Beware Of Juice Hacking

From booking tickets, making purchases to bank transactions, ordering food, paying bills, taking selfies to what not — our lives run on mobile phones. With consistent use of the phones comes the hassle of ensuring you don’t run out of battery power, especially when you are outdoors, sans your power bank.

But with public charging stations available at various places for this very purpose, there is nothing to worry, or so you think. Watch out, it is these very public charging stations which are the real cause of worry!

A new emerging threat is that of Juice Jacking — a security issue in which hacked USB charging stations are used to attack connected devices. Juice Jacking is one of the most ingenious and modern methods of hacking into devices such as smartphones that use the same USB cable for both data transfer and charging.

Compromising devices

From a cybersecurity standpoint, these public USB charging stations essentially function as attack vectors that hackers can leverage to potentially compromise devices, says Umesh Thota Founder, CEO AuthBase. “By plugging into infected charging ports, users may unknowingly install malware, provide access to sensitive data, or allow device controls to be taken over,” he explains.

Risks

The risk stems from the dual use of USB connections for both power delivery and data transfer.

“Without proper safeguards in place, there is no segmentation between those functions when plugging into an unfamiliar USB port. The port itself could leverage that data connection to carry out attacks, says Umesh, underling just why it is extremely important to keep the devices upto date and not use devices that don’t have the ability to identify or differentiate between power and data transfer mode.

According to him, potential vulnerabilities range from malware installation, remote command execution allowing device takeover, and extraction of sensitive personal information off the device via the data connection with the charging port. “Once installed, such malware could also propagate peer-to-peer spreading infections when users charge other personal devices from their compromised phones. Overall there is a false sense of security and trust associated with public USB charging stations,” he says.

The majority of consumers are unlikely to have their guard up or be tech savvy enough to take precautions when charging on the go, feels Umesh. “Especially, when the primary perceived purpose is power delivery. This results in ample opportunity for hackers to carry out juice jacking on a broad scale. Today, the form factor has reduced to having a command and control chip right in the wire itself and this is easily available online.”

Awareness

Umesh says it’s important to educate users about the potential risks of using public charging stations, especially in high-traffic areas like airports, malls, and public transportation hubs. “Many users may not be aware of the concept of Juice Jacking and the potential for compromised charging stations to compromise their devices,” he says.

Preventive Measures

There is an urgent need to encourage users to adopt preventive measures to mitigate the risk of Juice Jacking

1 Use wall outlets whenever possible instead of public charging stations. Carry a portable power bank to avoid the need for public charging. Invest in USB data blockers or ‘USB condoms,’ which prevent data transfer while allowing charging.

2 Consider using wireless charging when available, as it doesn’t involve data transfer through cables.

3 Vetting Charging Stations: Users should exercise caution when using public charging stations and only use trusted ones. It’s essential to verify the legitimacy of the charging station and avoid using stations that appear tampered with or suspicious.

The risk stems from the dual use of USB connections for both power delivery and data transfer. “Without proper safeguards in place, there is no segmentation between those functions when plugging into an unfamiliar USB port. The port itself could leverage that data connection to carry out attacks,” says Umesh Thota, Founder, CEO AuthBase.

Many users may not be aware of the concept of Juice Jacking and the potential for compromised charging stations to compromise their devices —Umesh Thota