Slashdot Mirror
Malware Can Use Fan Noise To Steal Data From Air-Gapped Systems (helpnetsecurity.com)
Reader Orome1 writes: For the last few years, researchers from Ben-Gurion University of the Negev have been testing up new ways to exfiltrate data from air-gapped computers: via mobile phones, using radio frequencies ("AirHopper"); using heat ("BitWhisper"), using rogue software ("GSMem") that modulates and transmits electromagnetic signals at cellular frequencies. The latest version of the data-exfiltration attack against air-gapped computers involves the machine's fans. Dubbed "Fansmitter," the attack can come handy when the computer does not have speakers, and so attackers can't use acoustic channels to get the info.An anonymous reader adds:Malicious applications use the noise emanated by a computer fan's speed to relay information to a nearby recording device and steal data from air-gapped, isolated systems. The attack relies on selecting a fan speed to represent binary "1" and another for binary "0". A specially crafted malware can alter the CPU, GPU or chassis fan speed between these two frequencies and provide a method to relay data from infected systems. Attackers can then place microphones or smartphones to record the sound coming from the infected machine and steal the data. The attack works for distances of one to four meters, and operates in the 100-600 Hz frequency that can be picked up by the human year. Choosing smaller fan speeds or fan speeds that are closer together can make the attack harder to pick up by a human, but also makes it susceptible to background noise.
Pretty neat idea but in every air-gapped environment I've worked in, getting the cellphone or recording device in would be the more difficult portion of this exercise.
Solving Unix problems since 1989...
Quote: "The attack works for distances of one to four meters..."
If you can get so close to the machine, then there are better ways of getting data off it.
They achieved a speed of 15 bits per minute, so a long time is needed for an attack
Oh wait, nevermind.
Anyone got some chalk and slate?
Captcha: laughs
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Is it April 1st again?
In the early 1980's one of my neighbors, a Honeywell employee, warned me that people could tell what I was printing out on my daisy-wheel printer just by listening through my open window. Apparently, each character of the Diablo 630 printer made a unique noise when struck.
As I was only printing teaching instructions for using the accounting software I trained users on, I thanked him kindly for the warning and carried on.
"The ferrets, they're every where I tell you!"
your favorite 3-letter agency
Air-gapped systems are usually justified in order to protect the information that said "3-letter agency" wishes to keep secure.
Let's not confuse civilian monitoring with government systems, since your average social media addict doesn't even understand the concept of a gapped system.
Just thinking of all the computer devices that I have at home:
2 laptops: fans are so quiet you'd have to have the microphone next to the vent to hear it
cellphones and tablets: no fans
server: If you can hear the two cpu fans over the 9 jet engine fans for the power supplies and disk arrays running at full speed 100% of the time, you can have my data.
computer 1: passively cooled
computer 2: Just has a large pretty silent 12V constant speed CPU fan
Sounds like a load of hot air to me
Didn't I hear "15 bits per minute" somewhere? You could transmit it faster by drum signal; it is probably more like smoke-sginals.
Put up a couple of USB fans around your computer to keep you cool and to confuse the enemy.
To suggest that malware can use fans to 'steal' data would imply that the data is being taken FROM an airgapped system by something outside it.
In fact, what it's talking about is that malware installed on an airgapped system can use the fan system to COMMUNICATE data across an air gap. Still interesting, but a little more honest about what's going on.
-Styopa
These days there seems to be no such thing as a gapped system. So far I've heard of... Using the RFI/EMI of keyboards and/or displays to spy, using built-in speakers/microphones for ultrasonic networking, new hardware being intercepted in transit having govt spyware/hardware installed before the customer gets it, USB devices including cables, picture frames, chargers, dongles having spyware/malware, etc. The only way to be sure is by not turning it on.
There are plenty of ways to mitigate the risks today.
20 years ago I was lugging around PC chassis and monitors that weighed in excess of 50 pounds. Because the damn thing was wrapped in a TEMPEST-certified case. Quite literally lead-lined. Excess crap like speakers and microphones are unnecessary in 99.999% of air-gapped environments.
This, along with getting back to using traditional wired connections for shit like keyboards, would tend to mitigate a lot of the risk we face today. COTS adaptation was perhaps the worst thing we could have done when it comes to air-gapped environments.
Air gapping machines is not effective.
Why? Because as soon as you air gap a machine, you need humans to ferry the data back and forth.
Now humans can exploited to be the exflitration path.
If you had a wire, you could control the protocol on the wire, put in overlapping constraints on traffic on the wire, and keep the humans out of the room.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Or, you know, they could use the hard drive LED to blink out the information they want to extract in Morse code with the cell phone camera set to record the transmitted data. I mean, holy crap, at some point this all becomes a little ridiculous.
licet differant, aequabitur
Isn't this trivial? Speed up fan for 1. Slow down for 0. Not only trivial, but poorly performing, because of the fan's inertia. Why not use the motherboard beep instead?
I solved this by just removing the fan from my computer, and I r$7mend* th(sssss solu#on fssst - jfha^fk lif4gkmv6n-3g ssssssssss
Just cruising through this digital world at 33 1/3 rpm...
If I'm reading this right (no I didn't RTFA) the malware can send out info. But it doesn't know if the info is being picked up or not. It can't answer questions from it's masters or anything like that.
So, I won't say it has no uses for spies, but it's kind of limited.
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
Enough to get the users name, pw, search terms, full project name out.
A lot of complex work starts the day with a log in and an internal keyword search, folder names, database location.
Not every cleared staff member is typing in a book chapter of data as part of their normal work load.
Domestic spying is now "Benign Information Gathering"
run all the machines in a vacuum.
Star Trek transporters are just 3d printers.
"[...] that can be picked up by the human year." I think they meant ear?
yuge mistake.
Star Trek transporters are just 3d printers.
Sounds like this is only useful if the computer is already compromised and has this special "fan-signal" malware on it. If you've already got malware on your isolated system, it sounds like you've already got other problems.
yeah; the secure system has to be infected with the malware, and you have to be close enough to it to pick up the sound of the fan very precisely and decode it. if you're going to all that trouble, might as well have the infected system just read the damn data out to you over the speaker.
Star Trek transporters are just 3d printers.
Because a system with disabled USB mass storage, a DVD ROM drive, and no network connection, would be ignored by most IT/security people as not having a data ex filtration risk. It can get data onto it, but not off, so the security people would probably think "Even if someone gets malware onto it, it can't send data off it, because there's no way to do it. They can't even burn a DVD."
Getting the malware on it would probably be easier than getting data off it in some mass storage kind of way.
our data warehouse is very secure. tons of data gong in but nobody can get anything out of it no matter how hard we try.
Star Trek transporters are just 3d printers.
Xenophobes have destroyed the UK. Scotland will leave to join the EU. We're not going to let our hate-fueled Trump supporters do the same in America.
good news for all of us americans who used to think british were on the average more intelligent just cause they talk good.
Star Trek transporters are just 3d printers.
Let's take back Murica like the British people did with their country last night!
get the US out of the EU!!!
Star Trek transporters are just 3d printers.
Until the cleaning people throw it out the evening after it was installed.
Or in other words: you don't even need physical access to retrieve the recorder.
Or find a believable excuse when you're spotted rummaging through the above-mentionned trashcan.
You only need to throw garbage (drop a new empty recorder) once in a while in the trash,
and count on the cleaning staff to unknowingly "retrieve" it for you.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]