Building An Evil Phone Charging Station

The talk starts from public charging points in airports, hotels and lounges, where a phone plugged into a port may send more than power. USB-C alternative modes can carry a display signal, and some phones also accept keyboard and Ethernet input over the same connection. The speaker, a red team member at a telecom operator, explains how a phone, a capture adapter and a laptop can be combined into a working setup that shows a phone's screen while it charges.

The team then tested many phone models bought in stores to see what appears on the mirrored display. Most showed notifications, two-factor codes, and PIN or password entry in plain view, with only small warnings. iPhones hid some input and used smaller notices, while Android devices showed keystrokes. A prototype split the captured video into frames, detected changes that matched typing, and ran Tesseract OCR on keyword-defined regions to rebuild passwords letter by letter. The speaker acknowledged OCR mistakes and the heavy processing needed for real-time use across several devices.

The main takeaway is that phone makers and app developers should warn users when screen mirroring starts during charging and protect sensitive fields. The speaker also suggested workplace docking stations as a possible target and noted that the code is publicly available. The question round covered iOS keyboard hiding and whether app window flags stop capture.