iOS and Android juice jacking defenses have been trivial to bypass for years

2 comments

If you plug in to charge your phone somewhere, and it asks you to 'trust' this device, just say NO.
Even worse: https://counterespionage.com/malicious-usb-cables/
If you want to try it yourself: https://counterespionage.com/malicious-usb-cables/
- 🎶Someone didn’t read the article 🎶
  The attacks then exploit various weaknesses in the OS that allow the charger to autonomously inject “input events” that can enter text or click buttons presented in screen prompts as if the user had done so directly into the phone. In all three, the charger eventually gains two conceptual channels to the phone: (1) an input one allowing it to spoof user consent and (2) a file access connection that can steal files.