Security Review: The Jupiter Jack (as seen on TV)

The continuously looping infomercials featuring Billy Mays and Anthony Sullivan state that Bluetooth devices and headsets sold at cell phone stores are expensive, ranging from $50 - $150. The Jupiter Jack provides a low cost alternative as State and local governments are placing restrictions, requiring hands-free devices to be used in cars. The device works similar to an iPod or MP3 car adapter. The mobile phone is mounted to the dashboard and connected to a small, key-sized microphone and radio transmitter. The jack broadcasts the conversation to the car’s FM radio, “Instead of hearing music, you hear the other person’s voice.” The microphone also amplifies the user’s voice into the phone.

Any customer would be enticed by the low price tag around $20. However, this device has some serious security flaws. As one of the millions of cell phone users in the nation, I want my conversations out of the public domain. I should always be able to have clear communications with the other caller without outside interference. It is not difficult to see how the Jupiter Jack does little to protect the confidentiality, integrity, or availability of the user’s conversation.

Those seeking to attack users of the Jupiter Jack require little effort or equipment to achieve a variety of goals. These include gaining access to conversations without detection, interjecting the attacker’s voice into the conversation, and also denying service to Jupiter Jack users. Attackers can easily listen in on conversations, as both broadcast frequencies 88.7 and 99.3 FM are explicitly mentioned in the infomercials. Though inventor Jason Bobb claims the Jack is FCC approved with a range of 25 ft, bumper-to-bumper traffic puts attackers much closer. Longer range side-channel attacks are still a possibility with stronger receiver antennas. Although only the other person’s voice is supposedly broadcast, user reviews complain of an echo effect in the radio. Enhancing this echo, attackers can listen in on both sides of the conversation. By purchasing a Jupiter Jack, attackers have all the tools to deceptively broadcast into another conversation, or even cause enough interference to make the Jupiter Jack unusable.

Just as computer users with wireless internet are not always exchanging secure information or making online purchases, conversations on the Jupiter Jack will often be meaningless to attackers. However, this is a nationally advertised product that provides a low-cost headset. In a city, there may be thousands of Jupiter Jack users. All it takes is one user giving out or receiving sensitive information to make Jupiter Jack a lucrative target. Unlike Bluetooth, there is no encryption, and listening in on another conversation on your car radio is not illegal.

Users are left with few options. Either don’t speak on the Jack in crowded areas, where a hands-free is a must, or limit your conversations. Owners of the Jupiter Jack must simply accept that they have made their conversations very public. Those looking to cut costs have skipped the gimmicks of the Jupiter Jack and have simply purchased an audio wire to connect their phone directly to the car’s MP3 port. Bluetooth devices may be worth the encryption. Ultimately, driver’s safety does not have to compromise information security as easily as the Jupiter Jack does.

Discovery’s Pitchmen. “Pitches and Tests”

StarReviews. “Jupiter Jack”

Youtube. “Jupiter Jack”