ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago

Florian Draschbacher, Lukas Maar, Mathias Oberhuber, Stefan Mangard

This paper introduces **ChoiceJacking**, a novel family of USB-based attacks that effectively bypass the existing mitigations against **JuiceJacking** attacks, which were discovered about a decade ago. JuiceJacking exploits the dual-purpose nature of mobile device USB ports, allowing malicious chargers to establish data connections and compromise devices. In response, mobile operating systems like Android and iOS implemented user prompts requiring explicit consent before a USB host could initiate a data connection. The core assumption underlying these mitigations was that an attacker could not inject user input events while simultaneously establishing a data connection. The researchers demonstrate this assumption to be fundamentally flawed.

AI review

This is exactly the kind of research that makes you reassess assumptions you stopped questioning years ago. Graz TU systematically dismantles a decade of JuiceJacking mitigations across every major mobile vendor, with three distinct attack techniques, working PoC hardware, CVEs already assigned, and a side-channel for stealth timing. It's thorough, novel, and immediately consequential.