No Free Charge Theorem: A Covert Channel via USB Charging Cable on Mobile Devices

Abstract

More and more people are regularly using mobile and batterypowered handsets, such as smartphones and tablets. At the same time, thanks to the technological innovation and to the high user demands, those devices are integrating extensive functionalities and developers are writing battery-draining apps, which results in a surge of energy consumption of these devices. This scenario leads many people to often look for opportunities to charge their devices at public charging stations: the presence of such stations is already prominent around public areas such as hotels, shopping malls, airports, gyms and museums, and is expected to significantly grow in the future. While most of the time the power comes for free, there is no guarantee that the charging station is not maliciously controlled by an adversary, with the intention to exfiltrate data from the devices that are connected to it.In this paper, we illustrate for the first time how an adversary could leverage a maliciously controlled charging station to exfiltrate data from the smartphone via a USB charging cable (i.e., without using the data transfer functionality), controlling a simple app running on the device-and without requiring any permission to be granted by the user to send data out of the device. We show the feasibility of the proposed attack through a prototype implementation in Android, which is able to send out potentially sensitive information, such as IMEI, contacts' phone number, and pictures.

Power to peep-all: Inference Attacks by Malicious Batteries on Mobile Devices

“…For a targeted attack, an attacker may physically access the phone to fetch the malicious battery with the recorded power trace. Alternatively, the battery may manipulate the reported charge level to force the phone's owner to connect to a malicious charger, which in turn may relay the data to an outside attacker [30]. To trigger this behavior in a specific location equipped with malicious chargers, the battery may identify the browsing event to a gateway for connecting to a public hotspot.…”

JFCGuard: Detecting juice filming charging attack via processor usage analysis on smartphones

“…It achieves this by cutting off the data pins in the USB cable and allowing only the power pins to connect through. However, this solution does not work for certain charging attacks like PowerSnitch [37], which can leak information via analyzing power consumption.…”

“…where they presented Mactans, a malicious charger to launch charging attacks by injecting malware on an iOS6 device based on BeagleBoard during the charging process. Spolaor et al [37] then proposed PowerSnitch, a malicious application that can utilize power consumption to send out data over a USB charging cable to the public charging station. Since we are not sure that these charging facilities are not maliciously controlled by cyber-criminals including charging station developers, maintenance managers and Government agencies, there is a need to pay particular attention on charging vulnerabilities in public charging facilitates.…”

The security risks of power measurements in multicores

“…The authors manipulated the charger to measure the current input to the phone and could reconstruct the leaked data stream by analysing the recorded power trace. In contrast to Spolaor et al [19], in this work we will not use any external devices to establish the covert channel but only rely on internal device measurements. Further, we will directly transfer data from one application to another within the device, which can leak the data later via conventional communication interfaces.…”

“…Using this map, the authors were able to reconstruct the movement trajectory of a mobile device by analysing the power trace. Spolaor et al [19] showed that it is possible to extract data from a charging phone by modulating the amount of power which is taken in via the charger, by changing the utilization of the mobile phones processor. The authors manipulated the charger to measure the current input to the phone and could reconstruct the leaked data stream by analysing the recorded power trace.…”