Ɔmanfo Wi-Fi hacks, bɔne twin hotspots, ne juice jacking¶

Wimhyɛn gyinabea, ahɔhodan, kɔfe sotɔɔ, nhyiam mmeae, nhomakorabea, ne mmeae a wɔde kar fa so yɛ mmeae titiriw a wɔbɔ abɔmmɔ ma honam fam ntua abien a ɛbɛn honam fam kɔmputa so: Evil Twin rogue Wi-Fi hotspots ne Juice Jacking (ɔmanfo USB charging ports a ayɛ basaa). Sɛ wode wo smartphone anaa laptop no bata wireless access point a ɔtowhyɛfo di so anaasɛ wode wo cable no hyɛ ɔmanfo USB port a wɔayɛ mu nsakrae mu a, wode network anaa honam fam bridge tẽẽ ma ɔtamfo bi ma osiw wo kar akwan, twa wo login credentials, anaasɛ fa active authentication session cookies.

Sɛ wuhui nkyɛe sɛ woakyerɛw wo email, adwumakuw login, anaa payment card ho nsɛm wɔ ahɔhodan anaa wimhyɛn gyinabea Wi-Fi splash screen a ɛyɛ adwenem naayɛ mu, anaasɛ sɛ wo fon no puei "Trust This Computer" prompt bere a wɔde ahyɛ ɔmanfo charge kiosk mu a, ntɛm ara a wobɛsiw wo so no betumi asiw ɔtowhyɛfo bi kwan sɛ ɔbɛto wo mu wɔ wo akontaabu mu. Saa akwankyerɛ yi de anammɔn a wɔbɛfa so asan anya asɛm a esii ntɛm ara, mfiridwuma mu nkyerɛkyerɛmu a ɛfa wireless ne USB hardware ntua ho, dwumadie nhyehyɛeɛ adansedie nkrataa ho akontabuo, ne akwantuo a ɛyɛ den ho nhyehyɛeɛ a egyina akwankyerɛ a ɛfiri Cybersecurity and Infrastructure Security Agency (CISA) a ɛwɔ United States, National Cyber ​​Security Center (NCSC) a ɛwɔ United Kingdom, Federal Communications Commission (FCC), ne European Union Agency for Cybersecurity (ENISA) hɔ ma.

Yɛ eyi mprempren¶

1. Twa Wi-Fi ntwamutam no mu ntɛm ara anaa yi USB nhama no fi nhama no mu. Dum Wi-Fi koraa wɔ wo laptop, tablet, anaa smartphone so, anaasɛ twe wo charge cord no fi ɔmanfo USB port no mu honam fam ntɛm ara.
2. Wo werɛ mfi Wi-Fi ntwamutam a ɛyɛ atoro no sɛnea ɛbɛyɛ a wo mfiri no ntumi nsan nkɔ so bio. Bue wo mfiri no Wi-Fi nhyehyɛe no, paw ntwamutam din a ɛyɛ hu (SSID), na pia Forget This Network (anaasɛ yi Connect Automatically) sɛnea ɛbɛyɛ a wo radio no begyae nkitahodi nhwehwɛmu ahorow a ɛrebɔ akɔ attacker hardware no so.
3. Sdan kɔ cellular data (4G/5G) nkutoo so na woabɔ akontaabu a asɛe ho ban. Mfa mpɔtam hɔ ɔmanfo Wi-Fi ntam nkitahodi biara nni dwuma da bere a woresan asiesie wo adansedi nkrataa no. Fa wo smartphone native cellular connection anaa kɔmputa a ɛyɛ soronko a ɛnyɛ nea ɛyɛ hu di dwuma wɔ network a wogye di so.
4. Twaw active login sessions nyinaa mu na dannan passwords ma exposed accounts. Sɛ wo kyerɛw password bi wɔ fake Wi-Fi captive portal mu anaasɛ wode wo nsa hyɛɛ account bi mu wɔ rogue network no so a, bue saa account security dashboard no, klik Sign out of all devices / Revoke active sessions, sesa wo password no kɔ passphrase soronko bi so, na freeze credit anaa debit card biara a ne nɔma a wokyerɛw no.
5. Audit na yi root certificates, VPN profiles, anaa inbox mmara biara a ɛyɛ atoro. Hwɛ wo operating system certificate store ne device management nhyehyeɛ no mu na hwɛ sɛ captive portal no andaadaa wo ma woamfa configuration profile bɔne bi anhyɛ mu, na hwɛ wo email nhyehyeɛ no mu sɛ auto-forwarding mmara a wɔmma ho kwan anaa.
6. Reboot na hwɛ wo mobile device sɛ wo tapped "Trust" wɔ USB kiosk so. Sɛ wo tapped "Trust This Computer" anaasɛ wo ma USB File Transfer/Debugging yɛɛ adwuma wɔ ɔmanfo charging station a, ma Airplane Mode nyɛ adwuma, hwɛ sɛ wonnim side-loaded apps anaa profiles, na bɔ sikasɛm mu korɔnbɔ anaa apoobɔ a emu yɛ den ho amanneɛ kyerɛ mmarahyɛ baguafo anaa wo mpɔtam hɔ ntɛmpɛ nɔma (911 wɔ United States ne Canada, 112 wɔ Europa Aman Nkabom no nyinaa mu, 999 wɔ United Kingdom, anaa hwɛ nɔma ahorow a egye ntɛmpɛ).

Ɔmanfo Wi-Fi ne USB charging asɛm a esii ho mmuae dua¶

flowchart TD
    Start["Suspected Public Wi-Fi or USB Charging Compromise"]
    ThreatType{"Which proximity vector occurred?"}
    WiFiBranch["Connected to Suspected Evil Twin Wi-Fi<br/>or Fake Captive Portal Splash Page"]
    USBBranch["Plugged Phone or Laptop Into Public USB Port<br/>or Used an Unattended Cable (Juice Jacking)"]

    WiFiAction1["1. Turn off Wi-Fi radio and tap 'Forget This Network'<br/>2. Switch to trusted 4G/5G cellular data"]
    WiFiPrompt{"Did you type credentials, payment card data,<br/>or install a profile/certificate?"}
    WiFiCompromised["ACTIVE CREDENTIAL / TRAFFIC COMPROMISE<br/>1. Revoke all active login sessions and refresh tokens<br/>2. Rotate passwords and check email forwarding rules<br/>3. Delete rogue Device Management profiles and Root CAs<br/>4. Freeze payment card and issue replacement number"]
    WiFiPassive["PASSIVE CONNECTION ONLY (HTTPS intact)<br/>1. Flush local DNS and ARP caches<br/>2. Enable audited VPN and Encrypted DNS (DoH/DoT)<br/>3. Monitor account login logs for 14 days"]

    USBAction1["1. Physically unplug USB cable immediately<br/>2. Do not use any cable left hanging in a kiosk"]
    USBPrompt{"Did you unlock the device and tap<br/>'Trust This Computer', 'Allow USB Debugging',<br/>or see rapid ghost typing on screen?"}
    USBCompromised["ACTIVE USB DATA OR HID KEYSTROKE BREACH<br/>1. Enable Airplane Mode to cut C2 network callbacks<br/>2. Check for rogue MDM profiles, accessibility apps, or shells<br/>3. Rotate passwords from a separate clean device<br/>4. Back up important photos/files and perform Factory Reset"]
    USBBlocked["OS USB RESTRICTED MODE PROTECTED DEVICE<br/>1. Reboot device to clear USB controller volatile state<br/>2. Charge using AC wall outlet brick or personal battery bank"]

    Start --> ThreatType
    ThreatType -->|Evil Twin Wi-Fi| WiFiBranch
    ThreatType -->|Public USB Port| USBBranch
    WiFiBranch --> WiFiAction1
    WiFiAction1 --> WiFiPrompt
    WiFiPrompt -->|Yes| WiFiCompromised
    WiFiPrompt -->|No| WiFiPassive
    USBBranch --> USBAction1
    USBAction1 --> USBPrompt
    USBPrompt -->|Yes| USBCompromised
    USBPrompt -->|No: Locked or Rejected| USBBlocked

Sɛnea Evil Twin Wi-Fi ne asisifo nnommumfa portals yɛ adwuma¶

Evil Twin yɛ wireless access point a ɛyɛ nnaadaa a ɔtowhyɛfo bi de laptop, multi-radio auditing router a wotumi fa so (te sɛ Wi-Fi Pineapple), Raspberry Pi, anaa smartphone hotspot a wɔayɛ mu nsakrae a wɔde asi ɔmanfo beae a adagyew nnim mu na ɛyɛ adwuma. Wɔ IEEE 802.11 Wi-Fi gyinapɛn ase no, ɔmanfoɔ ntwamutam din a wɔabue, a wɔfrɛ no Service Set Identifiers (SSIDs), wɔ zero cryptographic authentication a ɛkyerɛ sɛ hena na ɔwɔ din no. Obiara a ɔte wo nkyɛn wɔ mita 30 kosi 100 (anammɔn 100 kosi 330) wɔ terminal lounge anaa ahɔhodan abrannaa so betumi abɔ wireless network a wɔato din Airport_Free_WiFi, . Starbucks_Guest, . Marriott_Conference, anaa Inflight_WiFi.

Esiane sɛ client devices no ankasa paw access point a ɛde radio signal a emu yɛ den sen biara (a wɔde decibel susuw no sɛ wɔde toto milliwatt, anaa dBm) ma network din a ɛne no hyia nti, ɔtowhyɛfo a ɔte wo pon so akyirikyiri mita 5 (anammɔn 16) no bedi mmara kwan so router a ɛwɔ soro mita 25 (anammɔn 82) no so nkonim ntɛm ara. Sɛ mpo wo ne ahɔhodan Wi-Fi ankasa abɔ dedaw a, ntuafo taa de 802.11 deauthentication ("deauth") frame ahorow a wɔayɛ no atoro a ɛbɔ wo fon anaa laptop no fi router a ɛfata no so bere tiaa bi, na ɛhyɛ wo mfiri no ma ɛsan kɔ ɔtowhyɛfo no Evil Twin sɛnkyerɛnne a emu yɛ den no so ara kwa a wunhu.

Sɛ wo mfiri no ne Evil Twin kwan no di nkitaho pɛ a, ɔtowhyɛfo no di wo mpɔtam hɔ Dynamic Host Configuration Protocol (DHCP) aponkɛse ne Domain Name System (DNS) resolver no so, na ɔde wɔn si Adversary-in-the-Middle (AitM) gyinabea wɔ wo mfiri ne intanɛt ntam.

Mfiridwuma ntua vectors anan a ɛwɔ Wi-Fi a ɛyɛ atoro so no¶

Bere a nnɛyi Transport Layer Security (HTTPS / TLS 1.3) ne HTTP Strict Transport Security (HSTS) siw Wi-Fi dwumayɛni a ɔyɛ ɔkwasea kwan sɛ ɔbɛkenkan wɛbsaet nkratafa a wɔabɔ no kokoam wɔ browser ahorow a wɔayɛ no foforo so wɔ ɔkwan a ɛho nhia so no, ntuafo de akwan pɔtee anan twa HTTPS ho hyia:

1. Captive portal Adversary-in-the-Middle (AitM) credential harvesting: Bere biara a wobɛkɔ ahɔhodan, wimhyɛn gyinabea, anaa café ntam nkitahodi mu no, wo dwumadi nhyehyɛe no hwɛ kwan sɛ Captive Portal login window bɛba ankasa. Esiane sɛ captive portals yɛ adwuma ansa na wo VPN no abɔ nti, wɔahyɛ wɔn a wɔde di dwuma no sɛ wɔbɛgye login box biara a ɛbɛda adi no adi. Ntuafo gye ahɔhodan, wimhyɛn adwumakuw, Microsoft 365, Google Workspace, Apple ID, anaa sohyial media login nkratafa a ɛyɛ pixel-perfect clones a ɛkɔ so wɔ bere ankasa mu reverse-proxy frameworks (te sɛ Evilginx2 anaa Modlishka) akyi. Sɛ wo kyerɛw wo email password ne 6-digit Multi-Factor Authentication (MFA) code kɔ atoro portal no mu kɔ "Unlock Free High-Speed ​​Wi-Fi" a, reverse proxy no de wo credentials kɔma nea ɔde ma ankasa no na owia session authentication cookie a wɔasan de aba no fi asuten no mu pɛɛ.
2. Malicious Root Certificate Authority (CA) ne MDM profael instɔlehyɛn: Nnommum portal a ɛyɛ atoro betumi ada adwumakuw anaa ahɔhodan amanneɛbɔ a ɛyɛ nokware adi a ɛka sɛ: "Sɛ wopɛ sɛ wudi ntwamutam ahobammɔ gyinapɛn ahorow so a, yɛsrɛ wo klik Ma kwan ma fa yɛn bere tiaa mu Wi-Fi SSL abodin krataa / ntwamutam profile instɔlehyɛn." Sɛ wopene root adansedi krataa anaa Mobile Device Management (MDM) profael so a, wo dwumadi nhyehyɛe no ne ɔtowhyɛfo no bedi sɛ Certificate Authority a wogye di, a ɛma wɔn proxy server no tumi yɛ SSL abodin krataa a ɛfata ma bank anaa email domain biara na ɔde decrypt wo HTTPS traffic nyinaa wɔ bere ankasa mu.
3. Preferred Network List (PNL) ne KARMA/MANA auto-join sniffing: Sɛ wodan Wi-Fi wɔ wo kotoku anaa w’akyi bag mu a, wo fon anaa laptop no de probe abisadeɛ kɔ bere ne bere mu de hwehwɛ network ahorow a woakɔka ho wɔ bere a atwam no mu. Sɛ wowɔ "Auto-Join" a wɔahyɛ no den ama ntwamutam a wɔabue (te sɛ attwifi, . xfinitywifi, . Boingo_Hotspot, anaa Hotel_Guest), rogue access points tie saa broadcast probes no na dynamically spawn virtual network a ɛne SSID biara a wo device rehwehwɛ hyia, komm de wo laptop anaa fon no bata ho bere a ɛte wo bag mu.
4. Local subnet lateral movement (SMB, AirDrop, mDNS, ne LLMNR poisoning): Public Wi-Fi networks a entumi nhyɛ AP Client Isolation no de wo laptop no si Layer-2 local area network fã koro no ara pɛpɛɛpɛ sɛ ɔhɔho foforo biara a ɔwɔ dan no mu. Ntuafo hwehwɛ mfiri a ɛbemmɛn no mu hwehwɛ Windows Server Message Block (SMB) fael kyɛfa a ɛda adi, Remote Desktop (RDP), Secure Shell (SSH), nkɔso wɛb server ahorow a wɔabue (0.0.0.0:3000 anaasɛ :8080), anaasɛ awuduru a ɛwɔ mpɔtam hɔ Link-Local Multicast Name Resolution (LLMNR) ne Multicast DNS (mDNS) nsɛmmisa mu de kyere Windows NetNTLMv2 asɛmfua hashes.

Wireless nkitahodi akwan a wɔde toto ho denam ahobammɔ gyinabea so¶

Fa ntotoho pon yi susuw wo nkitahodi nhyehyɛe ahorow ho bere a woreyɛ adwuma wɔ akyirikyiri fi fie anaa adwumayɛbea no:

Step-by-step recovery after an Evil Twin Wi-Fi incident¶

If you connected to a suspicious public Wi-Fi network, saw browser certificate warnings (NET::ERR_CERT_AUTHORITY_INVALID), or entered information into a sketchy captive portal, perform these four technical remediation steps in sequence over a trusted cellular connection:

Step 1: Audit and remove rogue configuration profiles and Root CAs¶

Before changing any passwords on your device, verify that the attacker did not install a persistent Mobile Device Management (MDM) profile, rogue VPN configuration, or Root Certificate Authority that would allow them to watch you type your new passwords:

• On Apple iPhone and iPad (iOS / iPadOS):
• Open Settings > General > VPN & Device Management. Unless your device is managed by your employer IT department, there should be zero Configuration Profiles listed here. If you see any unrecognized profile, tap it immediately, select Remove Profile, enter your passcode, and restart your phone.
• Next, open Settings > General > About, scroll to the bottom, and tap Certificate Trust Settings. Under Enable Full Trust for Root Certificates, verify that no user-installed root certificates are toggled on.
• On Android smartphones and tablets:
• Open Settings > Security & privacy > More security settings > Encryption & credentials > Trusted credentials and switch from the System tab to the User tab.
• Any certificate listed under the User tab was manually installed onto the device. Tap any unrecognized certificate and select Remove / Uninstall.
• Also check Settings > Security & privacy > More security settings > Device admin apps and make sure no unknown app has device administrator privileges.
• On Apple macOS laptops:
• Open System Settings > General > Device Management (or Privacy & Security > Profiles) and remove any unrecognized configuration profile.
• Open Keychain Access, inspect System and login keychains under the Certificates tab, and delete any unfamiliar certificate marked with a blue + custom trust icon.
• On Microsoft Windows 10 and 11 laptops:
• Press Win + R, type certmgr.msc, and press Enter. Expand Trusted Root Certification Authorities > Certificates and delete any rogue root certificate you were prompted to install.
• Open Settings > Network & Internet > Proxy and verify that Use a proxy server has not been pointed to an external attacker IP address or .pac script.

Step 2: Flush poisoned DNS and ARP network caches¶

Sɛ wo ne Evil Twin router di nkitaho a, attacker DHCP ne DNS server no taa de wo kɔmputa no DNS records a awuduru wom a Time-To-Live (TTL) values ​​tenten wom ma enti redirect no kɔ so wɔ hɔ mpo bere a woasesa networks akyi. Popa wo mpɔtam hɔ network caches no ntɛm ara: - Wɔ Windows so: Bue Command Prompt sɛ Administrator na tu mmirika ipconfig /flushdns akyi no arp -d *. - Wɔ macOS so: Bue Terminal na tu mmirika sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. - Wɔ iOS ne Android so: Dane Airplane Mode ON simma 30, afei dum no na san bɔ fon no. - Wɔ wɛb brawsa mu: Popa Mfonini ne fael a wɔakora so ne Kuki ne sait data afoforo wɔ nnɔnhwerew 24 a atwam no mu.

Anamɔn 3: Twa active session cookies na dannan passwords¶

Sɛ wokɔɔ Google, Microsoft 365, Apple ID, social media, anaa w’ankasa akontaabu biara mu wɔ captive portal window no mu anaa bere a woakɔ network bi a na adansedi krataa a ɛyɛ atoro bi reyɛ adwuma so a: 1. Wo password a wobɛsesa no nkutoo ntaa nnɔɔso sɛ attacker reverse proxy no wiaa wo post-authentication session cookie anaa OAuth refresh token a. 2. Kɔ akonta ahobanbɔ nhyehyɛe biara a ɛka no mu wɔ cellular data so, kɔ Active Sessions / Where You’re Signed In / Devices, na klik Sign out of all sessions. 3. Dannan akontaabu no mu asɛmfua no kɔ asɛmfua a ɛyɛ den na ɛyɛ soronko a ɛwɔ nkyerɛwde 16 kosi 20 a wɔde asie wɔ asɛmfua sohwɛfo mu. 4. Hwɛ wo email akontaabu Forwarding ne Inbox Rules / Filters (wɔ Gmail anaa Outlook mu) na si so dua sɛ ɔtowhyɛfo no andua mmara a ɛyɛ komm a ɔde auto-forwarding password reset emails anaasɛ ɔde ahobammɔ kɔkɔbɔ kɔ Trash. 5. Fa wo akonta Multi-Factor Authentication no kɔ soro kɔ Passkey anaa FIDO2 hardware ahobanbɔ safoa (WebAutn) a ɛko tia phishing, a ɛkyekyere wɔ cryptographic kwan so kɔ domain din ankasa no so.

Anamɔn 4: Freeze payment cards a wɔde ahyɛ captive portals mu¶

Sɛ wokyerɛw credit anaa debit card nɔma, da a ɛbɛba awiei, ne CVV ahobammɔ code guu Wi-Fi portal a ɛyɛ adwenem naayɛ so a: 1. Bue wo banking app ntɛm ara wɔ cellular data so na Lock / Freeze kaad no. 2. Frɛ nsisi dwumadibea nɔma a ɛwɔ wo kaad no akyi no, bɔ amanneɛ sɛ wɔasɛe kaad no ho nsɛm wɔ ɔkwan bi a wosusuw sɛ ɛyɛ phishing portal so, na bisa sɛ wɔmfa kaad nɔma foforo a ɛwɔ ahinasa 16 ne CVV nsi kaad no ananmu. 3. Bisa nea ɔde kaad ma no sɛ ɔnsan nsiesie Account Updater (Visa VAU / Mastercard ABU) token biara a ɛyɛ adwuma ankasa sɛnea ɛbɛyɛ a wɔn a wɔsan tua kaad a wɔmma ho kwan no ntumi nni wo kaad nɔma foforo no akyi.

Sɛnea Juice Jacking ne USB nhama a wɔde akode ahyɛ mu yɛ adwuma¶

Standard Universal Serial Bus (USB) nkitahodi ahorow, a USB Type-A, Micro-USB, Apple Lightning, ne USB Type-C ka ho, de anyinam ahoɔden nhama ne data a wɔde fa akwan abien so pin a ɛwɔ plug koro no ara mu bom: - Wɔ 4-pin USB 2.0 nkitahodi mu no, Pin 1 (VBUS) kura +5 volts DC ahoɔden ne Pin 4 ( .GND) ma anyinam ahoɔden asase, bere a Pin 2 ( .D-) ne Pin 3 ( ) .D+) de differential data signals kɔ host kɔmputa ne afiri a ɛka ho no ntam. - Wɔ 24-pin USB Type-C nkitahodi mu, wɔ anan nkyɛn VBUS tumi pin ne asase pin anan, plug no mu D+/D- data abien, SuperSpeed ​​anan a ɛde ahoɔhare kɛse di dwuma TX/RX data akwan (ɛkɔsi 40 Gbps), ne Nsiesiei kwan (CC1/ .CC2) pins a wɔde di dwuma de di nkitaho wɔ tumi a wɔde ma ne host/device dwumadi ahorow ho.

Juice Jacking ba bere a ɔtamfo bi sesa hardware a wɔde asie ɔmanfo USB charging socket akyi anaasɛ ogyaw weaponized charging cable a wɔde ahyɛ ɔmanfo kiosk mu ma akwantufo de adi dwuma.

Honam fam USB charging ntua ahorow abiɛsa no¶

flowchart TD
    USBPlug["User Plugs Device Into Public USB Port or Unknown Cable"]
    AttackClass{"What malicious hardware is behind the port or inside the cable?"}
    Class1["1. MTP / PTP / ADB Data Exfiltration Host<br/>Hidden SBC (Raspberry Pi / microcontroller) requests<br/>file sync, photo access, or backup extraction"]
    Class2["2. BadUSB / HID Keystroke Injection Implant<br/>Cable head (O.MG Cable / Hak5) enumerates as a<br/>USB Keyboard + Wi-Fi AP and types shell commands"]
    Class3["3. Electrical Surge ('USB Killer') Capacitor<br/>Boosts 5V DC into -200V DC high-voltage pulses<br/>dumped directly into the device data lines"]

    Defense1["Mitigated if OS stays locked (USB Restricted Mode)<br/>OR if user taps 'Don't Trust' / uses a Data Blocker"]
    Defense2["Bypasses 'Trust Computer' prompts on unlocked screens<br/>because OS automatically trusts USB keyboards;<br/>prevented ONLY by never using unknown cables/ports"]
    Defense3["Destroys motherboard USB controller instantly;<br/>prevented by using your own AC wall charger or battery bank"]

    USBPlug --> AttackClass
    AttackClass -->|Data Host| Class1
    AttackClass -->|HID Keyboard| Class2
    AttackClass -->|Voltage Spike| Class3
    Class1 --> Defense1
    Class2 --> Defense2
    Class3 --> Defense3

1. Data exfiltration ne debugging abuse (MTP / iOS Pairing / ADB): Kɔmputa a wɔde asie wɔ USB ɔfasu mprɛte no akyi yɛ adwuma sɛ USB Host na efi ase de data nsa bɔ wɔ D+/D- pin ahorow. Sɛ akwantufo bi bue ne fon no na ɔbɔ "Trust This Computer" (iOS) anaasɛ ɔpaw "File Transfer / MTP" anaa "Allow USB Debugging" (Android) a, kɔmputa a ahintaw no betumi ayɛ mfonini, nkitahodi, nkrasɛm, ne mpɔtam hɔ backups a wɔankora so, anaasɛ side-load spyware denam Android Debug Bridge (ADB) so.
2. HID (Human Interface Device) keystroke injection ("BadUSB" ne O.MG Cables): Ntuafoɔ gyaw nhama a wɔasesa (te sɛ O.MG Cables) a wɔde ahyɛ wimhyɛn gyinabea anaa ahɔhodan mu nsuo afiri mu a ɛte sɛ nea ɛte sɛ Apple, Samsung, anaa Anker USB-C ne Lightning nhama ankasa na ɛbɔ ho ka. Wɔde microprocessor ne Wi-Fi transceiver ahintaw plastic connector shell no mu. Sɛ wode hyɛ laptop anaa fon a wɔanto mu mu a, cable no ka kyerɛ wo operating system no "Meyɛ USB hardware keyboard a ɛyɛ gyinapɛn." Esiane sɛ operating systems gye keyboards di a ɛnkyerɛ "Trust This Computer" prompt nti, cable no kyerɛw keystroke ɔhaha pii ntɛm ara wɔ sekan biara mu (ɛbue Terminal, PowerShell, anaa browser windows) bere a wɔde Wi-Fi so kanyan no.
3. Electrical hardware ɔsɛe ("USB Killer"): Nhama anaa ports a wɔasesa a DC-to-DC boost converters nketewa wom no charge capacitors fi 5-volt power line no so na ɛma 200-volt anyinam ahoɔden spikes san kɔ tẽẽ kɔ data pins no ase, daa frying USB controller chip ne logic board.

Ɔmanfo akwan a wɔfa so gye sika ne hardware ahobammɔ a wɔde toto ho¶

Anamɔn anammɔn a wɔsan nya wɔ bere a wosusuw sɛ Juice Jacking anaa USB asɛm bi asi akyi¶

Sɛ wode wo fon anaa laptop no ahyɛ ɔmanfo USB port anaa cable a wunnim mu a, hwehwɛ nea esii wɔ wo screen so na di recovery tier a ɛne no hyia no akyi:

Scenario A: Wo screen no kɔɔ so too mu, anaasɛ wobɔ "Don't Trust".¶

Nnɛyi iOS (efi iOS 11.4.1) ne Android (Android 9+) de ahobammɔ a wɔde ahyɛ mu a wɔfrɛ no USB Restricted Mode anaa Charge-Only USB Default ka ho. Sɛ wode fon a wɔato mu hyɛ USB data host mu a, dwumadie nhyehyɛeɛ no ma USB data nhama no twa mu wɔ nteaseɛ mu na ɛtwe anyinam ahoɔden nko ara kɔsi sɛ wobɛbue screen no na woabɔ "Trust" pefee (na woakyerɛw wo passcode no mprenu so wɔ iOS so) anaasɛ wobɛsesa USB amanneɛbɔ no akɔ "File Transfer."

Sɛ woankɔ "Trust" so da na woamfa cable a wunnim anni dwuma bere a wɔabue wo screen no a: 1. Yi nhama no fi nhama no mu ntɛm ara. 2. Dum wo fon no ahoɔden koraa, twɛn sikani 30, na san dane na yi USB port controller no memory a ɛyɛ mmerɛw no fi hɔ. 3. Dan kɔ AC ɔfasu mu afiri anaa batere sikakorabea.

Nsɛm a ɛfa ho B: Wobɔɔ "Trust This Computer," wo maa USB Debugging yɛɛ adwuma, anaasɛ wuhuu ghost typing¶

Sɛ wobue wo fon no na wobɔ "Trust" wɔ ɔmanfoɔ charging station, woama Android USB Debugging ayɛ adwuma, anaasɛ wode cable a wunnim ahyɛ fon anaa laptop a wɔanto mu mu na wohunuu sɛ ahonhommɔne rekyerɛw ntɛmntɛm a: 1. Twe cable no na ma Airplane Mode no nyɛ adwuma ntɛm ara (anaasɛ dum Wi-Fi ne cellular data) na ama woagyae background payload biara a wɔde ahyɛ mu no sɛ ɛnkɔ abɔnten command-and-control server so. 2. Wɔ iOS / iPadOS so no: - Sɛ wobɔ "Trust This Computer" a, ɛbɛma woanya cryptographic pairing record a ɛma host kɔmputa no tumi nya backups, mfonini, ne developer nnwinnade. - Sɛ wopɛ sɛ wotwa kɔmputa a wogye di nyinaa wɔ iPhone so ntɛm ara a, bue Nsiesiei > General > Transfer anaa Reset iPhone > Reset > Reset Location & Privacy (a ɛpopa USB kɔmputa a wogye di nyinaa a ɛka bom), na hwɛ Settings > General > VPN & Device Management ma profile anaa developer app biara a wɔde ahyɛ mu foforo. - Sɛ wosusu sɛ spyware instɔlehyɛn a, backup wo raw mfonini ne nkrataa nkutoo na yɛ Erase All Content and Settings a edi mũ, afei ma Lockdown Mode (Settings > Privacy & Security > Lockdown Mode) nyɛ adwuma. 3. Wɔ Android so no: - Bue Nsiesiei > System > Developer options (sɛ wɔama ayɛ adwuma a), pia Twe USB debugging tumi krataa, na dannan Developer options OFF. - Hwɛ Nsiesiei > Apps > Hwɛ apps nyinaa, Nsiesiei > Accessibility, ne Device admin apps ma app biara a wunnim a wɔde ahyɛ mu wɔ USB nhyiam no mu. - Sɛ wɔmaa USB Debugging ho kwan wɔ rogue port so a, fa mfonini ne nkitahodi ahorow a ɛho hia sie na yɛ Factory Data Reset.

Simma anum akwantu hardening checklist ma telefon ne laptop¶

• 1.1. Popa Wi-Fi ntwamutam a wɔabue a wɔakora so no na ma Auto-Join nyɛ adwuma: Popa ntwamutam din a wɔabue a ɛyɛ generic (Airport_Free_WiFi, . Hotel_Guest, . Starbucks, . attwifi) fi wo networks a woakora so no mu na dum Ask to Join Networks ne Auto-Join Hotspot.
• 2.1. Hyehyɛ VPN a wɔahwɛ so a Kill Switch a ɛyɛ katee: Fa VPN akraman a ɔwɔ din pa a wode WireGuard anaa OpenVPN di dwuma, na ma Kill Switch no nyɛ adwuma sɛnea ɛbɛyɛ a sɛ VPN tunnel no kɔ fam a, wɔasiw intanɛt akwantu nyinaa ano.
• 3.1. Ma Encrypted DNS (DNS-over-HTTPS / DNS-over-TLS) nyɛ adwuma): Ma Secure DNS / Private DNS nyɛ adwuma wɔ wo brawsa ne dwumadi nhyehyɛe no mu denam Cloudflare so (1.1.1.1 / . one.one.one.one) anaa Quad9 ( ) .9.9.9.9 / . dns.quad9.net). Sɛ hotel captive portal bi antumi ankɔhyɛ mfiase no a, dum Secure DNS sikɔne 30 na klik "Accept Terms," ​​afei dan Secure DNS ne wo VPN no san kɔ so ntɛm ara.
• 4.1. Lock down local network sharing: Set Windows Wi-Fi profiles to Public network, ma macOS Firewall + Stealth Mode nyɛ adwuma, na hyehyɛ AirDrop to Contacts Only anaa Receiving Off.
• 5.1. Ma USB data ahobanbɔ akwan no nyɛ adwuma: Wɔ iPhone/iPad so no, hwɛ sɛ wɔadan Nsiesiei > Anim ID & Passcode > Accessories OFF (anaasɛ ma Lockdown Mode nyɛ adwuma ma akwantu a asiane kɛse wom). Wɔ Android so no, ma USB data ahobanbɔ nyɛ adwuma na ma Developer Options dum.

Nsɛm a wɔtaa bisa¶

Sources a wɔhwɛɛ mu¶

• Cybersecurity and Infrastructure Security Agency (CISA, United States): * wireless Network Ahobanbɔ ne Mobile Device Intanɛt so Ahobammɔ Nhwehwɛmu a Wɔde Ma Akwantufo*.
• Ɔman Cyber ​​Security Center (NCSC, United Kingdom): Ɔmanfoɔ Wi-Fi: Sɛnea Wobɛtena Ahobammɔ wɔ Ntwamutam a Wonnye Wɔn So ne Akwankyerɛ a Ɛfa Nnwumakuo a Wɔde Tumi Ho.
• Federal Communications Commission (FCC, United States): Adetɔfoɔ Kɔkɔbɔ: "Juice Jacking" - Afotuo a ɛbɛma woakwati Malware ne Data korɔn wɔ Ɔmanfoɔ USB Charging Stations ne Wireless Nkitahodi ne Bluetooth Ahobanbɔ Afotuo.
• Ɔman Ahobanbɔ Dwumadibea (NSA, United States): Nneyɛe Pa a Wɔde Bɔ Wireless Networks ne Mobile Device Ahobanbɔ ho ban ma Telework ne Akwantuo.
• European Union Agency for Cybersecurity (ENISA, European Union): Akwankyerɛ a ɛfa Mobile Devices, Wi-Fi Hotspots, ne Remote Access a wɔbɛbɔ ho ban.
• Ɔman Asoɛe a Ɛhwɛ Gyinapɛn ne Mfiridwuma So (NIST, United States): Akwankyerɛ a ɛfa Wireless Local Area Networks (WLANs) a wɔbɛbɔ ho ban (NIST SP 800-153).

Akwankyerɛ ahorow a ɛfa ho¶

• MFA phishing ne ɔtamfo-wɔ-mfinimfini bypass
• Data breach mmuae ne password leaks
• Phishing ne compromised akontaabu a wɔsan nya
• Adwuma a wɔyɛ wɔ akyirikyiri na ahobammɔ wom fi ahɔhodan mu
• Wimhyɛn gyinabea nsisi ne akwantu mu ahobammɔ
• Telefon nɔma ahorow a wɔde ma ntɛm ara sɛnea ɔman biara te