XPorter: A Study of the Multi-Port Charger Security on Privacy Leakage and Voice Injection

Multi-port chargers, capable of simultaneously charging multiple mobile devices such as smartphones, have gained immense popularity and sold millions of units in recent years. However, this charging-targeted feature can also pose security and privacy risks by allowing one of the simultaneously charging devices to communicate with another one if not properly designed and implemented as these devices are actually interconnected. Unfortunately, such risks have not been thoroughly investigated and we have identified a novel attack surface in the circuit design of multi-port chargers, which allows an adversary to exploit one port to (𝑖) eavesdrop on the activities of other devices being charged and (𝑖𝑖) inaudibly inject malicious audio commands if the charging device supports voice assistants and USB-C interface.

In this paper, we design and implement a novel framework, XPorter, to analyze and demonstrate the uncovered security and privacy threats in multi-port chargers. Specifically, it leverages the changes in the voltage signals on one neighbor port to monitor the voltage changes of the charging port induced by various user activities, including recognizing the running apps and uncovering keystrokes. Moreover, XPorter can also achieve inaudible audio injection attacks The corresponding author.