Vulnerability In Fast Chargers Can Melt Your Phone: BadPower Attack

Chinese security researchers recently demonstrated how the firmware of some fast chargers can be modified to cause damage to connected devices by delivering more voltage than they can handle. 

The method dubbed as ‘BadPower’, was discovered by Xuanwu Lab, a research unit of Chinese tech giant Tencent. The team mentioned their findings in a detailed report last week that showed how a large number of fast-charging devices have security issues.

According to the researchers, the firmware of a USB fast charger can be altered to damage connected (charging) systems, which can cause components inside the affected devices to spark, crackle, melt, or even set devices on fire. 

For instance, some fast chargers can push 12V, 20V, or higher, but some devices can only safely accept the standard 5 output. The researchers found that BadPower alters the default charging parameters and overloads a device with more voltage than it can handle causing it to burst into flames, which can be extremely dangerous.

The researchers explain that the BadPower attack is lethal, as it is invisible and can be performed in a way that will not raise any suspicion. All the attacker needs to do is attach the attacking rig to the fast charger, which leaves the firmware modified in a few seconds. 

With some fast chargers, the attackers don’t even require any special equipment. They can silently load the malicious attack code on the targeted smartphone or laptop to modify the fast charger’s firmware. When the user attaches the compromised device to a fast charger, it would execute a power overload causing it to go up in flames.

The team at Xuanwu Lab reported that they tested BadPower attacks with 35 types of quick chargers from over 234 models available in the market. The researchers found 18 models from eight vendors were vulnerable to BadPower, which could update the firmware through the USB port that the phone was plugged into. 

Fortunately, the manufacturers can fix most BadPower vulnerabilities by applying the firmware update on fast chargers, researchers say. Sadly, the 18 affected models Xuanwu tested came from vendors that do not offer a firmware update, which means those manufacturers can’t update those charger models. In such a case, the user has no other option but to dispose of the charger. 

Xuanwu Lab researchers have notified all affected vendors about their findings, as well as the Chinese National Vulnerabilities Database (CNVD) about the potential danger. Further, the researchers recommend fixing the problem by hardening firmware to prevent unauthorized modifications while also deploying overload protection to charged devices.

Further, the researchers suggest fixing the BadPower problem by hardening firmware to prevent unauthorized modifications, while also deploying overload protection to charged devices.

Check out the demo video below of the BadPower attack: