USING CHARGING CABLES, RESEARCHERS GAIN ACCESS TO ANDROID AND IOS DEVICES

Wed 07 September 2022:

Researchers in cyber security have successfully used charging cables to remotely access Android and iOS cellphones and swipe touch screens without touching them.

They remotely cracked the Samsung Galaxy S20 FE, the Apple iPhone SE (2020), and cellphones made by Huawei, LG, and Xiaomi.

The first wired attack on those smartphones was demonstrated by security researchers from Zhejiang University in China and the Technical University of Darmstadt in Germany. This attack uses charging cables to create ghost touches on capacitive touchscreens and can be used to manipulate the victim devices in ways that have undesired consequences, such as allowing malicious Bluetooth connections or accepting malicious files.

“Our study calls for attention to a new threat vector against touch screens that only requires connecting to a malicious charging port, which could be a public charging station, and is effective across various power adapters and even USB data blockers,” the researchers said in a paper titled “WIGHT: Wired Ghost Touch Attack on Capacitive Touchscreens”.

Despite the fact that smartphones employ abundant noise reduction and voltage management techniques, they manage to inject carefully crafted signals that can induce ghost touches within a chosen range.

“The underlying principle is to inject common-mode noises over the power line to avoid being effectively filtered yet affect the touch measurement mechanism, and synchronise the malicious noise with the screen measurement scanning cycles to place the ghost touches at target locations,” they said.

They achieved three types of attacks: injection attacks that create ghost touches without users touching the screen, alteration attacks that change the detected legitimate touch position, and denial-of-service attacks that prevent the device from identifying legitimate touches.

“Our evaluation on 6 smartphones, 1 tablet, 2 standalone touchscreen panels, 6 power adapters, and 13 charging cables demonstrates the feasibility of all three type attacks,” the team wrote.

The researchers used Lightning, USB-A, USB-CF, and Micro-charging cords to link cellphones to a “malicious charging port” in order to accomplish this.

They reported that the attack was successful across a variety of power adapters and that USB data blockers were unable to stop it.

SOURCE: INDEPENDENT PRESS AND NEWS AGENCIES

___________________________________________________________________________________________________________________________________________

FOLLOW INDEPENDENT PRESS:

TWITTER (CLICK HERE)
https://twitter.com/IpIndependent