Bogus iPhone Chargers Infect Your Device with Malware

Bogus iPhone Chargers Infect Your Device with Malware

  • By Ginger Hill
  • Aug 01, 2013

Be careful where and what you use to charge your very trusting iPhone because your device could get infected with malicious malware!

Bogus iPhone Chargers Infect Your Device with MalwareResearchers from the Georgia Institute of Technology have created fake iPhone chargers, dubbed “Mactans,” that not only “juices up” your iPhone, but installs custom, malicious applications. Small computers are housed inside these bogus chargers, and your unsuspecting and obedient iPhone doesn’t discriminate as it treats these computers just like any other computer by responding to USB commands. If your iPhone is unlocked while attached to the USB host, the host is in control of your smartphone.

So, how did these researchers do it?

Well, it sounds really simple. They just used the Mactan to install an app package onto an iPhone.

Now, here’s where it gets a bit complicated!

This app package then takes advantage of an Apple-devised system that permits developers to deploy applications to their own devices for testing purposes. This requires an Apple-generated provisioning profile to be installed over USB to identify a specific phone and application, allowing the application to run on the named device.

The malicious charger interrogates your iPhone because it wants to get your phone’s UDID, a unique ID number that identifies your particular iPhone. This vengeful charger then sends your phone’s specific UDID to Apple’s Web page which generates provisioning profiles. These profiles are then deployed to your iPhone, and the vicious malware is identified by the profile.

Once this is done, what can happen?

Researchers gave a Facebook example in which a malicious Facebook app replaced a real app with a trojaned version. This enabled the malware to take screenshots of the iPhone wherever passwords were being entered.

This type of attack does have limitations, though, including:

  • The iPhone’s screen must be unlocked;
  • Generating a provisioning profile requires the attacker to have a valid developer account;
  • A valid developer account can only generate profiles for 100 different phones; and
  • There’s no facility to remove the UDID that associated with the developer’s account.

What has Apple done in response to this discovery?

Bogus iPhone Chargers Infect Your Device with MalwareThey have made the iPhone a little less trusting. iOS 7 will ask users if they want to trust the currently connected device, indicating that it could be a Mactan-like device.

Note: I'd be sure NOT to use those "free" charging stations in airports or any other location, for that matter. I'm sure hackers will soon be swarming to them...especially after this discovery.

Source: http://arstechnica.com/security/2013/07/trusting-iphones-plugged-into-bogus-chargers-get-a-dose-of-malware/

About the Author

Ginger Hill is Group Social Media Manager.

Featured

  • From the Most Visible to the Less Apparent

    The Cybersecurity and Infrastructure Security Agency (CISA) states “There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, and national public health or safety or any combination thereof.” Read Now

  • Work Anywhere, Secure Everywhere: 2025 Tech Predictions

    Five years after the pandemic, organizations need a flexible work reset to stay productive and support any work arrangement. Despite the pandemic-fueled workplace shift that began five years ago, companies across industries and geographies continue to increase flexible work configurations. However, many tools adopted during COVID onset remain in place today, and they now need a reset to keep employees productive and secure regardless of location. Security leaders must re-evaluate existing practices and reinvest in zero trust security, passwordless environments, and automation adoption to improve efficiency and productivity. Read Now

  • Guiding Principles

    Construction sites represent a unique sector of perimeter security, especially amidst a steady increase in commercial construction. As in any security environment, assessing weaknesses and threats remains paramount and modern technology, coupled with sound access control principles, are critical in addressing vulnerabilities at even the most secure construction sites around the world. Read Now

  • Empowering 911

    In the wake of the tragic murder of UnitedHealth Group CEO Brian Thompson, media coverage flooded the airwaves with images, videos and detailed timelines of the suspect’s movements. While such post-incident analysis is not new, today’s 911 centers now have access to similar data in real-time. This technological evolution marks a pivotal transformation in emergency response, transitioning from analog calls to a digital ecosystem capable of saving more lives. Read Now

Most   Popular

New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.