Slashdot Mirror
New Air-Gap Jumper Covertly Transmits Data in Hard-Drive Sounds (arstechnica.com)
Security researchers have found a new way to siphon data out of an infected computer even when it has been physically disconnected from the Internet -- otherwise known as "air-gap" computers -- to prevent the leakage of sensitive information it stores, reports ArsTechnica. From the article: The method has been dubbed "DiskFiltration" by its creators because it uses acoustic signals emitted from the hard drive of the air-gapped computer being targeted. It works by manipulating the movements of the hard drive's actuator, which is the mechanical arm that accesses specific parts of a disk platter so heads attached to the actuator can read or write data. By using so-called seek operations that move the actuator in very specific ways, it can generate sounds that transfer passwords, cryptographic keys, and other sensitive data stored on the computer to a nearby microphone. The technique has a range of six feet and a speed of 180 bits per minute, fast enough to steal a 4,096-bit key in about 25 minutes.
Considering that people play music with floppy drives then the ability to transfer information acoustically with hard drives isn't really different.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Nice theoretical attack, but in practise a HD that makes sounds like this is easy to spot. Just listen.
I remember fondly the drives for the C64 that made music, though.
This is some serious "Jason Bourne" hoop-jumping technology.
Exactly how are you planning on getting the malware onto the machine genius? This shit is getting ridiculous.
Of course, if I am allowed to install software on an "air-gapped" computer, I can make it transfer information by anything on it that makes noise or can be lit or even via power supply. Speakers, various fans, hard drive heads, retractable optical drive tray, locator blue LED, LCD display, even the power draw....I can manipulate all of those.
There is no point to these studies, they only belabor the obvious.
Any manager that makes some security policy based on such studies should be beaten.
Speaking as someone who performs even the most simple everyday tasks by way of giant machines that invariably incorporate a bowling ball, a funnel, a teakettle, a feather duster, my uncle sleeping in an armchair, and a live hen, this attack vector seems very relevant and concerning to me.
just saying.
so.. all you need to do is look out for the guy with the parabolic microphone pointed at your computer, standing.. six feet away.
via hard drive chatter?
Play clicky-clacky-white noise in your server room to confuse any microphone.
"That's the way to do it" - Punch
Wont work with my SSD. and honestly will not work at all on SAS drives. most places that are serious about their computing and security uses thin clients running SSD boot drives and the rack of servers are all the workstations. good luck recording the drive noises with all those fans and the libert unit running.
It may work if a target's cheap laptop is set on top of the microphone.
Do not look at laser with remaining good eye.
'Honest boss, I was sure the computer was secure! How was I to know the high sensitivity microphone pointed at it a few feet away, with a wire running out to the van outside and the stranger asking us to all be very VERY quiet for the next hour was a problem?'
Yes, this 'research' is pure stupidity because the methods are obvious as well as being easily mitigated if you really NEED security.
Although its not quite as stupid as the actually false and incorrect claim of using pixels to an infiltrated monitor was, which was basically all just a scam (there are NOT several x86 cpus in a monitor, the cpu that is sometimes there CANNOT read individual pixels, and you CANNOT infect them without a usb connection to the monitor).
Not to mention the obvious workaround, USE A SSD. sigh.
Well, very interesting were it not for the prevalence of solid-state disks with, oh, the horror, neither plates nor mechanical arms to produce sound with.
for solid state drives. They are completely quiet.
If an infected system wants to transmit data to a nearby microphone, a much more straightforward way would be to do so via the computer's speaker, so the usefulness of this nifty trick is limited to systems that
(a) you managed to infect despite them being air-gapped;
(b) do not have a speaker that can be activated by the malware; and
(c) you can get a microphone physically close enough to to listen in on the hard drive noises.
And if you think speaker sounds are more likely to tip someone off than funny hard drive noises, it's pretty easy to generate high-frequency sounds inaudible to the human ear via the speaker.
https://www.youtube.com/watch?...
Interesting proof-of-concept, but ridiculously impractical in the real world.
Just cruising through this digital world at 33 1/3 rpm...
Penetrating networks airgapped from the internet is difficult, and this novel technique is interesting. But, in the real world, dropping a few thumb drives with malware in the parking lots or getting people to listen/watch music CD/movie DVDs with a malware payload seems to have been very effective. Bribing a janitor to plug in a thumbdrive in an exposed usb port of a computer is a lot easier.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
here's manishs and his dan goodin obsession... i will never understand why every article dan goodin posts ends up on slashdot... without being submitted by anyone
We have dozens of 3.5" drives running in multiple arrays at various RAID levels, in a noisy server room with fans continually blasting over 70 db in the background. This trick might work in a lab, but call me when they've got the same attack vector working in a real data center environment. And, oh yeah, and against near-silent SSDs.
Let's See:
Monitor i2c-ddc channel
Hard Drive Motors
Blinking Pixels
Caps Lock LED / Num Lock LED /
SMBUS Port
JTAG Port
PS/2 , USB Mouse Port
Sound Card High Frequency Noise
Blinking Network Card LED - Even Unconnected
Fan Speed Toggling
CPU "Noise" Analysis
JoyStick Port
MIDI Port
Hard Drive LED
Analysis: If I want the information, I can get it.
What if the target computer only has an SSD? What if it has multiple hard drives?
..but I love it for its crypto-weirdness. "a speed of 180 bits per minute, fast enough to steal a 4,096-bit key in about 25 minutes." Have fun with that.
The fans in my system dwarf the sounds from the HDD's!
Well, the more modern HDDs anyway.
I still have some Seagate Medallist and random Conner drives which clack so loud it sounds like they use stepper motors instead of voice-coil actuators...
So, you can install the malware on the air-gaped computer, meaning you can sneak in a usb drive or CD or some other attack vector, then you can get something with a microphone (like a cell phone) within 6 feet, and then you are going to wait a LONG time to extract even small amounts of data off said computer. Preposterous. USB drives, CDs and cell phones are typically not permitted in such places, and if you can get one in, why not just copy to it in the first place? It would be faster/easier to write down, take a picture of the screen with your cell phone, or even memorize the password or key you are trying to extract.
Ya, but can it play Bohemian Rhapsody?
If you are air-gapped for security reasons, you are also aware of other ways to exfiltrate information through the environment and through personnel and are taking precautions appropriate for your situation.
If you aren't, you are doing it wrong.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If the computer has a RAID array will this work and will the throughput be faster ? ;-)
love is just extroverted narcissism
Interestingly enough... we have one overloaded UPS so when we RDPed into it the UPS sounded its alarm. It would be really slow but you could definitely hear the UPS alarm over the 20 servers. Just increase the power draw on 10 servers you don't mind shortening the life of to overload a UPS. I bet people don't think to secure their UPS and leave it on "Default" to sound an audio alarm. One more attack vector.
That being said the best advice I ever read was that there are two kinds of attackers "Mossad and Not-Mossad" "If it's mossad, you're screwed no matter what they'll find a way in." All security is really to stop Not-Mossad. That's true of physical security, digital security, information security whatever... if Mossad wants you dead you'll die. If the CIA wants into your database they'll get in. All you can really hope to stop is a guy in Bulgaria acting alone.
"so-called seek operations"
Does that phrase annoy anyone else?
Nobody will ever use this, except the FBI hope to. Why though?
Old news