Bad Battery: Accessing Data and Injecting Malware into Android Devices Nathalie Domingo Graduate Mentors: Kelvin Ly, kaveh shamsi, and Orlando arias Faculty Mentors: Dr. Shaojie Zhang and Dr. Yier jin

Introduction Goal: Create a device that can be disguised as a portable power bank that hacks phones Focus on Android phones iOS is more secure iOS has already been hacked through a malicious charger

Project Explanation Used a raspberry pi, that will be hidden inside a portable power bank, to exploit the access given to Android phones through USB connection Data Access Attack: copy specified folder off of the phone and send folder to a designated email address Malware Injection Attack: install a malicious app onto the user’s phone NSF REU Research Experience on the Internet of Things 2016

Malware Injection Attack Results Data Access Attack Malware Injection Attack Allow USB Computer Connection From Pop-Up MTP Enabled RSA Authentication USB Debugging PTP Enabled Nexus One—Android Version 2.3.6  Motorola Moto G—Android Version 4.4.4 Samsung Galaxy S5—Android Version 6.0.1

Importance Makes people aware of the potentially malicious devices available Highlights the security flaws in Android security, which can be prevented by users