Juice jacking

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
USB chargers in a public bus
USB charger in an airplane
Household AC power socket doubling as a USB charger

Juice jacking is a term used to describe a cyber attack wherein malware might be installed on to, or data surreptitiously copied from, a smart phone, tablet or other computer device using a charging port that doubles as a data connection, typically over USB.

Published research[edit]

The Wall of Sheep, an event at Defcon has set up and allowed public access to an informational juice jacking kiosk each year at DefCon since 2011. Their intent is to bring awareness of this attack to the general public. Each of the informational juice jacking kiosks set up at the Wall of Sheep village have included a hidden CPU which is used in some way to notify the user that they should not plug their devices in to public charging kiosks. The first informational juice jacking kiosk included a screen which would change from "Free charging station" to a warning message that the user "should not trust public charging stations with their devices".[1] One of the researchers who designed the charging station for the Wall of Sheep has given public presentations which showcase more malicious acts which could be taken via the kiosk, such as data theft, device tracking and information on compromising existing charging kiosks.[2]

Security researcher Kyle Osborn released an attack framework called P2P-ADB in 2012 which utilized USB On-The-Go to connect an attacker's phone to a target victim's device. This framework included examples and proof of concepts which would allow attackers to unlock locked phones, steal data from a phone including authentication keys granting the attacker access to the target device owner's Google account.[3]

Security researcher graduates and students from the Georgia Institute of Technology (Georgia Tech) released a proof of concept malicious tool "Mactans" which utilized the USB charging port on Apple mobile devices at the 2013 Blackhat USA security briefings. They utilized inexpensive hardware components to construct a small sized malicious wall charger which could infect an iPhone with the then-current version of iOS with malicious software while it was being charged. The software could defeat any security measures built into iOS and mask itself in the same way Apple masks background processes in iOS.[4]

Security researchers Karsten Nohl and Jakob Lell from SRLabs published their research on BadUSB during the 2014 Blackhat USA security briefings.[5][6] Their presentation on this attack mentions that a cellphone or tablet device charging on an infected computer would be one of the simplest method of propagating the BadUSB vulnerability. They include example malicious firmware code that would infect Android devices with BadUSB.[7]

Researchers at Aries Security and the Wall of Sheep later revisited the juice jacking concept in 2016. They set up a "Video Jacking" charging station which was able to record the mirrored screen from phones plugged into their malicious charging station. Affected devices at the time included Android devices supporting SlimPort or MHL protocols over USB, as well as the most recent iPhone using a lightning charge cable connector.[8]

Researchers at Symantec disclosed their findings on an attack they dubbed "Trustjacking"[9] during the 2018 RSA Conference. The researchers identified that when a user approves access for a computer on an iOS device over USB, that this trusted access level is also applied to the devices's iTunes API which is accessible over wifi. This would allow attackers access to an iOS device even after the user has unplugged the device from a malicious or infected USB based charge source.

History[edit]

Brian Krebs was the first to report on this attack and coined the term "juice jacking". After seeing the informational cell phone charging kiosk set up in the Wall of Sheep at DefCon 19 in August 2011, he wrote the first article on his security journalism site Krebs on Security.[10] The Wall of Sheep researchers—including Brian Markus, Joseph Mlodzianowski, and Robert Rowley—designed the kiosk as an information tool to bring awareness to the potential attack vector, and they have discussed but not released tools publicly which perform malicious actions on the charging devices.[2]

An episode of the hacking series Hak5 released in September 2012 showcased a number of attacks which can be utilized using an attack framework named P2P-ADB released by Kyle Osborn. The P2P-ADB attack framework discussed utilized one phone to attack another phone over a USB on the Go connection.[11]

In late 2012, a document was released by the NSA warning government employees who travel about the threat of juice jacking and reminding the reader that during overseas travel only to use their personal power charging cables and not to charge in public kiosks or by utilizing other people's computers.[12]

The Android Hackers Handbook released in March 2014 has dedicated sections discussing both juice jacking and the ADB-P2P framework.[13]

Juice jacking was the central focus on an episode of CSI: Cyber. Season 1: Episode 9, "L0M1S" aired in April 2015[14]

Mitigation[edit]

A USB condom.

Apple's iOS has taken multiple security measures to reduce the attack surface over USB including no longer allowing the device to automatically mount as a hard drive when plugged in over USB, as well as release security patches for vulnerabilities such as those exploited by Mactans.[4]

Android devices commonly prompt the user before allowing the device to be mounted as a hard drive when plugged in over USB. Since release 4.2.2, Android has implemented a whitelist verification step to prevent attackers from accessing the Android Debug Bridge without authorization.[15]

Juice jacking is not possible if a device is charged via the AC adapter shipped with the device, a battery backup device, or by utilizing a USB cable that has its data cables removed. A tool originally called the USB Condom (now renamed to SyncStop[16]) has been released with the sole purpose of disallowing data connections to be passed over a USB cable.

References[edit]

  1. ^ "Juice Jacking", Wall of Sheep
  2. ^ a b Rowley, Robert, Juice Jacking 101
  3. ^ Osborn, Kyle, P2P-ADB
  4. ^ a b BlackHat Briefings 2013 Mactans (PDF)
  5. ^ "BadUSB - On Accessories That Turn Evil", BlackHat Briefings USA 2014
  6. ^ Nohl, Karsten; Lell, Jakob, BadUSB Presentation at Blackhat USA 2014
  7. ^ "Turning USB peripherals into BadUSB", SRLabs.de
  8. ^ "Road Warriors: Beware of 'Video Jacking'", Krebs on Security
  9. ^ Iarchy, Roy, iOS Trustjacking
  10. ^ "Beware of Juice Jacking?", Krebs on Security
  11. ^ P2P-ADB on Hak5
  12. ^ "How American Spies Use iPhones and iPads", Fast Company
  13. ^ Drake, Joshua; Lanier, Zach; Mulliner, Collin; Fora, Pau; Ridley, Stephen; Wicherski, Georg (March 2014). Android Hacker's Handbook. Wiley. p. 576. ISBN 978-1-118-60864-7.
  14. ^ "CSI:Cyber L0M1S", Vulture Screencap Recap
  15. ^ "New Android 4.2.2 Feature USB Debug Whitelist", Android Police
  16. ^ SyncStop