Dutoƒo Wi-Fi hacks, vɔ̃ɖi vevi eve hotspots, kple detsiƒonuwo jacking¶

Yameʋudzeƒewo, amedzrodzeƒewo, kɔfidzraƒewo, takpekpewɔƒewo, agbalẽdzraɖoƒewo, kple mɔzɔzɔ ƒe teƒewo nye adedadaƒe veviwo na kɔmpiuta dzi amedzidzedze eve siwo do ƒome kplikplikpli siwo te ɖe wo nɔewo ŋu le ŋutilã me: Evil Twin rogue Wi-Fi hotspots kple Juice Jacking (dutoƒo USB charging ports siwo ŋu wogblẽ nu le). Ne ètsɔ wò asitelefon alo kɔmpiutadziɖoɖo do ka kple kaƒomɔ̃ si dzi amedzidzela kpɔ ŋusẽ ɖo alo tsɔ wò ka de dutoƒo USB-do si ŋu wotrɔ asi le me la, ètsɔa network alo tɔdzisasrã ŋutɔŋutɔ dea asi na futɔ aɖe be wòaxe mɔ na wò ʋuwo, aŋe wò gege ɖe eme ƒe ɖaseɖigbalẽwo, alo axɔ active authentication session cookies.

Ne ɖeko nèkpɔe be yeŋlɔ yeƒe e-mail, dɔwɔƒe ƒe gege ɖe eme, alo fexexegbalẽvi ŋuti nyatakakawo ɖe amedzrodzeƒe alo yameʋudzeƒea ƒe Wi-Fi ƒe ʋuʋudedi si ŋu ɖikeke le me, alo ne wò fon la do "Ka ɖe Kɔmpiuta Sia Dzi" ƒe nyabiase aɖe esime wotsɔe de dutoƒo gaxɔgbalẽvi me la, mɔxexeɖedɔa nu enumake ate ŋu axe mɔ na amedzidzela be wòagaxe wò le wò gakɔntawo me o. Mɔfiame sia na afɔɖeɖe siwo woawɔ atsɔ agbugbɔ nudzɔdzɔwo axɔ enumake, mɔ̃ɖaŋununya me numeɖeɖewo le kaƒomɔ̃ kple USB-mɔ̃ɖaŋununya ƒe amedzidzedze ŋu, dɔwɔɖoɖo ƒe ɖaseɖigbalẽwo me dzodzro, kple mɔzɔzɔ sesẽ ƒe ɖoɖo siwo wotu ɖe mɔfiame siwo tso Internet Dzi Dedienɔnɔ Kple Dɔwɔƒewo ƒe Dedienɔnɔ Dɔwɔƒe (CISA) si le United States, Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC) si le United Kingdom, Dukɔa ƒe Kadododzikpɔha (FCC), kple Europa Dukɔwo ƒe Ðekawɔha ƒe Dɔwɔƒe si Kpɔa Internet Dzi Dedienɔnɔ Gbɔ (ENISA) gbɔ.

Wɔ esia fifia¶

1. Tsɔ kadodoa ɖa le Wi-Fi network la ŋu enumake alo ɖe USB ka la ɖa. Tsi Wi-Fi keŋkeŋ le wò kɔmpiuta, tablɛt, alo asitelefon dzi, alo nàhe wò charging ka ŋutɔŋutɔ ado goe le dutoƒo USB-do la me enumake.
2. Ŋlɔ Wi-Fi network alakpatɔ la be ale be wò mɔ̃a mate ŋu agbugbɔ aɖo kadodo me le eɖokui si o. Ʋu wò mɔ̃a ƒe Wi-Fi ƒe ɖoɖowo, tia network ŋkɔ (SSID) si ŋu ɖikeke le, eye nàzi Forget This Network dzi (alo nàɖe dzesi le Connect Automatically) ŋu ale be wò radio nadzudzɔ kadodo ŋuti numekukuwo kaka ɖe amedzidzela ƒe xɔtunuwo ŋu.
3. Trɔ ɖe asitelefon dzi nyatakakawo (4G/5G) ɖeɖeko ŋu be nàkpɔ akɔntabubu siwo ŋu afɔku le ta. Mègazã dutoƒo Wi-Fi network aɖeke le mia gbɔ gbeɖe esime nèle wò ɖaseɖigbalẽwo gbugbɔm ɖo o. Zã wò smartphone native cellular connection alo kɔmpiuta si le vovo, si ŋu womeɖe mɔ ɖo o le network si dzi nèka ɖo dzi.
4. Te fli ɖe gege ɖe eme ƒe ɣeyiɣi siwo katã le dɔ wɔm la me eye nàtrɔ nyagbewo na akɔnta siwo woɖe ɖe go. Ne èŋlɔ nyagbe aɖe ɖe aʋatso Wi-Fi aboyoƒe ƒe nyatakakadzraɖoƒe alo nède asi akɔnta aɖe me to alakpatɔ ƒe network dzi la, ʋu akɔnta ƒe dedienɔnɔ ƒe dashboard ma, zi Do le mɔ̃wo katã me / Te fli ɖe ɣeyiɣi siwo le dɔ wɔm me dzi, trɔ wò nyagbegbɔgblɔ wòazu nyagbe ɣaɣla tɔxɛ aɖe, eye nàtu credit alo debit card ɖesiaɖe si ƒe xexlẽdzesi nèŋlɔ la ɖe tsikpe me.
5. Dzro root ɖaseɖigbalẽ, VPN profile, alo inbox ƒe se siwo nye alakpatɔ ɖesiaɖe me eye nàɖe wo ɖa. Kpɔ wò dɔwɔɖoɖo ƒe ɖaseɖigbalẽwo dzraɖoƒe kple mɔ̃wo dzikpɔkpɔ ƒe ɖoɖowo ɖa be nàkpɔe ɖa be captive portal la meble wò be nàde ɖoɖowɔɖi ƒe nɔnɔmetata vɔ̃ɖi aɖe wò kɔmpiuta dzi o, eye nàlé ŋku ɖe wò email ƒe ɖoɖowo ŋu hena auto-forwarding se siwo ŋu womeɖe mɔ ɖo o hã.
6. Gbugbɔ dze wò asitelefon gɔme eye nàlé ŋku ɖe eŋu ne èzi "Trust" dzi le USB kiosk dzi. Ne èzi "Trust This Computer" dzi alo nèwɔ USB File Transfer/Debugging ŋudɔ le dutoƒo charge station, na Airplane Mode nawɔ dɔ, lé ŋku ɖe apps alo profile siwo mènya o siwo le axadzi ŋu, eye nàgblɔ ga fifi alo gaxɔgbalẽvi sesẽwo na sedzikpɔlawo alo wò nutoa me xexlẽdzesi kpata (911 le United States kple Canada, 112 le Europa Dukɔwo ƒe Habɔbɔ bliboa me, 999 le United Kingdom, alo kpɔ xexlẽdzesi siwo wozãna kpata).

Dutoƒo Wi-Fi kple USB charge nudzɔdzɔ ƒe ŋuɖoɖo ati¶

flowchart TD
    Start["Suspected Public Wi-Fi or USB Charging Compromise"]
    ThreatType{"Which proximity vector occurred?"}
    WiFiBranch["Connected to Suspected Evil Twin Wi-Fi<br/>or Fake Captive Portal Splash Page"]
    USBBranch["Plugged Phone or Laptop Into Public USB Port<br/>or Used an Unattended Cable (Juice Jacking)"]

    WiFiAction1["1. Turn off Wi-Fi radio and tap 'Forget This Network'<br/>2. Switch to trusted 4G/5G cellular data"]
    WiFiPrompt{"Did you type credentials, payment card data,<br/>or install a profile/certificate?"}
    WiFiCompromised["ACTIVE CREDENTIAL / TRAFFIC COMPROMISE<br/>1. Revoke all active login sessions and refresh tokens<br/>2. Rotate passwords and check email forwarding rules<br/>3. Delete rogue Device Management profiles and Root CAs<br/>4. Freeze payment card and issue replacement number"]
    WiFiPassive["PASSIVE CONNECTION ONLY (HTTPS intact)<br/>1. Flush local DNS and ARP caches<br/>2. Enable audited VPN and Encrypted DNS (DoH/DoT)<br/>3. Monitor account login logs for 14 days"]

    USBAction1["1. Physically unplug USB cable immediately<br/>2. Do not use any cable left hanging in a kiosk"]
    USBPrompt{"Did you unlock the device and tap<br/>'Trust This Computer', 'Allow USB Debugging',<br/>or see rapid ghost typing on screen?"}
    USBCompromised["ACTIVE USB DATA OR HID KEYSTROKE BREACH<br/>1. Enable Airplane Mode to cut C2 network callbacks<br/>2. Check for rogue MDM profiles, accessibility apps, or shells<br/>3. Rotate passwords from a separate clean device<br/>4. Back up important photos/files and perform Factory Reset"]
    USBBlocked["OS USB RESTRICTED MODE PROTECTED DEVICE<br/>1. Reboot device to clear USB controller volatile state<br/>2. Charge using AC wall outlet brick or personal battery bank"]

    Start --> ThreatType
    ThreatType -->|Evil Twin Wi-Fi| WiFiBranch
    ThreatType -->|Public USB Port| USBBranch
    WiFiBranch --> WiFiAction1
    WiFiAction1 --> WiFiPrompt
    WiFiPrompt -->|Yes| WiFiCompromised
    WiFiPrompt -->|No| WiFiPassive
    USBBranch --> USBAction1
    USBAction1 --> USBPrompt
    USBPrompt -->|Yes| USBCompromised
    USBPrompt -->|No: Locked or Rejected| USBBlocked

Alesi Evil Twin Wi-Fi kple aboyomenɔnɔ ƒe ʋɔtru siwo nye ameflunyawo wɔa dɔe¶

Evil Twin nye kaƒomɔ̃ si me ameflunu le si amedzidzela zãa kɔmpiutadziɖoɖo, radio geɖe ƒe agbalẽdzikpɔkpɔ router si wotsɔna ɖe asi (abe Wi-Fi Pineapple ene), Raspberry Pi, alo smartphone hotspot si wogbugbɔ trɔ si woda ɖe dutoƒo teƒe si amewo sɔ gbɔ ɖo la me. Le IEEE 802.11 Wi-Fi ƒe dzidzenu nu la, dutoƒo network ŋkɔ siwo woʋu, siwo woyɔna be Service Set Identifiers (SSIDs), ƒe nya ɣaɣlawo ƒe kpeɖodzi zero si ɖoa kpe amesi tɔ ŋkɔa le dzi. Amesiame si bɔbɔ nɔ wò gbɔ meta 30 va ɖo 100 (afɔ 100 va ɖo 330) le ʋudzeƒe ƒe xɔdɔme alo amedzrodzeƒe ƒe xɔdɔme me ate ŋu akaka kaƒomɔ̃ aɖe si ŋkɔe nye Airport_Free_WiFi, . Starbucks_Guest, . Marriott_Conference, alo Inflight_WiFi.

Esi wònye be asisiwo ƒe mɔ̃wo tiaa teƒe si woaɖe radio ƒe dzesi sesẽtɔ kekeake (si wodzidze le decibel me ne wotsɔe sɔ kple miliwatt, alo dBm) na network ƒe ŋkɔ si sɔ ta la, amedzidzela si bɔbɔ nɔ adzɔge meta 5 (afɔ 16) tso wò kplɔ̃ gbɔ la ɖua dzisasrã ƒe mɔfianu si le se nu si didi meta 25 (afɔ 82) le xɔdɔme la dzi bɔbɔe. Ne èdo ka kple amedzrodzeƒea ƒe Wi-Fi ŋutɔŋutɔ xoxo hã la, amedzidzelawo ɖoa 802.11 deauthentication ("deauth") frames siwo wowɔ alakpatɔe ɖe amewo zi geɖe siwo ƒoa wò fon alo kɔmpiuta si dzi nèle la ɖa le router si le se nu dzi hena ɣeyiɣi kpui aɖe, si zia wò mɔ̃a dzi be wòagaɖo kadodo me kple amedzidzela la ƒe dzesi sesẽtɔ le eɖokui si evɔ màde dzesii o.

Ne wò mɔ̃a nya do ƒome kple Evil Twin ƒe mɔɖeɖeƒea ko la, amedzidzela la kpɔa wò nutoa me Dynamic Host Configuration Protocol (DHCP) agbo kple Domain Name System (DNS) resolver dzi, eye wòtsɔa wo dana ɖe Adversary-in-the-Middle (AitM) nɔnɔme me le wò mɔ̃a kple internet dome.

Mɔ̃ɖaŋununya ƒe amedzidzedze vektor ene siwo le Wi-Fi alakpatɔ dzi¶

Togbɔ be egbegbe Transport Layer Security (HTTPS / TLS 1.3) kple HTTP Strict Transport Security (HSTS) xea mɔ na Wi-Fi dɔwɔla alakpatɔ be wòagaxlẽ nyatakakadzraɖoƒe siwo wotsɔ nya ɣaɣlawo ŋlɔe le web-browser yeyewo dzi nu tsɛe o hã la, amedzidzelawo toa HTTPS ŋu to mɔnu ene koŋ zazã me:

1. Captive portal Adversary-in-the-Middle (AitM) credential harvesting: Whenever you join a hotel, airport, or café network, your operating system expects a Captive Portal login window to pop up automatically. Because captive portals operate before your VPN connects, users are conditioned to trust whatever login box appears. Attackers host pixel-perfect clones of hotel, airline, Microsoft 365, Google Workspace, Apple ID, or social media login pages running behind real-time reverse-proxy frameworks (such as Evilginx2 or Modlishka). When you type your email password and 6-digit Multi-Factor Authentication (MFA) code into the fake portal to "Unlock Free High-Speed Wi-Fi," the reverse proxy relays your credentials to the real provider and steals the returned session authentication cookie right out of the stream.
2. Malicious Root Certificate Authority (CA) and MDM profile installation: A rogue captive portal may display a convincing corporate or hotel notice stating: "To comply with network security standards, please click Allow to install our temporary Wi-Fi SSL certificate / network profile." If you approve a root certificate or Mobile Device Management (MDM) profile, your operating system treats the attacker as a trusted Certificate Authority, enabling their proxy server to forge valid SSL certificates for any bank or email domain and decrypt all of your HTTPS traffic in real time.
3. Preferred Network List (PNL) and KARMA/MANA auto-join sniffing: When Wi-Fi is turned on in your pocket or backpack, your phone or laptop periodically transmits probe requests searching for networks you joined in the past. If you have "Auto-Join" enabled for open networks (such as attwifi, . xfinitywifi, . Boingo_Hotspot, alo Hotel_Guest), rogue access points listen for those broadcast probes and dynamically spawn a virtual network matching whatever SSID your device is looking for, silently connecting your laptop or phone while it sits in your bag.
4. Local subnet lateral movement (SMB, AirDrop, mDNS, and LLMNR poisoning): Public Wi-Fi networks that fail to enforce AP Client Isolation place your laptop on the exact same Layer-2 local area network segment as every other stranger in the room. Attackers scan neighboring devices for exposed Windows Server Message Block (SMB) file shares, Remote Desktop (RDP), Secure Shell (SSH), open development web servers (0.0.0.0:3000 alo :8080), or poison local Link-Local Multicast Name Resolution (LLMNR) and Multicast DNS (mDNS) queries to capture Windows NetNTLMv2 password hashes.

Comparing wireless connection methods by security level¶

Use this comparison table to evaluate your connection options when working away from home or the office:

Afɔɖeɖe ɖesiaɖe ƒe hayahaya le Evil Twin Wi-Fi nudzɔdzɔ aɖe megbe¶

Ne èdo ka kple dutoƒo Wi-Fi-nyatakakadzraɖoƒe si ŋu ɖikeke le la, ke èkpɔ nuxlɔ̃ame siwo ku ɖe web-browser ƒe ɖaseɖigbalẽ ŋu (NET::ERR_CERT_AUTHORITY_INVALID), alo nyatakaka siwo nèŋlɔ ɖe aboyome ƒe agbo si me wowɔa nutatawo le me la, wɔa mɔ̃ɖaŋununya ƒe ɖɔɖɔɖo ƒe afɔɖeɖe ene siawo ɖe wo nɔewo yome to asitelefon ƒe kadodo si dzi woka ɖo dzi:

Afɔɖeɖe 1: Dzro agbalẽ me eye nàɖe ɖoɖowɔɖi ƒe nɔnɔmetata siwo nye alakpatɔwo kple Root CAwo ɖa¶

Hafi nàtrɔ nyagbe aɖeke le wò mɔ̃a dzi la, kpɔe ɖa be amedzidzela la mede Mobile Device Management (MDM) ƒe nɔnɔmetata si nɔa anyi ɖaa, VPN ƒe ɖoɖo gbegblẽ, alo Root Certificate Authority si ana woanɔ ŋku lém ɖe wò nyagbe yeyeawo ŋɔŋlɔ ŋu o:

• Le Apple iPhone kple iPad (iOS / iPadOS) dzi:
• Ʋu Nɔnɔmewo > Gbãtɔ > VPN & Mɔ̃wo Dzikpɔkpɔ. Negbe ɖe wò dɔtɔ ƒe IT dɔwɔƒeae kpɔa wò mɔ̃a dzi ko la, ele be zero Configuration Profiles nanɔ afisia. Ne èkpɔ profile aɖe si mènya o la, zi edzi enumake, tia Remove Profile, ŋlɔ wò passcode, eye nàgbugbɔ adze wò fon la gɔme.
• Eyome, ʋu Settings > General > About, yi ete, eye nàzi Certificate Trust Settings dzi. Le Na Kakaɖedzi Blibo nawɔ dɔ na Ke ƒe Ðaseɖigbalẽwo te la, kpɔe ɖa be wometrɔ root ɖaseɖigbalẽ aɖeke si zãla da ɖe eme o.
• Le Android smartphones kple tablets dzi:
• Ʋu Nɔnɔmewo > Dedienɔnɔ & adzamenyawo > Dedienɔnɔ ƒe ɖoɖo bubuwo > Nya ɣaɣlawo & ɖaseɖigbalẽwo > Ðaseɖigbalẽ siwo dzi woka ɖo eye nàtrɔ tso System ƒe akpaa dzi ayi Zãla ƒe akpaa dzi.
• Wotsɔ asi de ɖaseɖigbalẽ ɖesiaɖe si woŋlɔ ɖe Zãla ƒe tab te la mɔ̃a dzi. Zi ɖaseɖigbalẽ ɖesiaɖe si womede dzesii o dzi eye natia Ðe / Ðee ɖa.
• Kpɔ Settings > Security & privacy > Dedienɔnɔ ƒe ɖoɖo bubuwo > Device admin apps hã eye nàkpɔ egbɔ be dɔwɔnu aɖeke si mènya o si si device dzikpɔla ƒe mɔnukpɔkpɔwo le o.
• Le Apple macOS kɔmpiutawo dzi:
• Ʋu System Settings > General > Device Management (alo Adzamenyawo & Dedienɔnɔ > Profiles) eye nàɖe ɖoɖowɔɖi ƒe nɔnɔmetata ɖesiaɖe si womede dzesii o ɖa.
• Ʋu Keychain Access, lé ŋku ɖe System kple login keychains le Certificates tab la te, eye nàtutu ɖaseɖigbalẽ ɖesiaɖe si mènya o si wotsɔ blɔ de dzesii + kakaɖedzi ƒe dzesi si wowɔ ɖe ɖoɖo nu.
• Le Microsoft Windows 10 kple 11 ƒe kɔmpiutawo dzi:
• Zi edzi Win + R, ƒomevi aɖe certmgr.msc, eye nàzi Enter dzi. Keke Root Certification Authorities siwo dzi woka ɖo > Certificates ɖe enu eye nàtutu root certificate alakpatɔ ɖesiaɖe si wobia tso asiwò be nàda ɖe wò kɔmpiuta dzi.
• Ʋu Settings > Network & Internet > Proxy eye nàkpɔe ɖa be Zã proxy server mefia asi gotagome amedzidzela ƒe IP adrɛs alo .pac nuŋɔŋlɔ.

Afɔɖeɖe 2: Klɔ DNS kple ARP network caches siwo me aɖi le¶

Ne èdo ka kple Evil Twin router la, zi geɖe la, amedzidzela DHCP kple DNS server tsɔa Time-To-Live (TTL) ƒe asixɔxɔ didiwo dea asi na wò kɔmpiuta ƒe DNS nuŋlɔɖi siwo me aɖi le ale be mɔɖeɖea nɔa anyi ne ètrɔ networkwo gɔ̃ hã. Klɔ wò nutoa me network caches enumake: - Le Windows dzi: Ʋu Command Prompt abe Administrator ene eye nàwɔe ipconfig /flushdns kplɔe ɖo arp -d *. - Le macOS: Ʋu Terminal eye nàƒu du sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. - Le iOS kple Android dzi: Trɔ Yameʋu ƒe Nɔnɔme ON hena sɛkɛnd 30, emegbe nàtsii eye nàgbugbɔ telefon la adze egɔme. - Le nyatakakadzraɖoƒewo me: Klɔ Nɔnɔmetata kple faɛl siwo wodzra ɖo ɖi kple Kukiwo kple nyatakakadzraɖoƒe ƒe nyatakaka bubuwo ɖa le gaƒoƒo 24 siwo va yi me.

Afɔɖeɖe 3: Dzudzɔ session cookies siwo le dɔ wɔm la nu eye nàtrɔ nyagbewo¶

Ne ège ɖe Google, Microsoft 365, Apple ID, hadomenyatakakadzraɖoƒe, alo wò ŋutɔ wò akɔnta ɖesiaɖe me le captive portal fesrea me alo esime nèle kadodo me kple network si me ɖaseɖigbalẽ alakpatɔ aɖe nɔ dɔ wɔm le: 1. Zi geɖe la, wò nyagbe ɣaɣla tɔtrɔ ɖeɖe mesɔ gbɔ o ne amedzidzela si trɔ megbe la fi wò post-authentication session cookie alo OAuth refresh token. 2. Ge ɖe akɔnta ƒe dedienɔnɔ ƒe ɖoɖo ɖesiaɖe si ŋu wògblẽ nu le me to asitelefon dzi nyatakakawo dzi, yi Active Sessions / Where You’re Signed In / Devices, eye nàzi Do le sessions katã me dzi. 3. Trɔ akɔnta ƒe nyagbe ɣaɣla la ɖe nyagbe ɣaɣla sesẽ si le etɔxɛ si me ŋɔŋlɔdzesi 16 va ɖo 20 le si wodzra ɖo ɖe nyagbe ɣaɣla dzikpɔla me ŋu. 4. Kpɔ wò email akɔnta Forwarding kple Inbox Rules / Filters (le Gmail alo Outlook me) ɖa be nàɖo kpe edzi be amedzidzela la meƒã se si me ɖoɖoezizi le si nye auto-forwarding password reset emails alo ʋuʋu dedienɔnɔ ŋuti nuxlɔ̃amewo yi Trash o. 5. Do wò akɔnta Multi-Factor Authentication ɖe ŋgɔ wòzu Passkey alo FIDO2 hardware security key (WebAuth) si te ŋu nɔa te ɖe ameflunyawo nu, si blana ɖe domenyiŋusẽfianu ƒe ŋkɔ vavãtɔ ŋu le nya ɣaɣla me.

Afɔɖeɖe 4: Tsɔ fexexegbalẽvi siwo woge ɖe aboyomenɔnɔ ƒe mɔnuwo me la de tsikpe me¶

Ne èŋlɔ gaxɔgbalẽvi alo gaxɔgbalẽvi ƒe xexlẽdzesi, ŋkeke si dzi wòawu enu, kple CVV ƒe dedienɔnɔ ƒe dzeside ɖe Wi-Fi ƒe nyatakakadzraɖoƒe si ŋu ɖikeke le la: 1. Ʋu wò gadzraɖoƒe ƒe dɔwɔnua enumake le asitelefon dzi nyatakakawo dzi eye Lock / Freeze kaɖia. 2. Ƒo ka na ametafatafadɔwɔƒe ƒe xexlẽdzesi si le wò kaɖia ƒe megbe, ka nya ta be wogblẽ kaɖia ŋuti nyatakakawo le nyatakakadzraɖoƒe aɖe si wosusu be wonye ameflunyawo gbɔgblɔ dzi, eye nàbia be woatsɔ kaɖi ƒe xexlẽdzesi yeye si ƒe xexlẽdzesi nye xexlẽdzesi 16 kple CVV aɖo kaɖia teƒe. 3. Bia tso kaɖia nala si be wòagbugbɔ aɖo Account Updater (Visa VAU / Mastercard ABU) ƒe dzesi ɖesiaɖe si wowɔ le eɖokui si ale be fexela siwo ŋu womeɖe mɔ ɖo o siwo gbugbɔna xea fe na wo la mate ŋu awɔ ɖe wò kaɖi ƒe xexlẽdzesi yeyea dzi o.

Alesi Juice Jacking kple USB ka siwo ŋu aʋawɔnuwo le wɔa dɔe¶

Standard Universal Serial Bus (USB) ƒe kadodowo, siwo dometɔ aɖewoe nye USB Type-A, Micro-USB, Apple Lightning, kple USB Type-C, ƒoa elektrikŋusẽkawo kple nyatakakawo ɖoɖoɖa ƒe pin siwo le mɔ eve nu le plug ɖeka me nu ƒu: - Le 4-pin USB 2.0 kadodo me la, Pin 1 (VBUS) tsɔa +5 volts DC ŋusẽ kple Pin 4 ( .GND) naa elektrikŋusẽ ƒe anyigba, esime Pin 2 (D-) kple Pin 3 ( .D+) tsɔa nyatakaka ƒe dzesi siwo to vovo le kɔmpiuta si xɔa ame kple mɔ̃ si do ƒome kplii dome. - Le 24-pin USB Type-C kadodo me, le ene xa VBUS power pins kple anyigba pin ene, plug la me D+/D- nyatakaka eve, SuperSpeed ene siwo zɔna kabakaba TX/RX nyatakakawo ƒe mɔwo (vaseɖe 40 Gbps), kple Tɔtrɔɖoɖo ƒe Mɔ (CC1/ .CC2) pin siwo wozãna tsɔ dzroa ŋusẽ nana kple host/device ƒe akpawo me.

Juice Jacking dzɔna ne futɔ aɖe trɔ asi le xɔtunu siwo woɣla ɖe dutoƒo USB charge socket megbe alo gblẽ aʋawɔnu charging cable si wotsɔ de dutoƒo kiosk me be mɔzɔlawo nazã.

USB-fexexe ƒe amedzidzedze ŋutɔŋutɔ ƒe hatsotso etɔ̃awo¶

flowchart TD
    USBPlug["User Plugs Device Into Public USB Port or Unknown Cable"]
    AttackClass{"What malicious hardware is behind the port or inside the cable?"}
    Class1["1. MTP / PTP / ADB Data Exfiltration Host<br/>Hidden SBC (Raspberry Pi / microcontroller) requests<br/>file sync, photo access, or backup extraction"]
    Class2["2. BadUSB / HID Keystroke Injection Implant<br/>Cable head (O.MG Cable / Hak5) enumerates as a<br/>USB Keyboard + Wi-Fi AP and types shell commands"]
    Class3["3. Electrical Surge ('USB Killer') Capacitor<br/>Boosts 5V DC into -200V DC high-voltage pulses<br/>dumped directly into the device data lines"]

    Defense1["Mitigated if OS stays locked (USB Restricted Mode)<br/>OR if user taps 'Don't Trust' / uses a Data Blocker"]
    Defense2["Bypasses 'Trust Computer' prompts on unlocked screens<br/>because OS automatically trusts USB keyboards;<br/>prevented ONLY by never using unknown cables/ports"]
    Defense3["Destroys motherboard USB controller instantly;<br/>prevented by using your own AC wall charger or battery bank"]

    USBPlug --> AttackClass
    AttackClass -->|Data Host| Class1
    AttackClass -->|HID Keyboard| Class2
    AttackClass -->|Voltage Spike| Class3
    Class1 --> Defense1
    Class2 --> Defense2
    Class3 --> Defense3

1. Data exfiltration kple debugging abuse (MTP / iOS Pairing / ADB): Kɔmpiuta ɣaɣla si le USB gli ƒe agbalẽvi megbe wɔa dɔ abe USB Host ene eye wòdzea data asiléle gɔme ɖe... D+/D- pins. Ne mɔzɔla aɖe ʋu woƒe telefon la eye wòzi "Trust This Computer" (iOS) dzi alo tia "File Transfer / MTP" alo "Allow USB Debugging" (Android) la, kɔmpiuta ɣaɣla la ate ŋu awɔ fotowo, kadodowo, gbedasiwo, kple teƒea ƒe backup siwo wometsɔ nya ɣaɣlawo ɣla o, alo spyware si woatsɔ ade axadzi ƒe kɔpi to Android Debug Bridge (ADB) dzi.
2. HID (Human Interface Device) keystroke injection ("BadUSB" kple O.MG Cables): Amedzidzelawo gblẽa ka siwo ŋu wotrɔ asi le (abe O.MG Cables) siwo wotsɔ de yameʋudzeƒe alo amedzrodzeƒe ƒe kaƒomɔ̃wo me siwo ƒe dzedzeme kple charge sɔ kple Apple, Samsung, alo Anker USB-C kple Lightning ka vavãwo. Microprocessor kple Wi-Fi transceiver ɣla ɖe plastic connector shell la me. Ne wotsɔe de kɔmpiuta alo telefon si womeʋu o me la, ka la gblɔna na wò dɔwɔɖoɖoa be "I am a standard USB hardware keyboard." Esi dɔwɔɖoɖowo ka ɖe keyboardwo dzi evɔ womeɖea "Trust This Computer" ƒe nyabiase aɖeke fiana o ta la, ka la ŋlɔa safui alafa geɖe enumake le sɛkɛnd ɖeka me (eʋu Terminal, PowerShell, alo browser windows) ne woʋui to Wi-Fi dzi.
3. Elektrik xɔtunuwo tsɔtsrɔ̃ ("USB Killer"): Ka alo ʋɔtru siwo ŋu wotrɔ asi le siwo me DC-to-DC boost converters suesuesuewo le la doa charge capacitors tso 5-volt elektrikkaƒomɔ̃a me eye woɖea 200-volt elektrik spikes tẽe trɔ yi anyime data pins, tegbee frying USB dziɖula chip kple logic board.

Dutoƒo fexexemɔnu kple xɔtunu ƒe ametakpɔnuwo tsɔtsɔ sɔ kple wo nɔewo¶

Afɔɖeɖe ɖesiaɖe ƒe hayahaya le Juice Jacking alo USB nudzɔdzɔ aɖe si wosusu megbe¶

Ne ètsɔ wò fon alo kɔmpiutadziɖoɖo de dutoƒo USB-do alo ka si mènya o me la, da nusi dzɔ le wò screen dzi kpɔ eye nàwɔ ɖe recovery tier si sɔ kplii dzi:

Nɔnɔme A: Wò screen la tsi anyi, alo èzi "Don't Trust" dzi.¶

Egbegbe iOS (tso iOS 11.4.1 dzi) kple Android (Android 9+) ƒe ametakpɔnu si wotu ɖe eme si woyɔna be USB Restricted Mode alo Charge-Only USB Default le eme. Ne ètsɔ telefon si wotu ɖe USB data host me la, dɔwɔɖoɖoa nana USB data kaawo metsona le susu me eye elektrikŋusẽ koe wòhena vaseɖe esime nèʋu screen la eye nàzi "Trust" dzi tẽ (eye nàŋlɔ wò passcode zi evelia le iOS) alo atrɔ USB ƒe nyatakaka la ɖe "File Transfer."

Ne mèzi "Trust" dzi kpɔ o eye mèzã ka si mènya o esime woʋu wò screen la: 1. Ðe ka la ɖa enumake. 2. Power your phone completely off, wait 30 seconds, and turn it back on to clear the volatile memory of the USB port controller. 3. Switch to an AC wall outlet or battery bank.

Scenario B: You tapped "Trust This Computer," enabled USB Debugging, or saw ghost typing¶

If you unlocked your phone and tapped "Trust" at a public charging station, enabled Android USB Debugging, or plugged an unknown cable into an unlocked phone or laptop and saw rapid ghost typing: 1. Unplug the cable and immediately enable Airplane Mode (or turn off Wi-Fi and cellular data) to stop any injected background payload from contacting an external command-and-control server. 2. On iOS / iPadOS: - Tapping "Trust This Computer" generates a cryptographic pairing record that allows the host computer to access backups, photos, and developer tools. - To revoke all trusted computers on an iPhone immediately, open Settings > General > Transfer or Reset iPhone > Reset > Reset Location & Privacy (which wipes all trusted USB computer pairings), and check Settings > General > VPN & Device Management for any newly installed profile or developer app. - If you suspect spyware installation, back up only your raw photos and documents and perform a full Erase All Content and Settings, then enable Lockdown Mode (Settings > Privacy & Security > Lockdown Mode). 3. On Android: - Open Settings > System > Developer options (if enabled), tap Revoke USB debugging authorizations, and toggle Developer options OFF. - Check Settings > Apps > See all apps, Settings > Accessibility, and Device admin apps for any unfamiliar app installed during the USB session. - If USB Debugging was authorized on a rogue port, back up important photos and contacts and perform a Factory Data Reset.

Five-minute travel hardening checklist for phones and laptops¶

• 1. Purge saved open Wi-Fi networks and disable Auto-Join: Delete generic open network names (Airport_Free_WiFi, . Hotel_Guest, . Starbucks, . attwifi) from your saved networks list and turn off Ask to Join Networks and Auto-Join Hotspot.
• 2. Configure an audited VPN with a strict Kill Switch: Install a reputable VPN client using WireGuard or OpenVPN, and enable the Kill Switch so all internet traffic is blocked if the VPN tunnel drops.
• 3. Enable Encrypted DNS (DNS-over-HTTPS / DNS-over-TLS): Enable Secure DNS / Private DNS in your browser and operating system using Cloudflare (1.1.1.1 / . one.one.one.one) or Quad9 (9.9.9.9 / . dns.quad9.net). If a hotel captive portal fails to load initially, toggle Secure DNS off for 30 seconds to click "Accept Terms," then turn Secure DNS and your VPN right back on.
• 4. Lock down local network sharing: Set Windows Wi-Fi profiles to Public network, enable macOS Firewall + Stealth Mode, and set AirDrop to Contacts Only or Receiving Off.
• 5. Na USB data takpɔkpɔ ƒe mɔnuwo nawɔ dɔ: Le iPhone/iPad dzi la, kpɔe ɖa be Settings > Face ID & Passcode > Accessories trɔ OFF (alo na Lockdown Mode nawɔ dɔ na mɔzɔzɔ si me afɔku le ŋutɔ). Le Android dzi la, na USB nyatakakawo takpɔkpɔ nawɔ dɔ eye nàna Developer Options natsi.

Nya siwo wobiaa amewo enuenu¶

Wolé ŋku ɖe dzɔtsoƒewo ŋu¶

• Internet Dzi Dedienɔnɔ Kple Dɔwɔƒewo ƒe Dedienɔnɔ Dɔwɔƒe (CISA, United States): * wireless Network Security kple Mobile Device Cyberdecurity Checklist na Mɔzɔlawo*.
• Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC, United Kingdom): Dutoƒo Wi-Fi: Alesi Nànɔ Dedie le Nyatakakadzraɖoƒe Siwo Womeka Ðe O Dzi Kple Mɔfiame le Dɔwɔƒewo ƒe Ʋuʋu Ŋu.
• Federal Communications Commission (FCC, United States): Nuƒlelawo ƒe Nuxlɔ̃ame: "Juice Jacking" - Aɖaŋuɖoɖowo be Woaƒo asa na Malware kple Data Fifi le Dutoƒo USB Charging Stations kple Wireless Kadodowo kple Bluetooth Dedienɔnɔ Ŋuti Aɖaŋuɖoɖowo.
• Dukɔa ƒe Dedienɔnɔ Dɔwɔƒe (NSA, United States): Nuwɔna Nyuitɔ Kekeake Siwo Ku Ðe Kaƒomɔ̃wo Kple Asitelefon Dzi Dedienɔnɔ Ŋu Na Telefon Dɔwɔwɔ Kple Mɔzɔzɔ.
• Europa Dukɔwo ƒe Habɔbɔ ƒe Dɔwɔƒe si Kpɔa Internet Dzi Dedienɔnɔ Gbɔ (ENISA, Europa Dukɔwo ƒe Habɔbɔ): Mɔfiamewo le Asitelefonwo, Wi-Fi Hotspots, kple Adzɔge Dɔwɔƒewo ƒe Dedienɔnɔ Ŋu.
• Dukɔa ƒe Dzidzenuwo Kple Mɔ̃ɖaŋununya Dɔwɔƒe (NIST, United States): Mɔfiamewo na Dedienɔnɔ na Wireless Local Area Networks (WLANs) (NIST SP 800-153).

Mɔfiame siwo do ƒome kplii¶

• MFA phishing kple futɔ-le-titina bypass
• Nyatakakawo dzi dada ƒe ŋuɖoɖo kple nyagbe ɣaɣlawo ƒe dodo
• Fishing kple akɔntabubu si ŋu wogblẽ nu le gbugbɔgaxɔ
• Dɔwɔwɔ le didiƒe kple dedie tso amedzrodzeƒe
• Yameʋudzeƒea ƒe ametafatafa kple mɔzɔzɔ ƒe dedienɔnɔ
• Telefon xexlẽdzesi siwo wozãna kpata le dukɔwo nu