Slashdot Mirror
New Air-Gap Jumper Covertly Transmits Data in Hard-Drive Sounds (arstechnica.com)
Security researchers have found a new way to siphon data out of an infected computer even when it has been physically disconnected from the Internet -- otherwise known as "air-gap" computers -- to prevent the leakage of sensitive information it stores, reports ArsTechnica. From the article: The method has been dubbed "DiskFiltration" by its creators because it uses acoustic signals emitted from the hard drive of the air-gapped computer being targeted. It works by manipulating the movements of the hard drive's actuator, which is the mechanical arm that accesses specific parts of a disk platter so heads attached to the actuator can read or write data. By using so-called seek operations that move the actuator in very specific ways, it can generate sounds that transfer passwords, cryptographic keys, and other sensitive data stored on the computer to a nearby microphone. The technique has a range of six feet and a speed of 180 bits per minute, fast enough to steal a 4,096-bit key in about 25 minutes.
Considering that people play music with floppy drives then the ability to transfer information acoustically with hard drives isn't really different.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Nice theoretical attack, but in practise a HD that makes sounds like this is easy to spot. Just listen.
I remember fondly the drives for the C64 that made music, though.
This is some serious "Jason Bourne" hoop-jumping technology.
Exactly how are you planning on getting the malware onto the machine genius? This shit is getting ridiculous.
Of course, if I am allowed to install software on an "air-gapped" computer, I can make it transfer information by anything on it that makes noise or can be lit or even via power supply. Speakers, various fans, hard drive heads, retractable optical drive tray, locator blue LED, LCD display, even the power draw....I can manipulate all of those.
There is no point to these studies, they only belabor the obvious.
Any manager that makes some security policy based on such studies should be beaten.
Speaking as someone who performs even the most simple everyday tasks by way of giant machines that invariably incorporate a bowling ball, a funnel, a teakettle, a feather duster, my uncle sleeping in an armchair, and a live hen, this attack vector seems very relevant and concerning to me.
Play clicky-clacky-white noise in your server room to confuse any microphone.
"That's the way to do it" - Punch
Wont work with my SSD. and honestly will not work at all on SAS drives. most places that are serious about their computing and security uses thin clients running SSD boot drives and the rack of servers are all the workstations. good luck recording the drive noises with all those fans and the libert unit running.
It may work if a target's cheap laptop is set on top of the microphone.
Do not look at laser with remaining good eye.
'Honest boss, I was sure the computer was secure! How was I to know the high sensitivity microphone pointed at it a few feet away, with a wire running out to the van outside and the stranger asking us to all be very VERY quiet for the next hour was a problem?'
Yes, this 'research' is pure stupidity because the methods are obvious as well as being easily mitigated if you really NEED security.
Although its not quite as stupid as the actually false and incorrect claim of using pixels to an infiltrated monitor was, which was basically all just a scam (there are NOT several x86 cpus in a monitor, the cpu that is sometimes there CANNOT read individual pixels, and you CANNOT infect them without a usb connection to the monitor).
Not to mention the obvious workaround, USE A SSD. sigh.
Well, very interesting were it not for the prevalence of solid-state disks with, oh, the horror, neither plates nor mechanical arms to produce sound with.
for solid state drives. They are completely quiet.
You had me at gwar.
Website Just Down For Me? Find out
https://www.youtube.com/watch?...
Interesting proof-of-concept, but ridiculously impractical in the real world.
Just cruising through this digital world at 33 1/3 rpm...
Penetrating networks airgapped from the internet is difficult, and this novel technique is interesting. But, in the real world, dropping a few thumb drives with malware in the parking lots or getting people to listen/watch music CD/movie DVDs with a malware payload seems to have been very effective. Bribing a janitor to plug in a thumbdrive in an exposed usb port of a computer is a lot easier.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I would suspect the vast majority of computers that would be targeted would not have speakers. They're not going to be playing music or youtube videos on an air-gapped computer. Playing on a speaker is pointless.
This method of listening to hard drive reminds me of old spy techniques I've read about such as:
a) recording the sound a printer makes and using it to determine what was printed.
b) by pointing a laser at a window you can "listen" to what is going on inside by tracking how much the window flexes with vibrations.
"That's the way to do it" - Punch
We have dozens of 3.5" drives running in multiple arrays at various RAID levels, in a noisy server room with fans continually blasting over 70 db in the background. This trick might work in a lab, but call me when they've got the same attack vector working in a real data center environment. And, oh yeah, and against near-silent SSDs.
What if the target computer only has an SSD? What if it has multiple hard drives?
Ya, but can it play Bohemian Rhapsody?
If you are air-gapped for security reasons, you are also aware of other ways to exfiltrate information through the environment and through personnel and are taking precautions appropriate for your situation.
If you aren't, you are doing it wrong.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If the computer has a RAID array will this work and will the throughput be faster ? ;-)
love is just extroverted narcissism
Interestingly enough... we have one overloaded UPS so when we RDPed into it the UPS sounded its alarm. It would be really slow but you could definitely hear the UPS alarm over the 20 servers. Just increase the power draw on 10 servers you don't mind shortening the life of to overload a UPS. I bet people don't think to secure their UPS and leave it on "Default" to sound an audio alarm. One more attack vector.
That being said the best advice I ever read was that there are two kinds of attackers "Mossad and Not-Mossad" "If it's mossad, you're screwed no matter what they'll find a way in." All security is really to stop Not-Mossad. That's true of physical security, digital security, information security whatever... if Mossad wants you dead you'll die. If the CIA wants into your database they'll get in. All you can really hope to stop is a guy in Bulgaria acting alone.