Juice jacking

Juice jacking is a theoretical type of compromise of devices like smartphones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data.

While researchers have demonstrated charging-port attacks in controlled settings, as of May 2023, multiple reviews have found no credible reported cases of juice jacking on mobile OSs outside of research efforts, and experts generally assess the risk to typical users as low relative to other threats.

Published research

The Wall of Sheep, an event at Defcon, has set up and allowed public access to an informational juice jacking kiosk each year at Defcon since 2011. Their intent is to bring awareness of this attack to the general public. Each of the informational juice jacking kiosks set up at the Wall of Sheep village have included a hidden CPU, which is used in some way to notify the user that they should not plug their devices in to public charging kiosks. The first informational juice jacking kiosk included a screen that would change from "Free charging station" to a warning message that the user "should not trust public charging stations with their devices". One of the researchers who designed the charging station for the Wall of Sheep has given public presentations showcasing more malicious acts that could be taken via the kiosk, such as data theft, device tracking and information on compromising existing charging kiosks.

Security researcher Kyle Osborn released an attack framework called P2P-ADB in 2012, which utilized USB On-The-Go to connect an attacker's phone to a target victim's device. This framework included examples and proof of concepts that would allow attackers to unlock locked phones, steal data from a phone including authentication keys granting the attacker access to the target device owner's Google Account.