We've all heard true horror stories about low-quality chargers, damaged batteries, specifications that are never met, and smartphones wrapped in flames. As if that weren't enough, we now have to add firmware-level attacks. A group of Chinese researchers under Tencent's wing published a proof of concept last week for BadPower, a new technique that essentially falsifies the negotiation parameters between a "fast charger" and a mobile device to make it deliver a much higher voltage than necessary. The result? Fire.
If you have a classic battery charger with a micro USB connector for your mobile device, it will most likely deliver 5 volts at 0.5A or 1A at most. However, the need for more intense and faster charging has given rise to "fast chargers" or "smart chargers". In relaxed terms, charger and device negotiate optimal values without losing sight of each other's safety. If the quality in every link of the chain is good enough, that exchange poses no risk... but there's a detail: Those chargers have firmware, and they are vulnerable to attacks.
Let's make room for BadPower, a proof of concept published by researchers from the giant Tencent. The video lasts only two minutes, but its content deserves our attention: In extreme cases, a fast charger can enable loads of 20 volts (or more). Otherwise, if the device is not compatible or conditions are not ideal, the charger "falls back" to conventional 5V. What BadPower does is alter the charger's firmware, so that regardless of the negotiated voltage, it always sends 20 volts. In the test, the researchers use a malicious device that poses as a phone to trick the charger and carry out the attack. Once finished, the charger operates at 5V for a few seconds, and then makes the deadly jump to 20V immediately after. The video description and the original text (in Chinese) explain that they evaluated 35 fast chargers out of more than 200 available on the market. Of those 35, 18 are vulnerable to BadPower, and 11 were attacked through the charging port. The researchers believe BadPower can be neutralized with a firmware update, and those chargers with non-updatable firmware or configured as "read-only" should be safe.
https://old.neoteo.com/las-diferencias-entre-baterias-premium-y-baterias-economicas/What about the devices? Modern tablets and smartphones are supposed to have mechanisms that protect them from overvoltage, but we know well that manufacturers love to save a penny or two. In the video they sacrifice two small desk magnifying glasses with lights: The first dies with a "pop", followed by fire and smoke. The second repeats the "pop", throws a spark, and ends with more fire and smoke... all very close to generic 18650 batteries. That's how fires start...
Original text (Chinese): Click here Source: Hackaday
