ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago
Florian Draschbacher, Lukas Maar, Mathias Oberhuber, Stefan Mangard
USENIX Security Symposium 2025
Artifacts evaluated: Available
CVE-2024-20900, CVE-2024-43085
Info
BibTex
Zenodo
Black Hat Asia
In this paper, we introduce ChoiceJacking, a novel USB-based attack exploiting the flawed assumption
that attackers cannot inject input events during data connection establishment. Our platform-agnostic
attack enables a malicious charger to spoof user input, enabling data transfer on Android and iOS.
Testing across devices from 8 vendors reveals critical USB security flaws, allowing sensitive file
access, even from locked devices in some cases.
@inproceedings{Draschbacher2025ChoiceJacking,
author = {Florian Draschbacher and Lukas Maar and Mathias Oberhuber and Stefan Mangard},
booktitle = {{USENIX Security}},
title = {{ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago}},
year = {2025}
}