The Strange Case of Juicejacking

Have you ever seen people recharging their mobile phones at a public recharging station in an airport or shopping mall? They no doubt do this to avoid the severe symptoms of Twitter and texting withdrawal.

Don’t they realize that their mobile phone adaptor USB cable is a combination power-and-data connection? Plugging your phone into an untrusted USB cable is just plain stupid. Letting a stranger plug their phone into one of your USB ports is just plain stupid too.

Take a minute to think about the treasure trove of data on that smart phone. Your smart phone has more computing power and memory than my first three computers combined. Your digital and communications life history is on that thing.

When charging your phone from an unknown USB port, use a power-only USB cable. USB plugs have four or five connecting wires. The outermost two are for power. If your cable has two or three of the inner wires missing, then it can’t carry data, only power. This will slow the charging as the data wires allow the phone to control the charging amperage to get it above the minimum 100mA. Never trust a USB cable given to you by a helpful stranger, as a visual inspection will not reveal if it is power-only or power and data (I’ve tested this with a lot of people and over 90% got it wrong). To speed charging in a secure manner, use the charging adapter that came with the phone, not the data connection.

You can increase your security by configuring your device to require a password for all data-transfer features of the charging port. This stops synchronizing your data with another device unless you authorize it. This is good practice, but don’t rely on it if you are hooked-up to a hostile device. Don’t rely on shutting-off the phone as a protection either. It is hard to determine how much of the phone is truly powered-down. Even if the phone is powered-down, a USB connection may provide the hostile device an avenue to the memory card.

If you are in a foreign hotel and don’t have an adapter, please don’t get one from the concierge as you never know where it has been—like maybe to that country’s intelligence agency. I recently encountered a case where the helpful concierge provided an extremely effective and hostile power adapter probably engineered by either a moneyed industrial spy or the host county’s intelligence agency. Most national intelligence agencies conduct economic and industrial espionage— don’t be offended by this, be cautious, don’t take your entire life history with you on that smart phone, and don’t get juicejacked.