Slashdot Mirror
Acoustic Attacks on HDDs Can Sabotage PCs, CCTV Systems, ATMs, More (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: Attackers can use sound waves to interfere with a hard drive's normal mode of operation, creating a temporary or permanent denial of state (DoS) that could be used to prevent CCTV systems from recording video footage or freeze computers dealing with critical operations. The basic principle behind this attack is that sound waves introduce mechanical vibrations into an HDD's data-storage platters. If the sound is played at a specific frequency, it creates a resonance effect that amplifies the vibration effect. Because hard drives store vasts amounts of information inside small areas of each platter, they are programmed to stop all read/write operations during the time a platter vibrates so to avoid scratching storage disks and permanently damaging an HDD. Last week, scientists from the Princeton and Purdue universities published new research into the topic, expanding on the previous findings with the results of additional practical tests. The research team used a specially crafted test rig to blast audio waves at a hard drive from different angles, recording results to determine the sound frequency, attack time, distance from the hard drive, and sound wave angle at which the HDD stopped working.
Step 1 - record to SSD
Step 2 - move to spinning storage (this does not even have to be onsite where the attack is possible)
Pretty simple way to harden it would seem.
Silence is a state of mime.
Sound waves cause vibrations!
News at 11.
paid for by SSD markers buy now before prices go up to cover our court fees!
but how practical is this? If you're in close enough to blast the HDDs, you're in close enough to do a lot more than that.
"I don't know, therefore Aliens" Wafflebox1
From the paper:
We assume that the attacker can generate acoustic signals in the vicinity of the victim device, at frequencies within the audible range (2 - 20 kHz). The attacker can either apply the signal by using an external speaker or exploit a speaker near the target.
In order to get near the HD the attacker will likely have to pass in front of one or more of the security cameras that are streaming to the HD they're looking to interrupt, which means there will still be footage of them . And if they can get that close to the HD they can just physical destroy it anyway.
From TFA
There's little chance of seeing the mass exploitation of real-world devices using acoustic attacks on hard drives, as such scenario is likely impractical due to the multiple criteria an attacker needs to satisfy.
Nonetheless, acoustic attacks are inherently suitable for targeted attacks against carefully selected critical systems. For example, acoustic attacks can help nation-state sponsored attacks, aid with physical intrusions into secure systems, corrupt or sabotage forensics collection, or even cause loss of human life when attacking HDDs used by medical devices.
So once again you need physical access in order to perform this "exploit". In which case all bets are off anyway.
And the whole ATM thing is just TFA author's wishful thinking, and has nothing to do with the actual research paper.
Just to explore a scenario not included in the research paper, an ATM malware gang can deploy an acoustic attack on an ATM to prevent it from temporarily collecting forensic evidence while fileless malware executes in the ATM's RAM and dispenses cash to attackers. This scenario and many more others exist.
I am Slashdot. Are you Slashdot as well?
Researchers have proven that Large Hammers can disable power supplies. Power supplies are integral parts of PCs, Security Systems, and Nuclear Power Plant control equipment.
I would assume that your company would have enough physical security to not just let any clown enter your data center...
I'm reminded a $2 laser pointer aimed at the camera is much more effectkve.
If you want to spend more money, you can use a high power laser pointer and burn out the camera sensor.