The risks of charging a smartphone via a USB cord have been established for a while. What the new study shows is even without data wires, hackers using a “side channel” can assess which websites the device user has visited while which the smartphone is charging. A side-channel attack refers to any attack based on information gained from the physical implementation of a cryptosystem, rather than simply using physical force to access information. Here factors like timing information, power consumption, electromagnetic leaks or even sound can provide an extra source of information, which can be exploited to break the system.
The risk arises at public mobile device access charging points, such as at an airport. Here people regularly use communal points to charge their device. Here devices are at risk from a hacking step called “juice-jacking.” With this hackers can analyze a device’s power needs in order to obtain users’ private browsing information. This information can reveal passwords and bank account details. In some cases the hacking can be complete rapidly.
This can happen, according to Professor Paolo Gasti because “webpages have a signature that reflects the way they load and consume energy.” The remaining power traces act as “signatures” and help hackers discover which sites have been visited.
To show this the research group undertook an experiment using a series of power use signatures previously identified. They then attempted to hack smartphones charging under different conditions. The researchers succeeded on collecting power traces, from different models of smartphone, which revealed a range of popular websites that had been visited.
The different conditions modeled included variations to battery charging level; whether the browser cache was enabled or disable; whether Wi-Fi or LTE was used. The outcome was that the array of factors did not make any significant difference. However, it was found that a device with a near to fully charged battery was easier to hack. Where hacking was more difficult was when the user was tapping the screen while a page is loading, this seemed to lessen hackers’ ability to determine the website that was being viewed.
The research raises cyber security concerns for it is highly likely that information in addition to browsing activity can be stolen via the side channel. The researchers say users should be aware of the security concerns and it is safer to switch a device off while it is charging in a public place.
The research has been published in the journal IEEE Transactions on Information Forensics and Security. The paper is titled “On Inferring Browsing Activity on Smartphones via USB Power Analysis Side-Channel.”
