A fast charger is supposed to replenish a phone’s battery in minutes. Just don’t let a hacker mess the firmware, or the charger might cause your devices to catch on fire.
Security researchers in China were recently able to infect a variety of fast chargers with malicious code to deliver more voltage than the connected device could handle. The overload caused the components inside the affected electronics to spark, sizzle, and melt.
The findings come from Tencent’s Xuanwu Lab, which noticed a potential problem with the technology. To deliver energy, fast chargers use a USB port, which can hook up to your smartphone via a cable. However, in some cases the same USB port will also operate as a data connection, enabling you to read and write information to the charger’s firmware.
According to Xuanwu Lab, the data connection on these USB ports have no safeguards in place to prevent tampering. As a result, an attacker can exploit the read and write ability to send malicious code to alter the charger’s firmware.
By default, the fast charger is supposed to only deliver the standard 5 volts of electricity for devices that don’t support the fast charging standard. However, by rewriting the firmware you can cause the charger to constantly deliver up to 20 volts, which will trigger a dangerous overload.
The firmware can also be manipulated to lie. For example, the charger can tell a connected smartphone that supports fast charging that it’s delivering 5 volts of power. But in reality, the charger is actually delivering 20 volts, which would likely damage the battery over time.
The lab demonstrated its “BadPower” vulnerability in a video. The malicious code is carried on a smartphone, which transmits the attack once it’s connected to the fast charger. Once the firmware is altered, the fast charger first delivers 5 volts of electricity before quickly ramping up to 20.
In the video, the lab then connected the fast charger to an electronic product, which began to spark 10 seconds after it was plugged in.
According to Xuanwu Lab, there are at least 234 fast-charging-related products on the market. It decided to test 35 of them, and found that 18 from eight different brands suffered from the BadPower vulnerability.
The lab didn’t name the vulnerable products, but it has contacted the affected vendors and China’s National Vulnerability Database about the potential danger. The good news is that vendors can patch the problem with a firmware update, which can be delivered via a connected smartphone. To fix the problem, the lab is recommending manufacturers place protections around the fast charger’s USB data connection, or remove the feature all together. The firmware on board the chargers should also be vetted for vulnerabilities.
Further Reading
- Samsung Develops 900Wh Solid-State Battery
- 24-Hour Laptop Battery Life Is Here, But Will It Be the New Normal?
- EU Pushes to Kill Apple's Lightning Port by July
- Lithium-Sulfur Battery Promises to Power a Phone for 5 Days
- More in Batteries & Power