The Nigerian Communications Commission’s Cyber Security Incident Response Team (NCC-CSIRT) has alerted Nigerians that cyber attackers can access mobile phones when users charge their mobile phones at public charging stations.
This security alert was made known in a statement titled, ‘NCC-CSIRT Identifies Two Cyber Vulnerabilities’ signed by NCC’s Director, Public Affairs, Dr. Ikechukwu Adinde.
The statement reads in part, “The CSIRT, in its first-ever security advisories less than three months after its creation, has solely identified the two cyber-attacks targeting the consumers and proffer solutions that can help telecom consumers from falling victims to the two cyber vulnerabilities.
“The first is described as Juice Jacking, which can gain access into consumer’s devices when charging mobile phones at public charging stations and it applies to all mobile phones.
“The other is a Facebook for Android Friend Acceptance Vulnerability, which targets only Android Operating System.”
According to the statement, public spaces such as restaurants, hotels, and others offer complementary services to customers such as providing charging ports or sockets which can be exploited by mobile phone hackers.
The statement further reads, “Once unsuspecting persons plug their phones at the charging station or the cable left by the attacker, the payload is automatically downloaded on the victims’ phone. This payload then gives the attacker remote access to the mobile phone, allowing them to monitor data transmitted as text, or audio using the microphone. The attacker can even watch the victim in real-time if the victims’ camera is not covered. The attacker is also given full access to the gallery and also to the phone’s Global Positioning System (GPS) location.”
Symptoms of a mobile phone cyber attack may include device operating slower than normal, a sudden spike in battery consumption, apps taking a longer time than usual to load, and when the apps load; they frequently crash and cause abnormal data usage.
The NCC-CSIRT however, provided solutions to avoid Juice Jacking such as using charging only Universal Serial Bus (USB) cable to prevent USB data connection, using one’s AC charging adaptor in public space, and not granting trust to portable devices prompt for USB data connection.
Juice Jacking can also be prevented by installing Antivirus and updating them to the latest version, using one’s personal power bank, and a mobile phone should be switched off when charging in public spaces.
The statement also stated, “On the other hand, the NCC-CSIRT Advisory 0001 of January 27, 2022, warns that Facebook for Android is vulnerable to a permission issue which gives privilege to anyone with physical access to the android device to accept friend requests without unlocking the phone. The products affected include Versions 329.0.029.120 of Android OS.
“With this, the attacker will be able to add the victim as a friend and collect personal information of the victim, such as Email, Date of Birth, Check-ins, Mobile phone number, Address, Pictures, and other information that the victim may have shared, which would only be visible to his/her friends. However, to be protected from the Facebook-associated vulnerability, NCC-CSIRT in the security advisory recommends to users to disable the feature from their device’s lock screen notification settings.”
In October 2021, the NCC-CSIRT was launched to “provide guidance and direction for the constituents in dealing with issues relating to the security of critical infrastructure in their possession, and periodically assess, review and collate the threat landscape, risks, and opportunities affecting the communications sector, in order to provide advice to relevant stakeholders in those regards.”
The objectives of NCC-CSIRT are aligned with the objectives of the National Cyber security Policy and Strategy (NCPS) document published by the Office of the National Security Adviser (ONSA).
