Do I Have To Hook My Comcast Router To A Phone Jack

Your smartphone needs a rechargeyet again and you're miles from the charger at home; that public charging kiosk is looking pretty promising–merely plug your phone in and get the sweet, sweet, energy you lot crave. What could possible become wrong, correct? Thanks to mutual traits in cellphone hardware and software design, quite a few things–read on to larn more than about juice jacking and how to avoid it.

What Exactly Is Juice Jacking?

Regardless of the kind of mod smartphone you take–be it an Android device, iPhone, or BlackBerry–there is i common characteristic beyond all phones: the power supply and the data stream pass over the same cable. Whether you're using the at present standard USB miniB connection or Apple's proprietary cables, it's the same situation: the cable used to recharge the bombardment in your phone is the aforementioned cable you employ to transfer and sync your information.

This setup, data/power on the same cable, offers an approach vector for a malicious user to proceeds access to your telephone during the charging procedure; leveraging the USB data/power cable to illegitimately access the telephone's data and/or inject malicious lawmaking onto the device is known as Juice Jacking.

The assault could be as unproblematic as an invasion of privacy, wherein your telephone pairs with a computer concealed within the charging kiosk and information similar individual photos and contact information are transferred to the malicious device. The attack could too be as invasive equally an injection of malicious lawmaking direct into your device. At this year's BlackHat security briefing, security researchers Billy Lau, YeongJin Jang, and Chengyu Song are presenting "MACTANS: Injecting Malware Into iOS Devices Via Malicious Chargers", and here is an excerpt from their presentation abstract:

In this presentation, we demonstrate how an iOS device can be compromised within ane minute of being plugged into a malicious charger. Nosotros first examine Apple'southward existing security mechanisms to protect against arbitrary software installation, so describe how USB capabilities tin be leveraged to bypass these defense mechanisms. To ensure persistence of the resulting infection, nosotros prove how an attacker can hide their software in the aforementioned way Apple tree hides its own built-in applications.

To demonstrate practical application of these vulnerabilities, we built a proof of concept malicious charger, called Mactans, using a BeagleBoard. This hardware was selected to demonstrate the ease with which innocent-looking, malicious USB chargers can exist constructed. While Mactans was congenital with limited amount of fourth dimension and a small budget, nosotros also briefly consider what more motivated, well-funded adversaries could attain.

Using inexpensive off-the-shelf hardware and a glaring security vulnerability, they were able to gain admission to current generation iOS devices in less than a infinitesimal, despite the numerous security precautions Apple has put in identify to specifically avoid this kind of thing.

This sort of exploit is inappreciably a new blip on the security radar, however. Two years ago at the 2011 DEF CON security conference, researchers from Aires Security, Brian Markus, Joseph Mlodzianowski, and Robert Rowley, built a charging kiosk to specifically demonstrate the dangers of juice jacking and alert the public to but how vulnerable their phones were when continued to a kiosk–the image above was displayed to users afterward they jacked into the malicious kiosk. Even devices that had been instructed not to pair or share data were even so oftentimes compromised via the Aires Security kiosk.

Even more troubling is that exposure to a malicious kiosk could create a lingering security problem even without firsthand injection of malicious code. In a recent article on the subject field, security researcher Jonathan Zdziarski highlights how the iOS pairing vulnerability persists and can offer malicious users a window to your device fifty-fifty after you're no longer in contact with the kiosk:

If you're not familiar with how pairing works on your iPhone or iPad, this is the mechanism past which your desktop establishes a trusted relationship with your device so that iTunes, Xcode, or other tools can talk to information technology. Once a desktop machine has been paired, it tin can access a host of personal information on the device, including your address book, notes, photos, music collection, sms database, typing cache, and tin fifty-fifty initiate a total backup of the phone. Once a device is paired, all of this and more can be accessed wirelessly at any time, regardless of whether you have WiFi sync turned on. A pairing lasts for the life of the file system: that is, once your iPhone or iPad is paired with another machine, that pairing relationship lasts until you restore the telephone to a factory country.

This machinery, intended to make using your iOS device painless and enjoyable, can actually create a rather painful land: the kiosk you just recharged your iPhone with tin, theoretically, maintain a Wi-Fi umbilical cord to your iOS device for connected access even afterward y'all've unplugged your phone and slumped into a nearby drome lounge chair to play a round (or twoscore) of Aroused Birds.

How Worried Should I Be?

We're anything simply alarmist here at How-To Geek, and nosotros always give information technology to you straight: currently juice jacking is a largely theoretical threat, and the chances that the USB charging ports in the kiosk at your local airport are really a clandestine forepart for a data siphoning and malware-injecting computer are very low. This doesn't mean, all the same, that y'all should just shrug your shoulders and promptly forget nigh the very real security gamble that plugging your smartphone or tablet into an unknown device poses.

Several years ago, when the Firefox extension Firesheep was the talk of the boondocks in security circles, it was precisely the largely theoretical but still very real threat of a simple browser extension allowing users to hijack the web-service user sessions of other users on the local Wi-Fi node that led to meaning changes. End users started taking their browsing session security more seriously (using techniques like tunneling through their dwelling house net connections or connecting to VPNs) and major internet companies fabricated major security changes (such as encrypting the entire browser session and not just the login).

In precisely this fashion, making users aware of the threat of juice jacking both decreases the risk that people will be juice jacked and increases pressure on companies to better manage their security practices (information technology's great, for example, that your iOS device pairs so easily and makes your user feel smooth, simply the implications of lifetime pairing with 100% trust in the paired device are quite serious).

How Can I Avoid Juice Jacking?

Although juice jacking isn't as widespread a threat as outright telephone theft or exposure to malicious viruses via compromised downloads, you should still have common sense precautions to avoid exposure to systems that may malicious access your personal devices.Image courtesy of Exogear.

The most obvious precautions center around simply making it unnecessary to charge your phone using a third-political party organisation:

Keep Your Devices Topped Off: The most obvious precaution is to proceed your mobile device charged. Make it a habit to accuse your phone at your habitation and office when you lot're not actively using it or sitting at your desk doing work. The fewer times you find yourself staring at a red three% battery bar when you're traveling or abroad from dwelling, the better.

Behave a Personal Charger: Chargers have become then modest and lightweight that they scarcely weigh more than the actual USB cable they attach to. Throw a charger in your bag so you tin charge your own telephone and maintain control over the data port.

Acquit a Fill-in Battery: Whether you opt to deport a full spare battery (for devices that allow you to physically swap the battery) or an external reserve battery (like this tiny 2600mAh 1), you tin go longer without needing to tether your telephone to a kiosk or wall outlet.

In improver to ensuring your phone maintains a full battery, in that location are additional software techniques you can use (although, every bit y'all can imagine, these are less than ideal and not guaranteed to work given the constantly evolving arms race of security exploits). As such, we tin can't truly endorse any of these techniques equally truly effective, just they are certainly more constructive than doing aught.

Lock Your Phone: When your phone is locked, truly locked and inaccessible without the input of a Pivot or equivalent passcode, your phone should not pair with the device it is connected to. iOS devices will merely pair when unlocked–but again, equally we highlighted earlier, pairing takes identify within seconds so yous had better make sure the phone really is locked.

Power the Phone Down: This technique merely works on a phone model by phone model basis as some phones will, despite being powered down, still power on the entire USB circuit and allow access to the flash storage in the device.

Disable Pairing (Jailbroken iOS Devices Only): Jonathan Zdziarski, mentioned earlier in the article, released a small application for jailbroken iOS devices that allows the end user to control the pairing behavior of the device. You can detect his application, PairLock, in the Cydia Store and here.

One final technique you can use, which is effective but inconvenient, is to use a USB cable with the data wires either removed or shorted out. Sold as "power just" cables, these cables are missing the 2 wires necessary for information transmission and have just the two wires for power manual remaining. One of the downsides of using such a cable, nonetheless, is that your device volition usually accuse more slowly equally modern chargers use the data channels to communicate with the device and set an appropriate maximum transfer threshold (absent-minded this communication, the charger will default to the lowest safe threshold).

Ultimately, the all-time defense force against a compromised mobile device is awareness. Proceed your device charged, enable the security features provided by the operating system (knowing that they aren't foolproof and every security arrangement tin can be exploited), and avoid plugging your phone into unknown charging stations and computers the same manner you wisely avoid opening attachments from unknown senders.