Hack Air-Gapped Computers Using Heat

An anonymous reader writes Ben-Gurion University of the Negev (BGU) researchers have discovered a new method to breach air-gapped computer systems called "BitWhisper," which enables two-way communications between adjacent, unconnected PC computers using heat. BitWhisper bridges the air-gap between the two computers, approximately 15 inches apart that are infected with malware by using their heat emissions and built-in thermal sensors to communicate. It establishes a covert, bi-directional channel by emitting heat from one PC to the other in a controlled manner. Also at Wired.

Comments

Skynet foiled by ceiling fan

[Crashmarik]

Film at 11:00

goddamnit!!!

[Anonymous Coward]

they didn't "hack" the machine using heat!

they gained control of both machines ahead of time, and THEN used heat (etc) to exfil data.

they didn't gain control of an otherwise stock computer using heat over air gap. stop saying "hack".

Re:goddamnit!!!

[Lumpy]

Just like the "hack using computer speakers" just install this malware first...

It's an interesting out of band communications process, a very very VERY slow one... but still interesting.

Re:goddamnit!!!

[bondsbw]

This technique re-establishes communication which provides a mechanism for a malicious user to regain control. It could be used to load new malicious software, download sensitive data, and establish a proxy into other disconnected internal systems.

So I fail to care about which term is used, it is a security breach and one of the worst kind... the kind where you think you're completely safe, but you still aren't.

Re:goddamnit!!!

[Sique]

They used heat as an attack vector by creating a covered channel. It is not an attack vector to gain access, it's an attack vector to siphon data.

Re:goddamnit!!!

[LordLimecat]

So I fail to care about which term is used, it is a security breach and one of the worst kind

Except it will only work in the most esoteric scenarios with laboratory conditions, sure. 2 PCs, with side-vent cooling and no cold aisle, and a distance of 15 inches?

Somehow I dont think this will threaten air-gapped secure networks. Those are going to have steady cold air coming in the front, and exhausting out the back; if theyre dumping significant heat through the side of the cases you're doing it wrong.

Re:goddamnit!!!

[Wrath0fb0b]

they didn't "hack" the machine using heat!

they gained control of both machines ahead of time, and THEN used heat (etc) to exfil data.

they didn't gain control of an otherwise stock computer using heat over air gap. stop saying "hack".

I'm afraid you don't understand the meaning of the word "hack" in this context. It does not always mean "gain control/privileges on a computer system in excess of your authorization". In this context, it means "defeat a method used to guarantee a particular security property".

Property: No control/data flow shall pass from the outside world into this computer
Method: Air-gapping that computer
Hack: Defeating that property and passing data between the machines

Let me give you another example.

Property: Computers in different classrooms shall not be able to talk directly to each other despite being on the same physical network
Method: Assign each classroom a VLAN and enforce that at the switch
Hack: By Double tagging certain ethernet frames you can defeat the property.

Now you are going to sperg because no one gained control of anything (even the switch). But of course it's still a hack -- you have shown that the switch + VLAN configuration is not capable (in its current configuration) of providing that guaranteed property of non-communciation between VLANs. In some sense this is actually a more elegant hack than taking control of the switch for obvious reasons.

TL;DR Version: "Hack" means to gain advantage or defeat a security property. Sometimes that involves traditional exploits/privilege escalation, other times it involves other methods.

Re:goddamnit!!!

[wonkey_monkey]

If anything, then, I'd say they've hacked the air gap, not the computers.

Re:goddamnit!!!

[BradleyUffner]

Which step is it that installs the customized thermal sensors?

Step 2: Drop some customized thermal sensors.

Re:goddamnit!!!

[Anonymous Coward]

Exploits only ever get better. That's threat analysis 101. And you've provided no evidence or analysis why you're supposed mitigations are an insurmountable defense; at best they're only a stop-gap.

This is a proof of concept. And a pretty cool proof of concept. The idea of using a side channel like this isn't that novel (RSA key cracks via CPU acoustics was shown years ago), but just think of the all the little problems you'd have to solve to execute the concept. It's pretty awesome work.

Re:goddamnit!!!

[bondsbw]

Wow, please pay attention.

read:

I never stated that no other security breach already existed, but that a new one is being added.

Consider this scenario: government systems, one computer is internet facing, the other computer is completely isolated. Joe Badguy installs each computer before they are put into real use, and adds the exploit to each. The government beefs up physical security, then enables the internal system confident that data added to it cannot leave. But sometime later, Joe Badguy connects to the internet facing computer, then extracts new data from the isolated computer via the exploit.

Maybe now you understand the difference between real security, which can exist in layers and multiple forms simultaneously, and simplistic considerations like BOs.

mov eax, $phantomfive_understands
cmp eax, 0x1
jne read

Re:goddamnit!!!

[LordLimecat]

And you've provided no evidence or analysis why you're supposed mitigations are an insurmountable defense; at best they're only a stop-gap.

In THEORY breaking most encryption is just guessing the right 2048-bit code. At best, increasing the length from 1024 to 2048 is just a stopgap.

In reality, some attacks are so esoteric and hard to pull off (famous example: hard drive magnetic domain remnant detection) that they are not a real-world threat. MAYBE they could adapt this, but it already requires
A) a machine connected to the internet that is compromised (!)
B) an AIR-GAPPED, high-security machine directly adjacent to it (!!!)
C) That that air-gapped machine be compromised as well (!!!!!)
D) Sensors in both machines sensitive enough to detect incredibly minor fluctuations in temperature (given that a steady stream of air will be flowing through)

The proper security procedure is to analyze the chance of the risk, the annualized loss expectancy, etc, and then come up with mitigations. Ok, let me give this a shot.
1) DONT GET YOUR AIRGAPPED MACHINE INFECTED
2) probably dont stick it directly adjacent to non-airgapped machines

Sure, great, new comms channel

[OzPeter]

But how did the malware get on BOTH of the computers in the first place? TFA totally avoids that question.

Re:Sure, great, new comms channel

[GerardAtJob]

I don't know, but one thing is sure, you need to be patient in order to use/exploit this thing... From Article : The time it took them to increase the heat and transmit a “1” varied between three and 20 minutes depending. The time to restore the system to normal temperature and transmit a “0” usually took longer.

Re:Sure, great, new comms channel

[Thanshin]

The time it took them to increase the heat and transmit a 1 varied between three and 20 minute

So, somewhere between Comcast's Standard and High Speed plans.

Re:Sure, great, new comms channel

[fuzzyfuzzyfungus]

But how did the malware get on BOTH of the computers in the first place? TFA totally avoids that question.

TFA was either unclear or misrepresented: This technique is purely a demonstration of a sneaky covert channel implementation that requires only hardware likely to be present and functioning even on aggressively air-gapped systems. Actually getting the malware in place to use the covert channel is somebody else's problem, so TFA doesn't address it.

Re:Sure, great, new comms channel

[fuzzyfuzzyfungus]

Not quite; you can transfer at full speed for the whole month without being throttled or paying overage fees...

Re:Sure, great, new comms channel

[Lumpy]

No it doesnt defeat any security. It requires both machine to be pre infected to begin with, and the data rate is less than 1 bit per minute.

Re:Sure, great, new comms channel

[fuzzyfuzzyfungus]

It would be an atrocious choice for exfiltrating most types of data, even a couple of pages of 'sensitive_memo.doc' would take ages; but there are some cryptographic private keys that I'd be more than willing to wait a month or two for...

Re:Sure, great, new comms channel

[StikyPad]

Speak for yourse
NO CARRIER

Nothing new here

[Anonymous Coward]

Governments and business have been doing this for centuries, communicating by nothing more than hot air.

Next step - embed it in a chip

[Crookdotter]

With chips being so complicated these days, who audits them all? What's to stop a manufacturer being exploited and this kind of malware being as standard in a lot of silicon? However, if that's the case then a more traditional attack would be warranted - the data rate here is awful.

Zalewalski shit

[bluefoxlucid]

This is totally Zalewalski shit.

Wireless technology

[sreever]

So, can I use a space heater to extend the range of this new wireless technology?

Re:Bad Title

[pjt33]

Stenography is typing. You mean steganography. But even that is missing the point, which is one thing the title does get right: air-gapped. There's not supposed to be any communications channel at all between the two computers, but this technique creates one.

Finally, malware that gives computers a fever.

[Ihlosi]

Now all those viruses can finally give your computer proper disease symptoms.

Re:The larger problem is

[gstoddart]

And how did Stuxnet spread?

In some cases, by exploiting removable media.

If you think there's no precedent for getting the infection onto the machine, you're horribly mistaken.

Re:Nonsense

[gnupun]

Is it TCP/IP over hot air? If so, who installed the server software on the air-gapped PC?