Certik, a team of academic researchers and Web3 smart contract auditors from the University of Florida, has devised a new attack that causes wireless chargers to take over via mains voltage manipulation.
These attacks, dubbed Voltschemer (PDF), target vulnerabilities in wireless charging systems that could allow attackers to damage charging devices, manipulate voice assistants, and bypass Qi-standard mechanisms to damage items exposed to strong magnetic fields.
In their study, the scholars noted that these attacks exploit the voltage noise of the power supply and do not require malicious modifications to the charger.
Wireless chargers rely on near-field magnetic coupling for power transfer, which is more secure than wired chargers, prevents access to direct data paths, and combines strong safety mechanisms defined by the Qi standard to protect charging devices and other objects.
However, the researchers say that the electrical signal used for power transmission could be modified to potentially control the Qi communication between the charger and the device being charged and instruct the charger to perform malicious actions.
The root cause, according to the **, is that "due to the effects of electromagnetic interference (EMI) on the charger, planned voltage noise from the power adapter can propagate through the power line and modulate the power signal on the charger's transmit coil."
Attackers can exploit this new type of attack to modulate the magnetic field generated by the charger and trigger unexpected voice commands to take control of the voice assistant of the charging smartphone, or potentially initiate dangerous power transmission to damage the smartphone.
The researchers said they tested the Voltschemer attack against 9 commercial off-the-shelf wireless chargers and found that all of them were vulnerable.
The Voltschemer attack assumes that a threat actor can compromise a power adapter that supplies voltage to a wireless charger by connecting a disguised voltage-manipulating device, such as a power port, between the adapter and the charger.
Since wireless charging systems are not effective at attenuating low-frequency interference, the manipulating device allows modulation of the amplitude of the power signal propagating to the charger.
By connecting a wireless charger to a disguised power port, scholars were able to successfully carry out all three types of Voltschemer attacks. Only 3 out of 108 voice commands are unrecognized, charging the smartphone overheats beyond the off point, and items on the charger such as keychains, USB drives, SSD drives, and NFC cards are completely destroyed or permanently damaged.
The core issue that facilitates our attack is the lack of noise suppression in certain frequency bands, leaving the system vulnerable to interference. This gap makes all wireless charging technologies potentially vulnerable to interference-based attacks, especially high-power systems like wireless charging for electric vehicles (EVs)," the researchers added.