Researchers to show how to install malware in iPhones, iPads with just a charger

At the upcoming Blackhat Security Conference in July, three researchers plan to showcase a proof-of-concept that they claim can install malware into an Apple device that is plugged into it. The researchers claim that the charger can do this without requiring any permission, or even needing jailbreak on the device.

According to the summary of the talk , “despite the plethora of defense mechanisms in iOS, we successfully injected arbitrary software into current-generation Apple devices running the latest operating system (OS) software. All users are affected, as our approach requires neither a jailbroken device nor user interaction.”

The researchers—Billy Lau, Yeongjin Jang and Chengyu Song—will be demonstrating how an iOS device can be compromised within a minute of being plugged into a malicious wall charger at the presentation.

Even chargers aren’t safe anymore

The presentation also includes an examination of Apple’s existing security measures that protect their devices against arbitrary software installation. After this, they will talk about how USB capabilities can be used to bypass the defenses. The researchers then show how to hide their software in the same way that Apple hides its own built-in apps so that the malicious app doesn’t get removed by any security mechanism of the device.

For the demonstration, the researchers made their own malicious charger, dubbed Mactans. It was made using a BeagleBoard, which is an open source single-board computer produced and sold by Texas Instruments.

The Matcans was built with a limited amount of time and a small budget, since the BeagleBoard costs around $45 (roughly Rs 2,541). It is worth thinking what a well motivated and well-funded malicious person could do with these ideas.

To top off the presentation, the researchers recommend some security measures to protect themselves and suggest features that Apple can implement to make the attacks from chargers substantially more difficult to execute.