The Nigerian Communications Commission (NCC), through the Cyber Security Incident Response Team (CSIRT), recently alerted Nigerians to two data breach methods employed by cybercriminals to gain access to potential victims’ phone while charging their device in public. It’s called juice jacking.
According to the statement released by the NCC titled, ‘NCC-CSIRT Identifies Two Cyber Vulnerabilities,’ with Juice Jacking, cyber attackers can access potential victims’ devices when they use available charging cables or sockets in public spaces like restaurants, malls or even trains.
How It Works
The NCC warns that the attackers often leverage this complimentary service or business solution to install a payload in charging sockets or on the cables at the stations with the aim of transferring the payload to the unsuspecting victims’ phone once they plug their phones.
With the payload on the target device, the attacker has remote access, and is able to monitor texts, phone calls, applications, real time audio and might even be able to watch the victim live if the camera of the target device is not covered. The attacker would also have access the exact location of the device through Global Positioning System (GPS).
You May Have Been Juice-Jacked If:
· The battery consumption of your device is consistently, unusually high.
· Your device is constantly freezing or is operating slower than before
· Applications on your device are crashing or taking too long to open
· The data usage or screen time of applications on your device is oddly high and at variance with what you know to be true.
How to Prevent This Bug
· Avoid using publicly available Universal Serial Bus (USB) data connection cables. Go charge only cables!
· Get a personal AC charging adaptor for use in public and guard it jealously.
· Do not grant access to any prompt for USB data connection from an untrusted cable.
· Install antivirus on your devices and constantly update them.
· If possible, keep a personal power bank and detachable cable with you always.
In addition to ‘Juice Jacking’, The NCC-CSIRT also amplifies a loophole in the Versions 329.0.0.29.120 of Facebook for Android OS application, which allows anyone to be able to accept Facebook friend requests on behalf of an account owner even when the screen of the device is locked.
READ ALSO: One Tweet, One DM and a Love Story That Is Defying Distance
This lacuna opens up the possibility of an attacker having access to personal information of a potential victim having successfully added them as a friend on the social networking app. The NCC-CSIRT therefore advises users to disable the permission feature from their device’s lock screen notification settings.
