TL;DR: Juice Jacking Guard is a custom-built Windows security tool by Mathieu Haye: it blocks every unknown USB device before Windows trusts it, classifies it across four risk levels and runs entirely on the local machine, with no telemetry; it is available as a free download on mathieuhaye.fr.
Key takeaways
- Windows trusts whatever a USB device claims to be: a rogue stick declared as a keyboard can type 200 commands in a few seconds.
- Honeywell detected 1,826 unique USB threats in industrial environments in the first quarter of 2025, including 124 never seen before.
- Juice Jacking Guard blocks every unknown device on insertion: roughly 4,900 lines of code, 20 modules, 11 subsystems, 100% local.
- For most SMBs, well-configured Windows policies and a standard antivirus are enough; a custom tool is only justified by a specific exposure.
The problem: your USB port is too trusting
A USB port works on a simple principle: the device declares what it is, and the operating system believes it. A storage stick with modified firmware can present itself as a keyboard; Windows accepts it, and that fake keyboard then types commands at machine speed, roughly 200 commands in a few seconds. This is the family of attacks known as BadUSB, made famous by tools like the Rubber Ducky or the O.MG cable, an ordinary-looking charging cable that carries its own implant. No standard antivirus catches it in time, because a typing keyboard is not a file to scan.
The phenomenon is not theoretical. In its 2025 industrial threat report, Honeywell counted 1,826 unique USB threats in the first quarter of 2025 across sites running its inspection system, including 124 never observed before. According to the same study, covered by Help Net Security, one in four major security incidents traced back to a USB device plugged into a machine. The topic even reached the general public in 2023, when the FBI advised against public USB charging stations in airports and shopping malls, over fears of juice jacking, the infection of a device while it charges.
Why build instead of shopping the market?
The question deserves to be asked in that order, because it is the one I ask my clients. USB device control does exist on the market: the large enterprise security suites offer device control modules. But those modules come inside platforms designed for fleets of hundreds of workstations, with an administration console, a deployment project and per-seat pricing. At the other end, the do-it-yourself answer is to disable USB ports altogether, which amounts to cutting off a hand to avoid a burn.
In between, for a standalone Windows machine or a small fleet, I could not find a tool that does one precise thing and does it well: intercept every device before the system trusts it, with no cloud dependency and no subscription. That is exactly the situation where building makes sense: a sharp need, a narrow scope, and market solutions that only cover it as a by-product of a much heavier offer.
What was built, concretely
Juice Jacking Guard is a desktop application for Windows 10 and 11. Its principle fits in one sentence: every unknown device is blocked before it can even talk to the system, then classified across four risk levels. A new keyboard has to prove a human is behind it: the tool asks for one precise key, shown on screen, which an automated device can neither read nor guess. Storage drives are scanned read-only on insertion, with an optional reputation check. Everything stays local: no telemetry, no data sent anywhere.
On the engineering side, the tool amounts to roughly 4,900 lines of code across 20 modules and 11 subsystems, delivered all the way: a single-file Windows installer of 23.3 MB, a clean uninstall, and published SHA-256 checksums so anyone can verify the download. It is distributed for free on the projects page of this site. AI served as a development accelerator on this project; it did not remove the need to understand how Windows handles USB drivers, nor to test every blocking scenario on real machines.
What can an SMB take from this?
The first lesson is not about USB, but about ranking risks. Juice jacking makes headlines; yet, as Dark Reading notes, the FCC (Federal Communications Commission) itself acknowledges that no real-world case has been documented to date. The publicized risk and the measured risk do not overlap: the 1,826 threats counted by Honeywell come from perfectly ordinary sticks and drives, plugged in by employees and contractors. A company that reasons from headlines protects the wrong door.
The second lesson is about the decision to build. The table below sums up the four possible answers to USB risk, and who each one is for.
| Approach | What it covers | Who it is for |
|---|---|---|
| Do nothing | Nothing; Windows accepts any declared device | No one, once a machine touches business data |
| Windows policies + antivirus | Removable storage blocking, scanning of known files | Most SMBs with 10 to 100 employees |
| Enterprise security suite | Centralized device control across the whole fleet | Fleets of several hundred machines, with an IT team |
| Dedicated custom tool | One precise scope, owned, no subscription, no cloud | A specific exposure the market does not cover |
Let us be clear: for most SMBs, the second row is enough. Well-configured group policies, an up-to-date antivirus and wall chargers when traveling cover the bulk of the risk, at a cost close to zero. Commissioning a custom security tool without a documented exposure would be a poor investment; and security software without a maintenance plan becomes a risk of its own. Custom building is justified when your situation falls outside the frame: workstations that receive third-party drives all day, an isolated machine driving equipment, or confidentiality constraints that rule out cloud consoles.
It is the same reasoning I apply to business projects: the Horus Condition Report engagement ended with a configured Pipedrive rather than a custom-built CRM, because the market covered the need. Juice Jacking Guard is the opposite case: the market did not cover it, so the tool was built, small, local, and shipped.
Frequently asked questions
Is juice jacking a real risk for a small business?
Juice jacking, infecting a device through a public USB charging station, has no documented real-world cases to date according to the FCC. The actual USB risk for a business comes from BadUSB-style rogue devices and infected storage drives: Honeywell detected 1,826 unique USB threats in industrial environments in the first quarter of 2025.
What is a BadUSB attack?
A BadUSB attack uses a USB device whose firmware lies about what it is: a rogue storage stick declares itself as a keyboard to Windows, then types commands at machine speed, roughly 200 commands in a few seconds. The Rubber Ducky and the O.MG cable are the best-known tools in this family.
When should an SMB invest in a custom security tool?
Only when three conditions are met: a specific, documented exposure; market tools that only cover the need as a by-product of a heavy suite; and a clear maintenance plan. For most SMBs, well-configured Windows policies and a standard antivirus are enough.
A simple test to gauge your own exposure: count the unknown USB devices plugged into your machines last week, contractors' sticks included, and ask what happens today when one of them is inserted. If the answer is "nothing in particular" and those machines touch your customer data, the topic is worth 30 minutes. I help SMBs decide between existing settings, a market tool and a custom application; we can talk it through in a free 30-minute scoping call.
The takeaway: the right question is never "should we build?" but "does the market cover my real, measured risk, not the one in the headlines?". When the answer is yes, tune what you already have. When it is no, a narrow tool you own beats a broad suite you rent.