Wednesday, August 27, 2025

Juice Jacking: Real Threat or just Fear Mongering?

 

Juice jacking refers to malicious activity through USB charging ports or unfamiliar USB cables that can result in malware injection or data theft. The threat is real and was demonstrated by security researchers through a POC more than a decade ago. Devices like the O.MG cable, available online for under $200, are specifically designed to exploit this attack vector by emulating HID class devices and silently injecting keystrokes without any involvement from the OS or the user.

However, this attack is extremely rare and is likely to occur only in highly targeted scenarios. Even so, there are no documented cases of a real-world incident since the POC was published. The odds of an average user being victimized by it are lower than the odds of being struck by lightning 😃. For the attack to succeed, the attacker must be physically close, within Wi-Fi range of the embedded chip inside the malicious cable, or the device can connect to an attacker-controlled access point to extend the reach. It also depends on tricking the device into joining the access point it creates. Most public charging stations are simply power sources. Even when data lines are present, some platforms like iOS have built-in restrictions that make exploitation difficult. Unfortunately, most popular operating systems such as macOS, Android, Windows, and Linux all trust HID class devices by default, which means a malicious cable could execute commands immediately without any consent from the user or the operating system.

In summary, for an average person, juice jacking is not a practical concern. The hype surrounding it often borders on sensationalism. If you are concerned, avoid the paranoia and use a data blocker. Alternatively, as shown in the picture below, you can modify a regular USB cable by cutting the green and white data lines and leaving only the red and black power lines intact, then taping it all back together. This is essentially what a data blocker does. It is a simple and effective solution that gives you control, rather than relying on the operating system or trusting the power source or a third-party data blocker to protect your device.



Stay Informed and Safe Online
If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com

Sunday, August 17, 2025

Tech Paranoia and the art of Imaginary Hacking

 

Welcome to the wonderfully irrational world of tech paranoia, where the only thing truly compromised might be the mind. This blog is quite different from my usual posts at blog.selvansoft.com, where I mainly focus on cybersecurity and online safety. Here, I want to highlight the growing trend of technology-influenced paranoia, especially among younger generations. I frequently come across this paranoid crowd on the r/cybersecurity_help subreddit. These individuals believe they’ve been “hacked” in ways that resemble fictional Hollywood hacker movies. The screenshots and examples in this blog are from actual posts on reddit, where people spiral into delusions about being targeted by people who use spy tools that may cost millions of dollars.

While it's true that younger generations grew up using technology, many mistakenly believe they’re proficient simply because older generations told them so. There’s a significant difference between being a technology user and a technology professional. These individuals are technology users, who knows how to operate a computer or phone, send emails, do online banking, use social media and gaming platforms, and knows how to navigate modern devices. But some confuse this familiarity with expertise. Most importantly, they latch onto tech acronyms and terminologies like VPN, MitM, RAT, DDoS, IP address, 2FA, DNS, cookies, BIOS, SIM, IMEI, Pegasus virus, rootkit, boot kit, and more without any understanding what any of them actually mean. To make matters worse, some turn to chatGPT and blindly accept whatever it says, often without context or verification.

While some cases may involve mental or psychological disorders, many of these individuals are otherwise normal people who become delusional about their tech knowledge. Their beliefs are reinforced by exposure to movies, social media, and conversations with equally paranoid friends or relatives who lack expertise. These ideas often stem from misinterpreted experiences, sometimes involving real incidents or compromises to their devices or accounts. A kernel of truth gets magnified into a full-blown illusion, and unfortunately, many genuinely believe these scenarios are happening to them. Let’s look at some real cases (i.e. posts) I have seen on reddit to show the extent of this paranoia.

Case#1: In the following case, the person believes one of her classmates or boyfriend is attacking her and compromising a wide variety of heterogeneous collection of devices simply by executing a DDoS attack. This illustrates zero understanding of what a DDoS attack actually is, even at a basic, non-technical level.



Case#2: The following example features a guy who believes his friend can run some DDoS code, whatever that means, considering real DDoS attacks involve hundreds or thousands of devices, and take down Meta’s servers, which rank among the largest and most resilient in the world. Even more comical is his claim that the same friend can hack Instagram and WhatsApp servers after the DDoS attack, when the servers are supposedly down. That’s somehow even more magical than the DDoS fantasy itself.

Case#3: This one’s comical: the person believes a hacker can call your phone and instantly hack it.


Case#4: This guy believes someone with too much free time attacked every OS, platform, architecture, and device he owns using magical tools. His only proof? A flashing cursor in his Android browser :) 



Case#5: This is one of those cases where a large group of people genuinely believe that knowing someone’s public IP somehow grants magical hacking powers. This person thinks a hacker has either his IP or IMEI, two things that are completely unrelated, and that having either one somehow led to his device being compromised.


Case#6: This is a classic case where many paranoid people believe the scam emails they receive claiming they've been hacked using Pegasus software. While Pegasus is real, it is a sophisticated spyware developed by the Israeli cyber-arms company NSO Group. It is used for surveillance by government agencies and law enforcement for espionage and counter-espionage, not to target the average citizen. Not to mention, a single license can cost up to $500k or more.


Case#7: This is same as the case#6 above.



Case#8: The next two are examples of a classic belief on VPN that an overwhelming population of both younger and older generations believe using VPN somehow makes them invincible and keeps their devices safe. This is almost like a religion these large population believes is true without any evidence.


Case#9: Same as case#8 above.



Case#10: Last but not least, this is a clear example of self-inflicted pain through technology. In this case, the individual is trying to become a software developer without proper education or experience, relying on ChatGPT 



In summary, these are just a few examples from a broader trend of growing paranoia, fueled by the increasing use of technology by younger generation who lack a clear understanding of its capabilities and limitations. The proliferation of AI tools in the hands of ordinary users is undoubtedly adding fuel to this paranoia, making it easier for individuals to unintentionally harm themselves, as illustrated in the last example. The only viable solution I see is educating the younger generation about technology. That raises the questions: how, by whom, and where?


Stay Informed and Safe Online
If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com