Juice Jacking

Juice jacking is a hardware-based attack in which a public USB charging port — at an airport, hotel, conference venue, or coffee shop — is modified to do more than deliver power. Because a USB connection carries both electricity and data over the same cable, a compromised port or cable can attempt to read data from the connected phone or push malware onto it while the owner believes the device is simply charging.

How it works

The attacker either tampers with an existing charging kiosk, plants their own fake charging station, or leaves behind "trusted-looking" cables and power banks that contain hidden hardware (a technique that overlaps with baiting). When a device connects, the malicious hardware attempts to negotiate a data connection rather than a power-only one. Depending on the device's security posture, the attacker may try to exfiltrate photos, contacts, and credentials, or install a persistent implant for later access.

Both the FBI and the FCC have issued public warnings advising travelers to avoid free public USB charging ports for exactly this reason. Modern iOS and Android versions mitigate the risk by requiring the user to explicitly approve data access ("Trust this computer?") when a new USB host connects — which is why a data-access prompt appearing when you only expected charging is the single clearest warning sign of the attack.

For organizations, the concern is less the commuter's personal phone and more the traveling executive or engineer whose device holds corporate credentials, session tokens, and MFA authenticators. One compromised device can become the entry point for account takeover against corporate systems.

How to defend against it

• Carry your own charger and use a wall outlet. AC power sockets carry no data. A personal power bank achieves the same isolation.
• Use a USB data blocker ("USB condom") or a charge-only cable when a USB port is the only option — both physically sever the data pins.
• Never tap "Trust" on an unexpected prompt. If a charging port asks for data access, unplug immediately.
• Cover it in travel security training. Juice jacking belongs in security awareness training for road warriors, alongside evil twin Wi-Fi and shoulder surfing — the physical-world attacks that target employees precisely when they are outside the office perimeter.