2 ms·

>safeR You're also safer if you leave your phone in airplane mode, or better yet off. Juice jacking is possible, but there's no evidence it's been deployed. A

>safeR You're also safer if you leave your phone in airplane mode, or better yet off. Juice jacking is possible, but there's no evidence it's been deployed. A zeroclick attack seems like a much bigger threat, and I can't do much against that. >If you live in the middle of USA you are probably OK but many people live in or near nation states that could totally install juice jackers centrally. You're missing the point. If your adversary is a nation state, you're already screwed. They have better methods of attack than hoping you need to battery is low in some specific location. edit let's assume I run a criminal organization and want to effectively use juice jacking. My first step would be to purchase several expensive zero days, and then develop some kind of software to launch it and to assure only phones susceptible to them get targeted, otherwise people will quickly notice something's wrong. Then I need to get access to real estate in a high traffic area, where I'll need to buy electricity and run some kind of data server. Then I'll need to get people to sift through the resulting data, and the "payoff" is what, banking details or credit cards? Attacking an ATM seems way easier.

throwaway290 3y ago
> You're also safer if you leave your phone in airplane mode, or better yet off. The goal is not to eliminate phone use but to use it safer. > You're missing the point. If your adversary is a nation state, you're already screwed. They have better methods of attack than hoping you need to battery is low in some specific location. Being individually targeted you'd have to do a lot more, lockdown mode and all that. Juice jacking from a charging device in a public place is a mass attack, and the measure is very simple-- don't use public USB ports. > edit let's assume I run a criminal organization and want to effectively use juice jacking. If your criminal organization is also the government then it's a bit easier than what you describe. > assure only phones susceptible to them get targeted, otherwise people will quickly notice something's wrong The attacker simply disconnects data if exploit doesn't work right away. Not many people would notice a split second of a popup.
- boomboomsubban 3y ago
  >If your criminal organization is also the government then it's a bit easier than what you describe. The real estate part is, the rest isn't. And without the financial incentive the benefit becomes unclear. Presumably spying, but you're either hoping to randomly get a high profile target or needing to trawl through a truly massive amount of data for some unknown potential benefit. There are better methods of individual targeting and mass surveillance available to the state.
  - throwaway290 3y ago
    Mass surveillance running real-time face and gait recognition from millions of cctvs is where massive data is. But that surveillance won't tell you who's e2e messaging journalists, you gotta get into the device for that. Physically getting a hold of the phone is hard and NSO won't sell you Pegasus. Moreover you don't even know who are the "bad guys" with inconvenient opinions to start with. But set up a juice jacker and targets come to you. If you get a few dissidents and their contacts, a few of the wrong religion, a handful of your regular civilians who are traveling abroad and can be blackmailed into spying with spicy photos from the hidden folder. Small amounts of data and much boost for your hot career as a despicable dictator.

throwaway290 3y ago

> You're also safer if you leave your phone in airplane mode, or better yet off. The goal is not to eliminate phone use but to use it safer. > You're missing the point. If your adversary is a nation state, you're already screwed. They have better methods of attack than hoping you need to battery is low in some specific location. Being individually targeted you'd have to do a lot more, lockdown mode and all that. Juice jacking from a charging device in a public place is a mass attack, and the measure is very simple-- don't use public USB ports. > edit let's assume I run a criminal organization and want to effectively use juice jacking. If your criminal organization is also the government then it's a bit easier than what you describe. > assure only phones susceptible to them get targeted, otherwise people will quickly notice something's wrong The attacker simply disconnects data if exploit doesn't work right away. Not many people would notice a split second of a popup.

boomboomsubban 3y ago
>If your criminal organization is also the government then it's a bit easier than what you describe. The real estate part is, the rest isn't. And without the financial incentive the benefit becomes unclear. Presumably spying, but you're either hoping to randomly get a high profile target or needing to trawl through a truly massive amount of data for some unknown potential benefit. There are better methods of individual targeting and mass surveillance available to the state.
- throwaway290 3y ago
  Mass surveillance running real-time face and gait recognition from millions of cctvs is where massive data is. But that surveillance won't tell you who's e2e messaging journalists, you gotta get into the device for that. Physically getting a hold of the phone is hard and NSO won't sell you Pegasus. Moreover you don't even know who are the "bad guys" with inconvenient opinions to start with. But set up a juice jacker and targets come to you. If you get a few dissidents and their contacts, a few of the wrong religion, a handful of your regular civilians who are traveling abroad and can be blackmailed into spying with spicy photos from the hidden folder. Small amounts of data and much boost for your hot career as a despicable dictator.