No Free Charge Theorem 2.0: How to Steal Private Information from a Mobile Device Using a Powerbank
summary
Demonstrates a practical covert channel that encodes data as CPU-driven current bursts measured over the charging line, claims successful exfiltration from Android devices using only wakelock and battery-status permissions, and achieves up to 2 bits/sec (≈500 bytes in ~10 minutes). Builds a cheap sniffer (Arduino + Hall-effect sensor) hidden inside powerbanks or chargers and decodes the signal; works across standard USB and USB‑C/quick‑charge setups. Prototype is low-cost and effective; turning the device off prevents leakage.
AI-written summary · about
chapters (20)
- 0:00Start
- 3:50Our priorities change over time
- 7:17The threat runs on the data cable
- 9:17Background: how a smartphone recharges?
- 10:42Background: where the current goes?
- 11:13Background: Let's check this out!
- 15:26Properties of the covert channel
- 16:27Let me present Bob
- 17:36And here is Mark, the hacker
- 18:09How can Mark exploit this covert channel?
- 19:23PowerSnitch app: our prototype
- 21:19Decoder: from the signal to the information
- 22:56PowerSnitch app: Optimizations (2/2)
- 26:21NFCT 1.0: First version of the attack
- 27:00Decoder: Electronics DIY
- 28:38Decoder: Easy to deploy
- 29:00Electronics DIY: cost?
- 30:00VIDEO TIME?
- 31:31Black Hat Sound Bytes
- 33:11Questions?
related talks
34mA new categorization system for Side-channel attacks on mo...
17mHotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging...
51mBluetooth Hacking: Tools And Techniques
11mShort: Breaking the Charge: Exploiting State Manipulation in EV Charging
39mExfiltrate All The Things!
31mProtecting the Attack Surface and Data Silos of an EV Charging Network
40mVideo-Based Cryptanalysis: Recovering Cryptographic Keys from Device Using Video of Power LED
14mCharge It to My Neighbor: A Relay Attack on ISO 15118 Plug and Charge Payment