Smartphones can be compromised when charged using a standard USB connection connected to a computer.

Kaspersky Lab experts have discovered this in a proof-of-concept experiment and are evaluating the impact of such incidents.

Have you ever wondered how safe your smartphone and data are when you connect the device to freely available charging points at airports, cafes, parks and public transport? Do you know what, and how much data your mobile device is exchanging with these points while it’s charging?

As part of this Kapersky’s research, experts tested a number of smartphones running various versions of Android and iOS operating systems to determine what data the devices transfer while connected to a PC or Mac for charging.

The test results indicate that the mobiles reveal a litany of data to the computer during the “handshake” (a process of introduction between the device and the PC/Mac it is connected to), including: the device name, device manufacturer, device type, serial number, firmware information, operating system information, file system/file list, electronic chip ID.

The amount of data sent during the handshake varies depending on the device and the host, but each smartphone transfers the same basic set of information.

Smartphones, therefore, serve as unique identifiers for their owners and for any third party interested in collecting this “personal” data. But collecting a few unique identifiers is not all an attacker can do with a device connected to an unknown computer or charging device.

In 2014, a concept was proposed at Black Hat (an infosecurity conference held each year in Las Vegas) that a mobile phone could be infected with malware simply by plugging it into a fake charging station. In 2016,  Kaspersky Lab experts have been able to successfully reproduce the result.

Using just a regular PC and a standard micro USB cable, armed with a set of special commands (so-called AT-commands), a hacker can re-flash a smartphone and silently install a root application on it. This amounts to a total compromise of the smartphone, even though no malware was used.

Although information about actual incidents involving fake charging stations has not been published, the theft of data from mobiles connected to a computer has been observed. For example, this technique was used in 2013 as part of the cyberespionage campaign Red October. The Hacking Team group also made use of a computer connection to load a mobile device with malware. Both of these actions exploited the heretofore assumed safe initial data exchange between the smartphone and the PC to which it was connected.

“It is strange to see that nearly two years after the publication of a proof-of-concept demonstrating how a smartphone can be infected though the USB, the concept still works,” warns Alexey Komarov, researcher at Kaspersky Lab. Your phone could be silently packed with anything from adware to ransomware; and, if you’re a decision-maker in a big company, you could easily become the target of professional hackers.

“And you don’t even have to be highly-skilled in order to perform such attacks, all the information you need can easily be found on the Internet,” he adds.

In order to protect yourself from the risk of possible attack through unknown charging points and untrusted computers, Kaspersky Lab advises the following:

* Use only trusted USB charging points and computers to charge your device;

* Protect your mobile phone with a password, or with another method such as fingerprint recognition, and don’t unlock it while charging;

* Use encryption technologies and secure containers (protected areas on mobile devices used to isolate sensitive information) to protect the data;

* Protect both your mobile device and your PC/Mac from malware with the help of a proven security solution. This will help to detect malware even if a “charging” vulnerability is used.

Adapted from an article on itonline.com