Malware Can Steal Data From Air-Gapped Devices via Fans

ronjor · Jun 24, 2016

By Eduard Kovacs on June 24, 2016
Acoustic data exfiltration is possible from air-gapped computers even if they don’t have any speakers. Researchers have demonstrated that data can be stolen using fans and a mobile phone placed in the vicinity of the targeted machine.
Click to expand...

http://www.securityweek.com/malware-can-steal-data-air-gapped-devices-fans9

lotuseclat79 · Jun 28, 2016

Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers (PDF download webpage)

Because computers may contain or interact with sensitive information, they are often air-gapped and in this way kept isolated and disconnected from the Internet. In recent years the ability of malware to communicate over an air-gap by transmitting sonic and ultrasonic signals from a computer speaker to a nearby receiver has been shown. In order to eliminate such acoustic channels, current best practice recommends the elimination of speakers (internal or external) in secure computers, thereby creating a so-called 'audio-gap'. In this paper, we present Fansmitter, a malware that can acoustically exfiltrate data from air-gapped computers, even when audio hardware and speakers are not present. Our method utilizes the noise emitted from the CPU and chassis fans which are present in virtually every computer today. We show that a software can regulate the internal fans' speed in order to control the acoustic waveform emitted from a computer. Binary data can be modulated and transmitted over these audio signals to a remote microphone (e.g., on a nearby mobile phone). We present Fansmitter's design considerations, including acoustic signature analysis, data modulation, and data transmission. We also evaluate the acoustic channel, present our results, and discuss countermeasures. Using our method we successfully transmitted data from air-gapped computer without audio hardware, to a smartphone receiver in the same room. We demonstrated the effective transmission of encryption keys and passwords from a distance of zero to eight meters, with bit rate of up to 900 bits/hour. We show that our method can also be used to leak data from different types of IT equipment, embedded systems, and IoT devices that have no audio hardware, but contain fans of various types and sizes.
Click to expand...

Related: Fansmitter: malware that exfiltrates data from airgapped computers by varying the sound of their fans (w/Video)

In a new paper, researchers from Ben-Gurion University demonstrate a fiendishly clever procedure for getting data off of airgapped computers that have had their speakers removed to prevent acoustic data-transmission: instead of playing sound through the target computer's speakers, they attack its fans, varying their speeds to produce subtle sounds that humans can barely notice, but which nearby devices can pick up through their microphones.
Click to expand...

-- Tom

Log in or Sign up

Malware Can Steal Data From Air-Gapped Devices via Fans

ronjor Global Moderator

lotuseclat79 Registered Member

Log in or Sign up

Malware Can Steal Data From Air-Gapped Devices via Fans

ronjor Global Moderator

lotuseclat79 Registered Member

Useful Searches