Attackers could exploit public phone chargers to exfiltrate mobile device data while circumventing anti-juice jacking defenses with the novel choicejacking technique, according to Hackread.
Unlike juice jacking that involves malware, choicejacking entails charging stations that covertly turn phones to debug or data transfer mode in under 133 milliseconds via device communication protocol abuse, overflow input buffers, or keyboard inputs, a study from Austria's Graz University of Technology researchers showed. Initial device compromise could then be leveraged by threat actors to facilitate access to photos or messages, as well as subsequent payload delivery, said researchers, who urged mobile users to use power banks to charge their devices or activate their devices' "charge only" mode to prevent compromise. "Choicejacking is particularly dangerous because it manipulates a device into making decisions users never intended, all without them realising it. With a single deceptive prompt, attackers can trick people into enabling data transfer, potentially exposing personal files and other sensitive data," said NordVPN cybersecurity advisor Adrianus Warmenhoven.
Unlike juice jacking that involves malware, choicejacking entails charging stations that covertly turn phones to debug or data transfer mode in under 133 milliseconds via device communication protocol abuse, overflow input buffers, or keyboard inputs, a study from Austria's Graz University of Technology researchers showed. Initial device compromise could then be leveraged by threat actors to facilitate access to photos or messages, as well as subsequent payload delivery, said researchers, who urged mobile users to use power banks to charge their devices or activate their devices' "charge only" mode to prevent compromise. "Choicejacking is particularly dangerous because it manipulates a device into making decisions users never intended, all without them realising it. With a single deceptive prompt, attackers can trick people into enabling data transfer, potentially exposing personal files and other sensitive data," said NordVPN cybersecurity advisor Adrianus Warmenhoven.
