Most batteries in today’s smartphones are intelligent enough to detect how people use their phones and employ power-saving technologies that result in longer battery life. That advantage sounds excellent all around, but recent research suggests those smart batteries could be used by hackers to learn about smartphone users.
An Easily Orchestrated Hack
The researchers who authored a paper on the subject of smartphone batteries capable of spying on people pointed out that this hack would be quick to implement and difficult to detect. They say smartphone owners may even participate in helping the hacks happen by installing malicious batteries themselves.
It could happen in a scenario where a hacker sets up an online store and entices users with promises of extra-long battery life and low prices, sends a purchaser the battery and waits for it to become installed on the phone to begin the tracking segment of the hack.
Plus, the battery could be capable of continuous monitoring, giving hackers the opportunity to see almost all the things the targets do with their phones, whether that’s browsing the internet, typing on the phone’s keyboard or receiving calls.
Also, if the battery had a DRAM or GPU power tracer inside it, a hacker could tell which websites people visit by using an artificial intelligence algorithm that matches power flows to particular keystrokes.
They could then make certain inferences about individuals’ behaviors. For example, if a person frequently visited websites about Orlando, Florida, and then began looking at flight routes, it makes sense they’re probably planning a trip to that city.
The hacked battery would include an activity detector, too, that could tell when a person started using the phone, then proceed to filter the respective activities.
Potential Challenges for Hackers
Although the hack is undoubtedly dangerous once the battery gets into a phone, the researchers also explored the obstacles hackers could encounter in the preliminary stages. For example, they must fit the power tracer and the processing device that retrieves and sends the data inside the battery.
Plus, the battery cannot be overly dense or have other characteristics that might lead someone to believe it has additional parts. That’s especially important if a person buys one of the altered batteries to replace it with the factory-installed version and can immediately compare the two.
See: Your Smartphone and Laptop Battery Invading Your Privacy
Since today’s phones feature increasingly slim, light batteries, the possibility of people becoming suspicious of something being amiss with the batteries before installation could go up.
The process of extracting the data from the battery is also an obstacle for cybercriminals to contend with. The researchers say that although an out-of-band transmitter with Wi-Fi could send data to the hackers, it would also be conspicuous on the battery.
The other option is to change the output voltage and the current of the battery to make it communicate with an app that’s on the phone and send information to hackers through an indirect route.
However, if people didn’t notice something strange about the battery, the presence of an unfamiliar app on their phones may raise the alarm.
Furthermore, once they have the data, hackers would have to devise ways to figure out what information is most valuable to them. Because this hack involves continuous monitoring, it’s likely that it’d generate a significant amount of data that’s not valuable.
Is This a Major Concern?
The researchers conducted several tests using popular phones and doctored batteries. They achieved a 65 percent accuracy rate when detecting websites people visited and had total success when determining if people made phone calls.
However, while discussing their paper, the authors clarified that because this hack requires physical battery replacement before or after purchase, it doesn’t represent a “sky is falling” scenario. It’s also not something hackers have already done.
Nevertheless, it’s a significant study because it shows what’s possible and details how much information hackers could get through continuous monitoring.
Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.