Analysis of Juice Jacking Cyber Security Threat and Solutions

This report provides a comprehensive analysis of juice jacking, a prevalent cybersecurity threat involving data theft and malware installation through compromised USB charging ports. It begins with an introduction to cyber-attacks and the role of social engineers, followed by a background scenario outlining the vulnerabilities of mobile devices, particularly Android users. The report then delves into a detailed description of juice jacking, including the compromised ID pin of USB connectors and recent incidents like those at SBI charging stations. It explores precautionary steps such as avoiding public USB ports, using USB condoms and data blockers, and implementing BYOD policies. The report incorporates literature analysis, citing various studies on the topic, and concludes by summarizing the key findings and emphasizing the importance of system security updates and awareness to mitigate the risks associated with juice jacking.

Running head: JUICE JACKING
Juice jacking
Name of the Student
Name of the University
Author Note

1JUICE JACKING
Table of Contents
1. Introduction............................................................................................................................2
2. Background scenario..............................................................................................................2
3. Detailed description of Juice Jacking.....................................................................................3
4. Recent Juice Jacking incident................................................................................................4
5. Precautionary steps of Juice Jacking......................................................................................4
6. Literature analysis..................................................................................................................5
7. Conclusion..............................................................................................................................6
8. References..............................................................................................................................8
9. Annotated bibliography........................................................................................................10

2JUICE JACKING
1. Introduction
Cyber-attack is defined as the attempt to expose, alter, disable and steal essential data
from any network (Loe et al. 2016). The role of social engineers are very much significant in
any sort of cyber security attack. There are numerous categories of cyber security attacks
which are conducted by the social engineers all-round the world such as Juice Jacking and
Ransomware.
Juice Jacking is one of the most popular cyber security attacks in recent times and it is
spread with the help of USB chargers (Hassan and Hijazi 2017). There are two categories of
Juice Jacking, such as data theft and malware installation.
 Data theft: Whenever a mobile device is connected to a charging point, essential data
from the mobile device is stolen by social engineers.
 Malware installation: After a connection is established, malware is sent to the
connected devices.
The prime objective of this report is to brief the hypothetical manager of any
commercial establishment about the issues which are faced during Juice Jacking incident.
The discussions of this report shall be supported with the help of literature support from
different perspectives. Thus, this report shall be beneficial for any mid-sized government
agency which has highly classified sensitive information.
2. Background scenario
The GPS location of the infected users can be understood by the social engineers with
the help of this cyber security attacks. All the social media interactions are exposed due to
this cyber-attack as well. Call logs, videos and images which are there in the mobile devices
is also exposed due to this cyber-attack (Conversation. 2020). Android users are more

3JUICE JACKING
vulnerable to this cyber attack as compared with the iPhone users as the malware cannot
identify any sort of security vulnerabilities in the systems which are created by Apple
Corporation.
In the year 2011, the concept of Juice Jacking was coined in a security platform in an
American conference (Song and Kong 2017). Giant antivirus organizations such as
Kaspersky had no clue about the ways to minimize the impact of this cyber-attack. Famous
television series called CSI: Cyber has successfully portrayed the entire concept related to
this cyber-attack.
3. Detailed description of Juice Jacking
All the mobile devices which are used in or society as well as in commercial
establishments are very much vulnerable to this cyber attack (Su et al. 2017). Untrusted USB
ports are used by the social engineers for the conduction of Juice Jacking. New work stations
are created by the social engineers in order to spread this cyber-attack from one region to
another.
The webs key is linked with a website and it helps the social engineers to get access
of the data which comes in and moves out of the mobile devices (Dean, Dean and Dean
2016). Most of the older versions of Android are vulnerable to this cyber attack as it does not
have the latest security patches. There are five pins in a regular USB connector, the forth pin
which is the ID pin gets compromised during juice jacking. The social engineers make the
most of that pin and that pin helps to establish an active connection with the control systems
they use while spreading the malware. The below pictorial representation is very much
significant for the readers of this document to understand the colour and description of each
pin of the USB charger.

4JUICE JACKING
Figure 1: Colour and description of the pins of USB connector
{Source: Dean, Dean and Dean 2016).
4. Recent Juice Jacking incident
In the year 2019, public station stations of State Bank of India (SBI) was
compromised due to this cyber-attack (Vasundara 2020). The digital economy of this country
was heavily affected due to this security incident. Essential data of some of the naïve users of
this banking organization was adversely affected due to this juice jacking attack. The
essential customer information of this banking organization was compromised as a result of
this cyber attack. The investigative department stated that the malware cane from the SBI
charging stations which is uniformly distributed all over this country. This cyber attack
resulted in both reputation loss as well financial loss of this banking organization.
5. Precautionary steps of Juice Jacking
Free USB ports must not be used by the users of mobile devices. Carrying a laptop
charger is very much significant to stop the spreading of this cyber-attack (Meng et al. 2017).
The use of USB condoms can also be very much useful to deal with the threat coming from
this cyber-attack. The cost of these USB condoms is around USD $7, hence it can be said
that prevent this cyber attack is not at all cost for the users of the mobile devices. The use of

5JUICE JACKING
the two conductor cable can be very much significant for restricting the spreading of this
cyber-attack. The use of the Juice Jack protector is very much significant to restrict the entry
of the malware which causes Juice Jacking (Neumann 2020). The deployment of the data
blocker devices is very much significant to protect the confidential data which are usually
stored in our mobile devices. There is no real residual risk coming from either data blocker
devices or the Juice Jack protector.
The deployment of the Bring Your Own Device policy can also be very effective in
order to maintain the security and integrity of the data which are stored in mobile devices
(Yang 2017). The use of power only USB cables can also be very much useful to prevent
juice jacking attacks.
6. Literature analysis
As mentioned by Meng et al. (2016), most of the busy commuters or travelers are
vulnerable to this attack as they tend to use public USB stations that are available across
numerous locations in a city. The scholars of this resource helped in understanding that the
data transfer capabilities of the USB chargers get also affected due to juice jacking as the
malware of this security attack has the self-mutation power. The researcher stated that
PortaPow one of the most widely used data blocker which are used by travelers all around the
world to secure their mobile devices from the threat coming from juice jacking. The
researchers also stated that the use of wireless charging pads is also very useful secure most
of the modern mobile devices which are used by commuters all over the world. At the same
time, the researchers also warned that the use of the untrusted cables can also lead to issues
like data leakage, they added that Juice Jacking can lead to security issues in major
commercial establishments as well such as the hospitality industry or a banking organization.
In order to secure these

6JUICE JACKING
According to Reddy (2019), mobile devices must be switched off while it is being
charged with an unknown charger. The researcher of this journal helped in understanding that
the transfer of data with unknown devices must be restricted in the first place in order to deal
with the threat coming from Juice Jacking. The researcher stated that that the functional code
of the malware is very much beneficial for the social engineers to infect any type of mobile
devices. The malware vectors are used to hijack any sort of mobile devices as well as per the
discussions of this journal.
On the other hand, as elaborated by Yang et al. (2016), multiple security measures
can be taken in the first place with the help of security patches. The journal helped in
understanding that the use of an android debug bridge can be very much significant to
address threats coming from cyber attacks like Juice Jacking. The journal helped in
understanding that the system security updates can be understood in the first place with the
help of the system security updates of the mobile devices (Κασαγιάννης 2018). The journal
accepted that the limited access of the anti-viruses cannot be useful to deal with the security
threats coming from this cyber-attack. The scholars highlighted that most of the railway
stations and international airports all around the world have public USB power charging
stations, the social engineers uses these security vulnerabilities
7. Conclusion
Confidential and essential data that are stored in our mobile devices can be
compromised by the social engineers using the Juice Jacking Attack. This cyber security
attack is becoming very much popular these days as it requires minimum effort from the
social engineers who want to conduct this security attack. The two categories of juice jacking
are data theft and malware installation. The GPS location of the infected users can be tracked
by the social engineers after the conduction of this security attack. The cost of the devices

7JUICE JACKING
which can help to deal with this threat such as the USB condoms, data blocker devices and
Juice Jack protectors, are also very much on the lower side and has no residual risks
associated with them. The older versions of the android devices are more vulnerable to this
cyber attack as compared with the iPhone users. The system security updates is one of the
key preventive actions which can be taken by the daily commuters to secure their mobile
devices from this threat. The public USB power charging stations are the key areas that are
compromised by the social engineers to conduct this cyber attack.

8JUICE JACKING
8. References
Dean, P.C., Dean, P.M. and Dean, J.L., 2016. Identity Theft: What You Don’t Know Could
Hurt You. International Journal of Business and Social Science, 7(8).
Hassan, N. and Hijazi, R., 2017. Digital Privacy and Security Using Windows: A Practical
Guide. Apress.
HMD Global unveils Nokia 8.3 5G, 5., 'I hugged her portrait and told her, j., Madhya Pradesh
govt crisis Live: BJP plotted against us, .. and Coronavirus live updates: Vasundara Raje, s.,
2020. Juice Jacking: SBI Warns Of Deadly Mobile Malware. [online] Deccan Herald.
Available at: <https://www.deccanherald.com/specials/juice-jacking-sbi-warns-of-deadly-
mobile-malware-785490.html> [Accessed 20 March 2020].
Loe, E.L., Hsiao, H.C., Kim, T.H.J., Lee, S.C. and Cheng, S.M., 2016, December. SandUSB:
An installation-free sandbox for USB peripherals. In 2016 IEEE 3rd World Forum on
Internet of Things (WF-IoT) (pp. 621-626). IEEE.
Meng, W., Lee, W.H., Liu, Z., Su, C. and Li, Y., 2017, November. Evaluating the impact of
juice filming charging attack in practical environments. In International Conference on
Information Security and Cryptology (pp. 327-338). Springer, Cham.
Meng, W., Lee, W.H., Murali, S.R. and Krishnan, S.P.T., 2016. JuiceCaster: towards
automatic juice filming attacks on smartphones. Journal of Network and Computer
Applications, 68, pp.201-212.
Neumann, P.G., 2020. Risks to the Public. ACM SIGSOFT Software Engineering Notes,
45(1), pp.6-11.
Reddy, N., 2019. Practical Cyber Forensics. Apress.

9JUICE JACKING
Song, Y. and Kong, S.C., 2017. RETRACTED: Affordances and constraints of BYOD (Bring
Your Own Device) for learning and teaching in higher education: Teachers' perspectives.
Su, Y., Genkin, D., Ranasinghe, D. and Yarom, Y., 2017. {USB} snooping made easy:
crosstalk leakage attacks on {USB} hubs. In 26th {USENIX} Security Symposium ({USENIX}
Security 17) (pp. 1145-1161).
The Conversation. 2020. Charging Your Phone Using A Public USB Port? Beware Of 'Juice
Jacking'. [online] Available at: <https://theconversation.com/charging-your-phone-using-a-
public-usb-port-beware-of-juice-jacking-130947> [Accessed 20 March 2020].
Yang, Q., 2017. Exploiting Power for Smartphone Security and Privacy.
Yang, Q., Gasti, P., Zhou, G., Farajidavar, A. and Balagani, K.S., 2016. On inferring
browsing activity on smartphones via USB power analysis side-channel. IEEE Transactions
on Information Forensics and Security, 12(5), pp.1056-1066.
Κασαγιάννης, Γ., 2018. Security evaluation of Android Keystore (Master's thesis,
Πανεπιστήμιο Πειραιώς).

10JUICE JACKING
9. Annotated bibliography
Κασαγιάννης, Γ., 2018. Security evaluation of Android Keystore (Master's thesis,
Πανεπιστήμιο Πειραιώς).
The prime objective of this research paper was to focus on the security vulnerabilities
of the android systems which are being used in our society for different purposes. Identify
theft and data theft are the two most significant adverse effect related with cyber security
attacks such as Juice Jacking. ARM architecture processors, System on chip, and ARM V6
processors are easily compromised in a Juice Jacking attack. Symmetric key ciphers are very
much significant to deal with the security threats coming from Juice Jacking. Trusted
Execution Environment can be very significant for the android users to safeguard their
devices from this cyber attack. TrustZone technology can also be introduced in each of the
latest android phone in order to secure them from any cyber attack. The experimental analysis
conducted in this research paper also helped in understanding the ways by which this cyber
attack can be prevented.
Paul, P. and Aithal, P.S., 2019, October. Mobile Applications Security: An Overview
and Current Trend. In Proceedings of National Conference on Research in Higher
Education, Learning and Administration (Vol. 1, No. 1, pp. 112-121).
According to the researchers of this journal, maintaining mobile security is very much
significant in order to protect the data from security threats like Juice Jacking. Juice Jacking
is one of the most deadly cyber attacks which can have a direct adverse impact on all the
sensitive information which are stored in a mobile device. GSM networks of mobile devices
are very much vulnerable to security threats such as Juice Jacking. The vulnerabilities of the
mobile devices are easily identified by the social engineers, the lack of security patches in the
operating systems which are used in the mobile devices are the other significant reason

11JUICE JACKING
behind the occurrence of cyber attacks such as Juice Jacking. Process isolation is very much
significant in android devices to improve the security of mobile devices. USB chargers are
used for attacking the victims of the Juice Jacking attacks, along with this the scholars of this
data source also stated that Jail breaking and rooting is the other vulnerability related to the
security of the mobile devices.
Čisar, P. and Rudas, I., 2018. Overview of Some Security Aspectsof Smart Phones. In
Thematic conference proceedings of international significance. Vol. 2/International
Scientific Conference" Archibald Reiss Days", Belgrade, 2-3 October 2018 (pp. 383-
393). Belgrade: Academy of Criminalistic and Police Studies.
Based on this conference paper, it can be mentioned that advanced security
capabilities are not very much useful to prevent cyber attacks like Juice Jacking. The number
of detected installation packages that helps in preventing cyber attack is increasing every year
as per the statistical analysis which was conducted in this paper. The top ten mobile risks
which was highlighted in this paper are extraneous functionality, reverse engineering, code
tampering, client code quality, insecure authorization, insufficient cryptography, insecure
authentication, insecure communication, insecure use of data which comes in and moves out
of the mobile devices and improper usage of the security controls which is a type of human
error. Each of these risks can help social engineers to conduct a Juice Jacking attack.
Meng, W., Jiang, L., Choo, K.K.R., Wang, Y. and Jiang, C., 2019. Towards detection of
juice filming charging attacks via supervised CPU usage analysis on smartphones.
Computers & Electrical Engineering, 78, pp.230-241.
In this article the major focus was on the detection of Juice Jacking attacks with the
help of the CPU usage analysis. Cyber criminals are increasingly making the most out of the
security vulnerabilities of the smart phones which are deployed in our society as well as in