Juice jacking

Juice Jacking describes a cyber attack using the power supply of a smartphone , tablet computer or other mobile device. Malware can be transferred from this device to the target computer via its USB port , which is used both for data transfer and for charging the mobile device .

Hazard description

DEFCON 22 booth

During the DEFCON hacking event , the Wall of Sheep company set up "free charging stations". When using these charging stations, a message with the content "... should not trust public charging stations with their devices" was displayed. The aim was to make the public aware of the dangers of falling victim to an attack through such careless charging. In addition, a presentation was given to explain this type of attack in more detail.

In 2012, security researcher Kyle Osborn published a framework called “P2P-ADB” to connect the attacker's device to the victim's device. This connection enables the attacker to unlock the victim's device, gain access to data and carry out further operations.

Georgia Institute of Technology undergraduate and graduate students in security research provided evidence of malicious application software called Mactans that uses the USB port on an Apple device. A cheap hardware component has been designed to infect an iPhone while it is charging. This software can bypass all security precautions contained in the iOS and hid itself as an Apple background process.

Security researchers Karsten Nohl and Jakob Lell from srlabs published their work on BadUSB at the Black Hat conference for information security and demonstrated an attack via a smartphone or tablet connected to the computer to show how vulnerable systems connected via USB port are. They also provided sample code for firmware that can infect Android-based systems.

History and notoriety

Brian Krebs was the first to point out this method of attack and called it " juice-jacking ". After hearing about the Wall of Sheep charging stations , he wrote the first article on his website on computer security. Brian Markus, Joseph Mlodzianowski and Robert Rowley, all Wall of Sheep employees , had designed these charging stations as a tool to warn of potential hazards.

In September 2012, Hak5 demonstrated an attack using Kyle Osborn's P2P-ADB framework.

In late 2012, a document was published by the NSA to inform employees of the dangers that can lurk when charging their smartphones, tablets or notebooks at publicly accessible charging stations.

The Android Hackers Handbook , published in March 2014, mainly discusses juice jacking and the ADB-P2P framework.

In April 2015, Juice Jacking was the main theme in the episode of CSI: Cyber . Season 1: Episode 9, "L0M1S".

Countermeasures

With Apple iOS , several security measures have been taken to reduce the possibility of attack via USB ports, such as automatic integration as a data carrier when connecting the smartphone to a computer.

Android devices ask for confirmation before the device connects to the computer as a disk. A whitelist function has existed since Android version 4.2.2 to prevent attackers from accessing the Android ADB function.

Juice jacking is not possible if a device is connected via the supplied power adapter. The user software “USB Condom”, renamed “SyncStop”, can give the user security.

literature

• Android Hacking Handbook , ISBN 978-1-118-60864-7 .
• Marc Goodman : Global Hack: Hackers who spy on banks. Cyber ​​terrorists who hijack nuclear power plants. Secret Services Cracking Our Cell Phones , ISBN 978-3446444638
• Marc Goodman: Future Crimes: Everything Is Connected, Everyone Is Vulnerable and What We Can Do About It , ISBN 978-0385539005

Web links

• Juice Jacking Information / Warning
• Article on Juice Jacking
• The Wall of Sheep website
• Video example of the action by "The Wall of Sheep"

Individual evidence

1. ↑ Wall of Sheep - About us (English)
2. ↑ The Wall of Sheep website , description of the structure. Accessed January 8, 2016
3. ^ Presentation by Rowley, Robert , Juice Jacking 101. Accessed January 8, 2016
4. ↑ by Kyle Osborn , P2P-ADB. Accessed January 8, 2016
5. ↑ PDF , BlackHat Briefings 2013 Mactans. Accessed January 8, 2016
6. ↑ Security Research Labs GmbH, Berlin ( Memento of the original from March 4, 2016 in the Internet Archive ) Info: The archive link was inserted automatically and has not yet been checked. Please check the original and archive link according to the instructions and then remove this notice. 
7. ↑ BadUSB - On Accessories That Turn Evil , BadUSB Presentation. Accessed January 8, 2016
8. ↑ from Android BadUSB firmware  ( page no longer available , search in web archives )  Info: The link was automatically marked as defective. Please check the link according to the instructions and then remove this notice. , Android BadUSB. Accessed January 8, 2016.  
9. ^ Beware of Juice-Jacking , by Brian Krebs. Accessed January 8, 2016
10. ^ How American Spies Use iPhones and iPads , by Fast Company. Accessed January 9, 2016
11. ↑ Android Hackers Handbook , by Wiley. Accessed January 9, 2016
12. ↑ CSI: Cyber ​​L0M1S , from Vulture Screencap Recap. Accessed January 9, 2016
13. ↑ PDF , BlackHat Briefings 2013 Mactans. Accessed January 8, 2016
14. ^ ADB Whitelist , Android Police. Accessed January 8, 2016
15. ↑ SyncStop , SyncStop website; accessed on January 9, 2016.