[VoltSchemer]

Use Voltage Noise to Manipulate Your Wireless Charger

VoltSchemer:

VoltSchemer is an attack using voltage noise at the power supply to take full control of wireless chargers. The critical vulnerability enabling VoltSchemer is that changes in the input DC bus voltage can be converted to the voltage changes on the charger’s transmitter coil. Because the transmitter coil not only transmits power to the devices under charging but also transmits or receives data via in-band frequency or amplitude modulations, this effect has a straightforward impact not only on the power transmitted but also on the data exchanged with the device under charging. Exploiting this vulnerability, VoltSchemer can trick a charger into transferring power to metallic foreign objects, igniting or destroying nearby objects using extensively high temperatures. Besides, VoltSchemer can also manipulate a wireless charger to emanate an amplitude-modulated strong magnetic field, which can further inject inaudible voice commands into the voice assistant in a device under charging.

Attack Design

Inaudible Voice Command Injections

Activate Siri

Wake Up Voice Assistant on iOS

Activate Google Assistant

Wake Up Voice Assistant on Android

FOD / [Foreign Object Destruction]

Binder Clips (heatmap, max > 536°F)

Binder Clips (burn mark)

Paper Clips (heatmap, max > 536°F)

Paper Clips (burn mark)

Copper Foil (heatmap, max 490°F)

Copper Foil (burn mark)

Keys (heatmap, max 469°F)

Keys (burn mark)

Key Rings (heatmap, max 426°F)

Key Rings (burn mark)

Coins (heatmap, max 400°F)

Coins (burn mark)

NFC Cards (heatmap, max 291°F)

NFC Cards (burn mark)