Hackers Install Malware on iPhone With Malicious Charger
June 3, 2013 3:36 PM
comment(s) - last by
Black Hat conference demonstration shows a fresh route to subverting the popular iPhone
Apple, Inc.'s (
) popular smartphone, the iPhone, has had its
fair share of security struggles in the past
. Researchers are preparing to unveil in a few months a new iOS exploit at the annual
Black Hat security conference
-- to be held Sept. 10-12 in Las Vegas, Nev. The attack, like some past hacks, relies on flaws in transfer protocols in the joint proprietary data/charging USB connector. The researchers give things a new twist, though, demonstrating how this can be baked into a third party microcontroller, allowing for malicious peripherals.
The physical attack was developed by a trio of security researchers at the
Georgia Institute of Technology
-- post-doctoral researcher
, Ph.D candidate
, and Ph.D candidate
. The "alarming" the physical-type attack is described in
[D]espite the plethora of defense mechanisms in iOS, we successfully injected arbitrary software into current-generation Apple devices running the latest operating system (OS) software. All users are affected, as our approach requires neither a jailbroken device nor user interaction.
In this presentation, we demonstrate how an iOS device can be compromised within one minute of being plugged into a malicious charger. We first examine Apple’s existing security mechanisms to protect against arbitrary software installation, then describe how USB capabilities can be leveraged to bypass these defense mechanisms. To ensure persistence of the resulting infection, we show how an attacker can hide their software in the same way Apple hides its own built-in applications.
To demonstrate practical application of these vulnerabilities, we built a proof of concept malicious charger, called Mactans, using a BeagleBoard. This hardware was selected to demonstrate the ease with which innocent-looking, malicious USB chargers can be constructed. While Mactans was built with limited amount of time and a small budget, we also briefly consider what more motivated, well-funded adversaries could accomplish. Finally, we recommend ways in which users can protect themselves and suggest security features Apple could implement to make the attacks we describe substantially more difficult to pull off.
The researchers seem to draw the name of their malicious charger from the scientific name for the iconic Southern Black Widow spider,
. The hack isn't very price -- the BeagleBoard used is a Texas Instruments, Inc. (
) development product which retails for around $45 USD.
The attack uses a TI Beagle Board. [Image Source: Julien Ponge]
The last major exploit found in the USB data transfer layer involved flaws in the backup processes. This allowed the
published in February
to jailbreak iOS devices. Apple patched the flaw -- which could also be exploited for malicious purposes --
in the iOS 6.1.3 update
that aired a month later in March.
The attack reportedly works on both the old and new style proprietary iPhone connectors, as it is firmware based. The attackers suggest that the supporting circuitry for the attack could be hidden in an external charger or battery, giving buyers of a malicious product a nasty surprise -- a hacked iPhone. And a more sophisticated attacker could miniaturize them into even smaller form factors like cables.
The researchers contacted Apple about their findings but were rewarded with silence,
Apple is notorious for a
belligerent stance towards security professionals
sluggish patching pace
for security flaws
, with some security firms suggesting it is
ten years behind Microsoft
) in terms of security.
Black Hat conference [abstract]
This article is over a month old, voting and posting comments is disabled
RE: Good to know
6/5/2013 8:05:11 AM
I'd imagine they meant plugging a phone into a charger is a standard interaction and there would be no difference from a users perspective between a malicious charger and a standard one.
Could see sellers undercutting everyone else for 3rd party chargers and cables, then making the difference (and more) up exploiting the devices they infect. Must be plenty of people who buy spare chargers and cables from eBay, etc.
"Can anyone tell me what MobileMe is supposed to do?... So why the f*** doesn't it do that?" -- Steve Jobs
IOS, Android-Powered Devices to Make Way Onto Defense Networks Next Year
February 27, 2013, 5:52 PM
Surface Pro Reviews: Excellent Performance, Gorgeous Screen, Poor Battery Life
February 5, 2013, 10:44 PM
ARM Continues to Bump Out Record Profits
February 5, 2013, 3:54 PM
NOAA: May 2011-April 2012 Hottest Year on Record in U.S.
May 10, 2012, 2:46 PM
Samsung More Than Quadruples Smartphone Sales; Outsells Nokia, Apple
April 27, 2012, 3:16 PM
UK Teachers Want Parents to Cut-Off Their Children's Internet, Tablet Use at Night
April 17, 2014, 3:40 PM
Quick Note: Chrome Remote Desktop App for Android Launches
April 17, 2014, 9:26 AM
Report: Apple Plans to Integrate Shazam Song Finding Functionality into Siri
April 17, 2014, 9:15 AM
Bring Your Own Battery: LG Isai FL Likely is G3, First U.S. Quad-HD Android
April 16, 2014, 7:38 PM
Project Moonshine: Google's Plan to Flatten Android App Icons Leaks
April 16, 2014, 1:46 PM
Apple, Microsoft, and Major U.S. Wireless Carriers Embrace Smartphone "Kill Switch"
April 16, 2014, 10:08 AM
Most Popular Articles
Cities to Carpoolers: Sharing Your Car is Illegal, We Will Seize Your Cars
April 4, 2014, 9:17 PM
Taiwan's AOU Claims to Have World's Highest-Res. OLED Smartphone Display
April 11, 2014, 1:44 PM
iPad Exploiter is Freed by Federal Appeals Court
April 11, 2014, 7:40 PM
It's Very Likely Neanderthals and Humans Had Sex, Produced Offspring
April 10, 2014, 8:40 PM
A-10 Warthog May Live to Fight Another Day with Support from Lawmakers
April 14, 2014, 9:41 AM
Latest Blog Posts
Facebook Aims to Provide Internet to "Every Person in the World" with Drones, Satellites
Apr 1, 2014, 10:20 AM
Retail Mobile Sites Experience Outages in Light of Simplexity's Bankruptcy
Mar 14, 2014, 8:48 AM
Tesla vs. BMW: Who Has the Safer EV?
Feb 1, 2014, 2:56 PM
Justice Leaks Details of Next HTC One Two Flagship Phone
Dec 5, 2013, 4:04 PM
Global Cyber Espionage Concerns Reveal Growing Cyber Armies
Nov 29, 2013, 11:04 AM
More Blog Posts
Copyright 2014 DailyTech LLC. -
Terms, Conditions & Privacy Information