Mobile charging stations steal data from devices

USB mode silently comes to life.

Security researchers have demonstrated how data can be stolen from Windows, Android and Apple devices by unassuming power charging towers.

In an attack demonstrated at the Defcon hacking conference, mobile phone charging units were rigged to pull data from phones plugged into them.

They were laced with different power charging adaptors to make them more appealing.

Some stock phones were safe since they deactivated USB mode when they were powered off, but others were not so lucky.

Many jailbroken and modified devices activated USB functions when  they were plugged in, or simply rebooted.

That gave security researchers Brian Markus, Joseph Mlodzianowski and Robert Rowley the access they needed to pull data, though they instead served victims with a warning.

“If the phone died due to lack of power, in most cases the phone would boot up upon
plugging it in, then expose the data,” Marcus said.

Three hundred and sixty four people fell for the trick. Each was served with a message that warned of the dangers of using public power charging stations.

The researchers were still crunching over the findings, however Markus said specifications that may mean USB modes were silently actived included the platform and version of operating system and root kits and jailbreaks used, whether custom systems like Android ROMs were used, and the drivers loaded on the host.

Markus said the team was to his knowlegde the first to expose the threat, but said he was suspcious “of certain power kiosks”.

“Our goal is to promote security awareness.  While we do have several other variants of this demo that shows what could happen, we demo them in a responsible way.”