Juice jacking | How hackers target smartphones tethered to public charging points

Juice Jacking attacks are used to steal users’ passwords, credit card information, and other sensitive data. To learn more, read the full story on The Hindu.

Juice jacking or infecting devices tethered to public charging stations has been around for some time. U.S. law enforcement agency FBI and the Federal Communications Commission (FCC) have issued warnings detailing the risks posed by such attacks. This form of attack is used to target devices being charged at USB charging stations in public spaces. In May 2023, the FBI in a tweet advised users to avoid using free charging stations in airports, hotels, or shopping centers. The warning comes as threat actors have figured out ways to inject malware into devices attached to publicly installed USB ports.

The term “juice jacking” was first coined in 2011 by investigative journalist Brian Krebs. It is a form of cyberattack where a public USB charging port is tampered with and infected using hardware and software changes to steal data or install malware on devices connected to it. The attack is used by hackers to steal users’ passwords, credit card information, addresses, and other sensitive data stored on the targeted device.

Juice jacking attacks can take place in any public place with portable wall chargers, or public USB charging stations found in shopping malls, cafes, and hotels.

To perform the attack, hackers infect USB ports or charging cables in public areas before the users connect to them. Most attacks target both Android and iOS mobile devices, with older devices being particularly vulnerable due to their outdated software. USB ports have multiple pins, but only one pin is used for charging while the other pins are used for data transfers. When users connect their devices to compromised USB ports, hackers use the connection to hack into mobile devices and steal personal data or deliver malware.

(For top technology news of the day, subscribe to our tech newsletter Today’s Cache)

Juice jacking attacks also target laptop USB ports, which are similarly capable of transferring data.

Juice-jacking attacks can vary in their impact, even though the method remains the same. The different attack forms include data theft, malware installation, disabling attack, and multi-device attack.