Juice Jacking: Malware Attacks Through Charging Stations

Ashley_Buckwell

No doubt when you next head out, you will have your cell phone or another portable device like an iPad or tablet with you, and you will need to recharge it at some point. If your battery is running low, be aware that juicing up your electronic devices at free charging kiosks, such as those found at airports, train stations, in hotels, and at other travel-friendly locations, could have unfortunate consequences. You could become a victim of "juice jacking," a relatively old but nasty cyberattack method. 

What is juice jacking?

Juice jacking, which takes advantage of public charging ports, is one of the many cyberattack techniques hackers use to hijack your mobile devices. In juice jacking, the ultimate goal is to transform charging kiosks into hacking devices that leave malware in your device or simply steal your critical data. You might not even know when your data is being transferred to a third party because your phone is being charged normally.

These juice jacking attacks take advantage of your mobile phone being connected to the same USB port linked to the cybercriminal’s data-syncing hardware. Once the juice jacking begins, it can steal your passwords, backup your data to a connected device, or leave a malicious application on your phone.

This attack method is a hardware-related man in the middle attack: hackers set up a USB connection either directly or indirectly with one of their own devices and wait for unsuspecting individuals to connect their phone’s power supply. In juice jacking, the popup message that asks if you trust this device does not appear, so you do not know that your device has been connected and is transferring data. This gives hackers a perfect chance to connect to your data without your knowledge and move it wherever they want. 

Types of attacks 

1. Data theft. Juice jacking can lead to data theft of connected devices. Cybercriminals can transfer all sorts of data from your phone, including personally identifiable information, account credentials, multimedia files, browser histories, and credit card data. 
2. Malware installation. Once a connection is established, malware is automatically installed on the connected device. Malware remains on the device until it is detected and removed by the user. There are several categories of malware that cybercriminals can install through juice jacking including adware, crypto miners, ransomware, spyware, and trojans.
3. Multiple device attacks. This is a method of attacking multiple devices at the same time. A device that has been infected may unwittingly act as a carrier, infecting additional cables and charging ports with the same malware. 

Where is juice jacking most likely? 

All public charging stations or USB ports are a security risk, but the following are the most at-risk locations:

• Airports, being high-transit areas, provide cybercriminals with a lot of potential targets, so naturally they are popular locations for setting up juice jacking devices. Also, people at airports are more likely than not to want to charge their devices, as they may not have convenient access to power at their next destination.
• Train stations, like airports, are popular locations for cybercriminals because they are high-transit areas with a lot of potential targets.
• Convention centers, depending on the conference being held, can be honeypots to hackers because of the types of people who attend: certain types of guests may have specific, valuable information on their devices.
• Hotel rooms provide convenient access for cybercriminals to install juice jacking hardware, as the malicious devices can be installed surreptitiously. 

Preventing juice jacking

The best defense against juice jacking is to understand the risks associated with using public charging kiosks and USB ports. For the best protection, ensure you have alternative power sources before leaving the house and do not just randomly plug your phone anywhere you see a charging station. Here are some simple tips you can follow to prevent your devices from being subject to juice jacking:

• Check your battery before you leave a trusted place. Trusted places include your home, workplace, or a friend's house. Before leaving, make sure your battery is charged enough to last until you reach your destination. This way, you will not fall victim to a juice jacking attack while traveling.
• Keep a spare charger or power bank with you. It is easy to say you should check your battery percentage every time you plan to go somewhere, but in real life, people have busy lives, so that does not always happen. To prevent juice jacking, keep a power bank in your bag or purse. If you do not want to carry a power bank with you (they can be heavy), bring a charger and cable for your phone.
• Always plug into an AC power outlet. Typically, juice jacking attacks occur through the USB ports at charging kiosks. Try to avoid using USB ports in high-risk locations like airports, train stations, convention centers, and hotels, and be cautious at restaurants, cafes, and malls. If you do need to charge at any of these places, plug your charger into the AC power outlet rather than the USB port. This way, there is no opportunity for a hacker to get access.
• Turn off your phone or use a USB adapter. If you are in desperate need to charge your phone at a public charging kiosk, there are still ways to prevent juice jacking. You can try turning off your device while it charges, if the device allows this. Or, as a last resort, get a USB adapter that turns the USB cable into a charging device only. There are different pins on a USB port for charging and data transfer. These adapters disable the data transmission signal pins so that only charging is possible.
• Avoid low-cost knock-off cables. Your charging cable might come preinstalled with malware built into its circuit. For this reason, buy charging cables only from reputable vendors.

The bottom line is that juice jacking is a relatively rare attack method but one that is brimming with potential for cybercriminals and spies. The remedies are easy and inexpensive, and as long as the safety protocols mentioned here are followed, there is no cause for concern. 

 *The opinions reflected in this article are the sole opinions of the author and do not reflect any official positions or claims by Acer Inc.

About Ashley Buckwell: Ashley is a technology writer who is interested in computers and software development. He is also a fintech researcher and is fascinated with emerging trends in DeFi, blockchain, and bitcoin. He has been writing, editing, and creating content for the ESL industry in Asia for eight years, with a special focus on interactive, digital learning.