Plugging into a public USB port can quietly hand your phone to a stranger

A dying phone battery in an airport terminal has a way of overriding caution. The nearest free charging kiosk looks harmless enough, just a USB port and a cable, but security researchers have spent more than a decade demonstrating that the same cable used to charge a phone can also move data across that connection, and a compromised port or cable can exploit that dual purpose without a user ever noticing.

A vulnerability built into the cable itself

The underlying issue traces back to how USB was designed. A standard USB connection carries both power and data on the same physical pins, a convenience that lets one cable both charge a device and sync files with a computer. Security researchers refer to the exploitation of that dual channel, using a compromised public charging station or a tampered cable to install malware or copy data off a connected phone, as juice jacking. An attacker only needs to alter the charging equipment itself, either by planting malicious hardware inside a kiosk or by leaving behind a doctored cable, since the phone has no way to visually distinguish a rigged port from a legitimate one.

The 2011 stunt that gave the threat its name

The concept moved from theoretical to demonstrated at the DEF CON security conference in 2011, when researchers Brian Markus, Joseph Mlodzianowski and Robert Rowley, working with the conference’s Wall of Sheep group, built a public charging kiosk specifically to make a point. Over roughly three and a half days, more than 360 attendees plugged their phones into the booth. According to journalist Brian Krebs’s original account of the demonstration, anyone who connected was shown an on-screen warning stating that public kiosks should not be trusted with a smart phone, since information could be retrieved or downloaded from a connected device without the owner’s consent. The booth had not actually stolen anything — it was built purely to educate attendees about the risk — but the experiment coined the term that stuck, and Krebs’s write-up remains the earliest documented use of “juice jacking” in print.

What a compromised port can actually do

In a genuine attack, a rigged charging station or cable can be configured to quietly install malware onto a connected device or exfiltrate files, contacts, photos and credentials while the phone appears to be doing nothing more than charging. The attack requires no action from the victim beyond plugging in, since the connection itself is what opens the data channel. Because the exploit depends on physically compromised hardware at the charging point rather than a remote software flaw, it cannot be patched away entirely — it can only be blocked at the connection itself, either by the device refusing to transfer data or by the user avoiding unknown charging equipment in the first place.

How phone makers responded

Both of the major mobile operating systems eventually built in defenses against exactly this scenario. Modern Android and iOS devices now display a prompt asking whether the user trusts the connected computer before any data transfer is permitted, meaning a phone plugged into a compromised port for power alone will charge normally without exposing its data unless the user actively approves the connection. That single permission dialog closes off the most direct version of the attack, though it depends on the user reading and understanding the prompt rather than reflexively tapping “allow” to make it disappear.

A threat that researchers say is more theoretical than common

Despite the DEF CON demonstration and years of public warnings from government agencies and security vendors, independent reviews have repeatedly found no confirmed cases of juice jacking happening to ordinary users outside of controlled research settings. That gap between a technically real vulnerability and its real-world use has led some security researchers to describe juice jacking as a risk that is easy to demonstrate but rare to encounter, since built-in device protections and the relative effort required to compromise a public charger make it a less efficient attack than simpler methods like phishing. The safest practice security professionals still recommend is straightforward regardless of how often the attack actually occurs: carry a personal charging cable and a standard wall adapter, or use a USB “data blocker” accessory that physically permits power to flow while disabling the data pins, turning any public port into a power-only connection, a mitigation that traces directly back to the dual power-and-data design of the standard USB connection described in the original juice jacking research.

A related trick that targets what a screen displays

Security researchers have since documented a variant that goes beyond data theft entirely. In 2016, the same Wall of Sheep team behind the original DEF CON demonstration built a follow-up they called “video jacking” using roughly $220 in readily available electronics hidden inside a fake charging kiosk. The attack exploits an alternate USB mode, built on standards such as Slimport, MHL or Lightning, that some phones use to mirror their screen output to an external display through the same physical port used for charging. A rigged kiosk built to exploit that mode can silently record everything shown on a connected phone’s screen during the charging session, including typed passwords, lock-screen codes and private messages, without installing any malware on the device itself, and most phones display no warning at all when that video-out mode is activated. Because the technique relies on the phone’s own screen-mirroring hardware rather than a data-transfer exploit, the standard “trust this computer” prompt that blocks conventional juice jacking does not stop it, making it one of the more persistent open questions in public-charging security even as the original juice jacking threat has faded into a largely theoretical one.

This article was produced with the assistance of AI and reviewed by an editor.

More from Morning Overview