BadPower attack can trick devices into setting themselves on fire, security researchers say

The vulnerability cannot always be patched because of limitations in the chips used

Adam Smith
Tuesday 21 July 2020 14:32
Comments

Chinese security researchers have found a way to hack smartphone chargers to break or burn the device.

The issue, which has been called “BadPower”, was discovered by the Xuanwu Lab, which is a research unit of Chinese technology giant Tencent.

The attack makes chargers put out an excessively high voltage, resulting in the device breaking down. It focuses on fast-charging technology – chargers, stands, and cables, that can fill up your smartphone faster than standard cables.

Both iPhone and Android phones have fast-charging capabilities.

The current fast charging technology can provide a maximum voltage of 20V and 100W of power, as well as actually transmitting data between the charger and the device via built-in firmware.

This firmware is used to decide charging speeds, based on the capabilities of the device. However, the researchers say that this connection is not secure.

Hackers could rewrite the code that controls the power supply, meaning devices only capable of receiving 5V charge could be forced to take four times as much, resulting in the device overloading.

“All products with BadPower problems can be attacked by special hardware, and a considerable number of them can also be attacked by ordinary terminals such as mobile phones, tablets, and laptops that support the fast charging protocol,”the researchers say.

This is done through a specific device, designed to look like a smartphone, being plugged in to the charger to insert the malicious code before the charger is used with another device.

The researchers tested BadPower attacks on 35 fast chargers, from 234 models available. It was discovered that 18 models from eight different vendors were vulnerable to this flaw.

While the BadPower vulnerability can be patched with an update to the charger’s firmware, the researchers say that 18 of the chip vendors did not provide the option to update the firmware. As such, there is no way to fix the vulnerability in those chargers.

The researchers did not say which models of charger could be affected by the BadPower vulnerability, but have contacted China’s National Vulnerability Database about the flaw. The Independent has reached out to the Xuanwu Lab for more information.

Register for free to continue reading

Registration is a free and easy way to support our truly independent journalism

By registering, you will also enjoy limited access to Premium articles, exclusive newsletters, commenting, and virtual events with our leading journalists

Already have an account? sign in

By clicking ‘Register’ you confirm that your data has been entered correctly and you have read and agree to our Terms of use, Cookie policy and Privacy notice.

This site is protected by reCAPTCHA and the Google Privacy policy and Terms of service apply.

Join our new commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies

Comments

Thank you for registering

Please refresh the page or navigate to another page on the site to be automatically logged inPlease refresh your browser to be logged in