Qi2 Charging and Public Stations: Emerging Security Risks for Mobile Devices

The mobile industry's push toward more convenient charging solutions is introducing new attack vectors that cybersecurity professionals need to address. Two significant developments are converging to create potential security risks: the adoption of Qi2 wireless charging with magnetic alignment (as seen in Apple's MagSafe and reportedly coming to Google's Pixel 10) and sophisticated attacks targeting public charging stations.

Qi2 Security Considerations:
The Qi2 standard, while improving charging efficiency through magnetic alignment, introduces new hardware-level security questions. The magnetic interface could potentially be exploited for data exfiltration or as a physical attack vector. Security researchers are particularly concerned about:

• Magnetic interference attacks that could disrupt secure boot processes
• Potential for malicious charging accessories to bypass security protocols
• Increased risk of juice jacking through enhanced power delivery capabilities

Public Charging Threats:
A newly identified attack method called 'choicejacking' has emerged, targeting both iOS and Android devices during charging sessions. This technique:

1. Exploits charging negotiation protocols to present fake permission dialogs
2. Tricks users into granting excessive permissions to malicious charging stations
3. Can lead to data theft or malware installation while appearing as legitimate system prompts

Mitigation Strategies:
For enterprises:

• Implement MDM policies to restrict charging from untrusted sources
• Educate employees about charging station risks
• Consider providing secure charging stations in corporate environments

For individual users:

• Use AC power adapters instead of direct USB connections
• Carry portable power banks for emergency charging
• Enable 'USB Restricted Mode' on iOS or equivalent on Android

As charging technologies evolve, security considerations must keep pace. The convenience of magnetic alignment and fast charging shouldn't come at the expense of device security.