Juice Jacking

Juice Jacking

A charging port that asks for your files is not a charger.

What Is Juice Jacking?

A USB port carries data as well as power, so a public charging point can hide a computer that reads your phone. In this exercise you plug a nearly flat phone into a cafe charging point, allow the prompt that appears, and see which folders it opened to the port. You replay that moment and deny the same prompt, so the phone charges and shares nothing, then unplug, switch to your own laptop and report it to IT. You finish with the habit that never needs the prompt at all.

What You'll Learn in Juice Jacking

Juice Jacking — Training Steps

  1. A call at half eleven

    It is just after ten at Wrenloft Coffee. Alice has a video call with Tessmoor Cider at half past eleven, on her phone, and a set of label proofs to finish before it. Her phone buzzes on the table.

  2. Seven percent

    The call is still on. The phone may not be: an hour of video will not run on what is left, and her charger is at home. Her laptop is low too, and every minute of its battery has to go on the proofs, so the phone cannot borrow from it yet. All she has in her bag is a USB cable.

  3. Free phone charging

    At the edge of her table sits a small charging block with two USB ports and a printed card: Free phone charging, Wrenloft Coffee. It is exactly what she needs.

  4. A question on the screen

    The cable is in, and the phone lights up with a question. Alice has tapped through prompts like it more times than she can count, and her mind is on the proofs she has to finish before the call.

  5. A message from Ostmere IT

    The proofs went off to Tessmoor a few minutes ago, and the phone's battery has crept up. Then an email from Ostmere IT lands on her laptop, and it is about her phone.

  6. When it could have stopped

  7. Rewind: the same question

    This is a replay of 10:12, the moment that mattered. The cable has just gone into the block, and the phone is asking: Allow access to phone data? A plug that only gives power has nothing to ask. The phone raises this question when the other end of the cable is a computer that wants to read it. The card on the block says charger; the prompt says computer. Hiding a computer behind a public charging point is called juice jacking.

  8. Deny

    In the replay, Alice gives the other answer. Deny leaves the port with power and nothing else: the phone still charges, but it does not open its files to whatever is on the other end.

  9. Power and nothing else

    The prompt is gone and the cable is still in.

  10. Off the block

    Back to now. What happened at 10:12 still stands: she tapped Allow, and her folders have been open to that port since. The phone is still on the charging block, and whatever sits behind that port still has access to it. The proofs are with Tessmoor, so her laptop can spare its battery now. Alice pulls her cable out of the block; her own laptop will top the phone up before the call.

Security Framework Coverage

MITRE ATT&CK

  • T1533 Data from Local System (Mobile)

CIS Controls

  • CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure
  • CIS 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents

NIST CSF

  • PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind