Touchscreens: Attack from the charging socket

International research team manipulates mobile devices with “Ghost Touch”.

Touch screens on mobile devices can be attacked and manipulated via charging cables and power supply units. This is what researchers at the System Security Lab at TU Darmstadt have discovered together with a Chinese research team. Several smartphones and standalone touchscreen panels could be compromised in practical tests by simulated touches, the “ghost touches”. The results were presented at this year’s “IEEE Symposium on Security and Privacy.”

The researchers from TU Darmstadt and Zhejiang University in Hangzhou carried out attacks on capacitive touchscreens via charging cables and power adapters, revealing a new way to attack mobile devices. Similar to their previous research project, “GhostTouch,” the researchers were able to create false touches, called “Ghost Touches,” on multiple touchscreens and manipulate the device via them.

The international research team had to overcome two main challenges. The first was to affect the capacitive touchscreens via a charging-only cable without damaging the hardware. Electronic devices are usually equipped with resistive filters in the circuits to ensure a stable power supply. It was necessary to design an attack that would work even if users were using a charging-only cable without a data channel, which is typically used in public spaces for privacy and security reasons. Second, the touch points had to be specifically controlled in order to manipulate the device. This was necessary so that, for example, malicious Bluetooth connections could be established, users could be tapped by a phone call, or malware could be received.

In the test setup, a compromised public charging station was assumed to be the starting point of the attack. A manipulated USB charging socket was used, whose power supply can be controlled remotely. Such publicly accessible charging stations are often found in cafés, in hospitals, hotels or at airports and train stations. Anyone who charges their smartphone or tablet at this charging station initiates the attack, which is initially disguised as a normal charging signal. The attacker measures the sampling frequency of the touchscreen via the charging connection in order to adapt the attack signal. Beyond that, no data connection is necessary.

A sophisticated attack signal is injected into the GND line, i.e. the ground line, via the charging line. The attack signal, which is injected via the USB interface, affects the power supply and is converted into a noise signal due to the lack of filtering. With the help of these noise signals, three different attack effects can be achieved, which are related to the typical structure of capacitive displays.

The main component of a touchscreen is a matrix of rows and columns of conductive electrodes (TX) and sensing electrodes (RX), whose crossing points are called mutual capacitance. If one now touches the screen, the finger forms an additional capacitance with the electrodes and changes the equivalent capacitance, creating a touch event and allowing the smartphone to be controlled.

The researchers were able to achieve targeted ghost touches along both the TX electrodes and the RX electrodes without physical contact. Furthermore, the screen could be manipulated in such a way that it no longer responded to real touches.

In addition to the attack scenarios, the international research team also describes possible software- as well as hardware-based countermeasures in their paper, which was published at the prestigious “IEEE Symposium on Security and Privacy 2022.” Further to a hardware-based functional tool that disrupts the common-mode attack signal, software-based measures can be used to detect the altered capacity or to identify reliable charging stations in a manner similar to the fingerprint mechanism.

Link to paper: https://www.computer.org/csdl/proceedings-article/sp/2022/131600b537/1CIO7Ic5kR2

About TU Darmstadt
TU Darmstadt is one of Germany’s leading technical universities and a synonym for excellent, relevant research. We are crucially shaping global transformations – from the energy transition via Industry 4.0 to artificial intelligence – with outstanding insights and forward-looking study opportunities. TU Darmstadt pools its cutting-edge research in three fields: Energy and Environment, Information and Intelligence, Matter and Materials. Our problem-based interdisciplinarity as well as our productive interaction with society, business and politics generate progress towards sustainable development worldwide. Since we were founded in 1877, we have been one of Germany’s most international universities; as a European technical university, we are developing a trans-European campus in the network, Unite! With our partners in the alliance of Rhine-Main universities – Goethe University Frankfurt and Johannes Gutenberg University Mainz – we further the development of the metropolitan region Frankfurt-Rhine-Main as a globally attractive science location.

MI No. 46e/2022, Richard Mitev/Ahmad-Reza Sadeghi/sip

Wissenschaftliche Ansprechpartner:

Prof. Ahmad-Reza Sadeghi, Head of System Security Lab, TU Darmstadt
ahmad.sadeghi@trust.tu-darmstadt.de

Originalpublikation:

https://www.computer.org/csdl/proceedings-article/sp/2022/131600b537/1CIO7Ic5kR2

https://www.tu-darmstadt.de/universitaet/aktuelles_meldungen/einzelansicht_376384.en.jsp