4 ms·

I think juice jacking is one of those things that's about a lack of real engagement about risk. Yes it's all very 007 to plant a dodgy usb charger, but it doesn

I think juice jacking is one of those things that's about a lack of real engagement about risk. Yes it's all very 007 to plant a dodgy usb charger, but it doesn't really reflect the real threat profile in the world. If you're just an average guy the biggest risk to you of someone stealing your phone and accessing your data is having your phone out as you walk through a city and someone will just snatch it out of your hands. If you're a head of state you should be more worried about someone like the NSO group and you should be operating a whole host of security practices. And as well as all this remember - the way Stuxnet was delivered wasn't some subtley planted infected phone charger, they had a mole on the inside who inserted the infected USB stick in the full knowledge that what they were doing was breaching security.

Two4 3y ago
I thought they used the Russian consultants as a vector by infecting their laptops before they went inside the airgapped system? I was under the impression that this was the reason Stuxnet spread so far and wide, because it had to spread organically to the Russians' devices. Time for a Wikipedia rabbit hole, I guess.
thefurdrake 3y ago
What about placing public, malicious chargers at the cafe across the street from the busy office building owned by a company whose data you'd really like to steal? It's sort of like the old tactic of dropping interesting-looking USB drives/CDs in the same kind of area, hoping that someone will be dumb/curious enough to plug it in. It's about application and context.
- SilverBirch 3y ago
  If, as a company, you’re expecting all your employees to be opsec experts you either have 1 employee or you are planning to fail. This is like that bullshit fake “phishing” email corporate IT departments send out as a test. The only thing it proves is your attack surface is too large.

Two4 3y ago

I thought they used the Russian consultants as a vector by infecting their laptops before they went inside the airgapped system? I was under the impression that this was the reason Stuxnet spread so far and wide, because it had to spread organically to the Russians' devices. Time for a Wikipedia rabbit hole, I guess.

thefurdrake 3y ago

What about placing public, malicious chargers at the cafe across the street from the busy office building owned by a company whose data you'd really like to steal? It's sort of like the old tactic of dropping interesting-looking USB drives/CDs in the same kind of area, hoping that someone will be dumb/curious enough to plug it in. It's about application and context.

SilverBirch 3y ago
If, as a company, you’re expecting all your employees to be opsec experts you either have 1 employee or you are planning to fail. This is like that bullshit fake “phishing” email corporate IT departments send out as a test. The only thing it proves is your attack surface is too large.