<
https://arstechnica.com/security/2025/04/ios-and-android-juice-jacking-defenses-have-been-trivial-to-bypass-for-years/>
"About a decade ago, Apple and Google started updating iOS and Android,
respectively, to make them less susceptible to “juice jacking,” a form of
attack that could surreptitiously steal data or execute malicious code when
users plug their phones into special-purpose charging hardware. Now,
researchers are revealing that, for years, the mitigations have suffered from a
fundamental defect that has made them trivial to bypass.
“Juice jacking” was coined in a 2011 article on
KrebsOnSecurity detailing an
attack demonstrated at a Defcon security conference at the time. Juice jacking
works by equipping a charger with hidden hardware that can access files and
other internal resources of phones, in much the same way that a computer can
when a user connects it to the phone.
An attacker would then make the chargers available in airports, shopping malls,
or other public venues for use by people looking to recharge depleted
batteries. While the charger was ostensibly only providing electricity to the
phone, it was also secretly downloading files or running malicious code on the
device behind the scenes. Starting in 2012, both Apple and Google tried to
mitigate the threat by requiring users to click a confirmation button on their
phones before a computer—or a computer masquerading as a charger—could access
files or execute code on the phone."
Via Violet Blue’s
Threat Model - Cybersecurity: April 29, 2025
https://www.patreon.com/posts/cybersecurity-29-127700677
Cheers,
*** Xanni ***
--
mailto:xanni@xanadu.net Andrew Pam
http://xanadu.com.au/ Chief Scientist, Xanadu
https://glasswings.com.au/ Partner, Glass Wings
https://sericyb.com.au/ Manager, Serious Cybernetics
