice jacking exploits are a security threat at airports, shopping malls and other public places that provide free charging stations for mobile devices. At the time of this writing, the risk of becoming the victim of a juice jacking exploit is thought to be low, but the attack vector is real and is often compared to ATM card skimming exploits from years past. Both juice jacking and card skimming rely on the end user feeling confident that the compromised hardware is safe to use.
How juice jacking works
Juice jacking is a hardware-focused Man in the Middle (MitM) attack. The attacker uses a USB connection to load malware directly onto the charging station or infect a connection cable and leave it plugged in, hoping some unsuspecting person will come along and use the ‘forgotten’ cable.
Juice jacking exploits work because the same port used for charging a device can also transfer data. A USB connector has five pins, but only one is necessary for charging a connected device and only two of the five pins are used to transfer data. This architecture is what allows an end user to move files between a mobile device and a computer while the mobile device is connected to the charging station.
USB ports and phone charging cables are the most common devices used in juice-jacking attacks. Other less common devices that may be used in this type of exploit include USB ports in video arcade consoles and portable battery power banks.
How to protect against juice jacking
Juice-jacking allows an intruder to copy sensitive data from a mobile device, including passwords, files, contacts, texts and voicemails. People may not realize they have been a victim of an attack or may have no way of knowing how the attack happened once they realize their device is infected. Users can guard against juice-jacking attacks by purchasing a protective attachment called a USB condom. A condom is a device that connects to a charging cable and sits between the device’s charging cable and the public USB charging station.
The condom works by blocking connections to all the pins in the USB male connection except one – the pin that transfers power. The condom prevents the pins that transfer from establishing a connection, while still allowing the device to charge.
Another way to prevent this type of attack is to avoid using chargers that are left plugged into wall sockets. In addition, it is a best practice to keep devices and software programs updated and never accept free promotional charging devices or devices from unverified sources or people.
Types of juice jacking attacks
- Data theft. In data theft juice-jacking attacks, the user is not aware that his or her sensitive information has been stolen. Depending how long a device is left plugged into a compromised cable or port, very large amounts of data may be compromised. Given enough time and storage space, hackers may even be able to make a full backup of the data on a device.
- Malware installation. When malware installation juice-jacking attacks occur, the malware placed on the device may do a great deal of damage, including manipulation of a phone or computer, spying on a user, locking the user out of the device or stealing information.
- Multi-device attack. On top of harming the device plugged into a compromised charger, a device charged by infected cables may in turn infect other cables and ports with the same malware as an unknowing carrier of the virus.
- Disabling attack. Some malware uploaded through a charging device can lock the owner out of their device, giving full access to the hacker.
Juice jacking first came into the public conversation at a hacking conference called DEF CON in August 2011. Conference attendees were offered free charging stations for their mobile devices. When they plugged them in, a message appeared warning them not to trust convenient but suspicious offers of free charging because the devices could be loaded with malicious code.
In response to juice jacking, Apple and Android updated their devices to warn users whenever they charge and allow the user to choose whether to trust the charging port, power bank or other charging process. If users choose the untrusted device option, their devices will only be charged and will not allow data transfer.