Slashdot Mirror
Data Exfiltrators Send Info Over PCs' Power Supply Cables (theregister.co.uk)
From a report on The Register: If you want your computer to be really secure, disconnect its power cable. So says Mordechai Guri and his team of side-channel sleuths at the Ben-Gurion University of the Negev. The crew have penned a paper titled PowerHammer: Exfiltrating Data from Air-Gapped Computers through Power Lines that explains how attackers could install malware that regulates CPU utilisation and creates fluctuations in the current flow that could modulate and encode data. The variations would be "propagated through the power lines" to the outside world.
Depending on the attacker's approach, data could be exfiltrated at between 10 and 1,000 bits-per-second. The higher speed would work if attackers can get at the cable connected to the computer's power supply. The slower speed works if attackers can only access a building's electrical services panel. The PowerHammer malware spikes the CPU utilisation by choosing cores that aren't currently in use by user operations (to make it less noticeable). Guri and his pals use frequency shift keying to encode data onto the line.
Depending on the attacker's approach, data could be exfiltrated at between 10 and 1,000 bits-per-second. The higher speed would work if attackers can get at the cable connected to the computer's power supply. The slower speed works if attackers can only access a building's electrical services panel. The PowerHammer malware spikes the CPU utilisation by choosing cores that aren't currently in use by user operations (to make it less noticeable). Guri and his pals use frequency shift keying to encode data onto the line.
Double-conversion UPS... the data stops there. There's your firewall.
Apple will fix this with $100 DRMed power cables.
years ago alienware had an $50+ upgraded power cable as an add on.
>> If you want your computer to be really secure, disconnect its power cable
Spoken like a true desktop security guru.
On my work machine our overzealous virus scanner settings have closed this security hole... the CPU is constantly pegged at 100% ensuring that the power can't fluctuate at all.
It also eliminated the need for a furnace in the building.
Hackers can get into your system no matter what!
I bet if we went back to abacuses, hackers would figure out how to decipher the clicks and know what you're doing.
"Damn! My abacus was hacked!"
"You moron! You should have used the anti-hacking felt on the beads. Geeze!"
And then a hacker would figure out how to hack the abacus by the felt dust that falls.
The paper describes a method of adding jank to applications which will cause users to frown and furrow their eyebrows, which in turn can be monitored by a high-def camera furtively installed on their monitor to communicate between 100 and 1337 bits per minute to attackers.
----
Honestly, who approves this research? I mean, yes, it's possible, but if your computer is "air-gapped" and the attackers have the ability to breath your air, you are already screwed.
Don't install malware
You insensitive clod! I run Windows.
Have gnu, will travel.
Or a laptop (even plugged in).
Have gnu, will travel.
This is obvious. Not obvious in hindsight but obvious as a fundamental well known security problem. It have been protected against in the past (filtering power lines to reduce or eliminate signal transmission). And it is _really_ old news, this was known and protected against before I was born.
The attacker needs to gain access to the server's power cord, or maybe the building's power panel then attach some dongle. Then they need to somehow gain access to a air gapped machine on a secure network in what is likely a secured facility. Once they do that, they then gain access to the server and install malware that will send semaphores by upping CPU use.
While an interesting laboratory experiment, I'm not really all that concerned. I do predict it showing up in the next Mission: Impossible installment, though
Have gnu, will travel.
No actual security expert is surprised this is possible. However, this is actually worthless in almost all circumstances. First, you have to be close enough that standard TEMPEST attacks should work a lot better. And second, this has a high risk of causing problems elsewhere and getting notices. And thirs, the data-rate is laughable and unsuitable for most attacks.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Depends on the filters. They will try to transmit power-spikes and those can get trough an inline-UPS as well to a degree. The whole thing is a worthless stunt anyways as you need to tap the power-line close by.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That's only 2000 hours to get 1MB of information...
So yeah... there might be faster, more efficient ways...
120 characters ought to be enough for anyone
It should read, "Researchers Send Info Over PCs' Power Supply Cables."
The Daddy casts sleep on the Baby. The Baby resists!
Generator + treadmill + Jack Russell Terrier + squirrel (or cat)
Probably depends on how the laptop's power circuitry is designed.
Basically there are two forms of battery backups. One form charges the batteries and keeps them charged but doesn't run the load through them unless a switchover event happens. The other form does run the load through the batteries because they cannot afford for the system to go down temporarily for such a switchover.
The former is the way that large UPSes that use lithium-ion batteries works, because lithium-ion batteries cannot sustain being in the circuit that way. That's why most UPSes still use SLA batteries. There are new UPSes coming out with a combination of SLA and Li-Ion though, where there's just enough SLA in the loop to keep the equipment running for the few moments it takes to bring up the Li-ion batteries.
If the laptop, while plugged in, runs on the corded power then it's probably subject to the same issues as the desktop computer.
Do not look into laser with remaining eye.
Congressman: Does Facebook exfiltorate data by regulating CPU utilization to create fluctuations in the current flow that could modulate and encode data, then propagate those variations through the power lines to the outside world?
Mr. Zuckerberg: Yes sir, but only for security purposes.
That might not be as difficult as you'd think. Commercial buildings have a lot of people coming and going doing maintenance, and most commercial buildings don't hide the basic electrical stuff inside of highly secured areas, they reserve such security for devices that are expensive, or devices that do something important, or for devices that have important information on them. For most buildings the vast majority of the power is for regular mundane things like lighting and HVAC, so the raw incoming power and any transformers are probably easily accessed with something as simple as a fake workorder presented to the receptionist in the lobby. Someone coming in that way might not be able to get access to the generator yard that keeps the datacenter up, but if the power supplying the generator yard and battery room is tappable to give this kind of info, or if they're attempting to get data off of a regular user's computer that isn't on the generator, then they may well be able to come in and install whatever they need to place in order to sample the power the way they need.
For all we know, equipment no more sensitive or expensive than a cheap clamp meter might do the trick, if they can find a way to transmit that data, but my guess is that this sort of thing would be limited to nation-states or to extremely high level corporate espionage, and probably would be above even groups like those that steal payment card info to get money.
Do not look into laser with remaining eye.
The vast majority of us are not sufficiently important or interesting to be worthy of such an attack.
I don't have or want a smartphone, and I don't go home at night and stare at a computer screen until I go to bed like I imagine you do. Shove it up your ass.
Random charge and discharge cycles for power line white noise generator.
I think we all knew this could be done in theory but someone actually went out and tried it and measured what the results were. They even came up with data rates. It should be noted also that they could still read the data above other noise on the power line. They used frequency shift keying to encode their data so that noise from some devices could be easily filtered out. Big things like a water heater or stove can be filtered out by amplitude, inductive things like air compressors or pool pumps are also easy to filter out, it's small things in the 30watt range that are switching on and off that would be a problem but there aren't many things like that.
This threat is down on my list of things to worry about to the same level as being hit by a meteor but I still applaud Mordechai Guri for actually trying it and measuring the results.
If my UPS / Power Filter sees any funny business in the line power, it's going to either compensate or terminate the power, effectively ending this type of attack. The only way this type of attack could work would be if the victim has no power monitoring, which is risky at best for the victim.
They must attempt to monitor one computer at a time per power station, after convincing the rest of the population to turn off all electrical equipment for the duration. And at a max data rate of 1 Kbps. Right. Someone alert DHS.
Apple will fix this with $100 DRMed power cables.
years ago alienware had an $50+ upgraded power cable as an add on.
Meanwhile, all you need to do is have some kind of transformer or other device that separates electrical circuits.
Calling someone a "hater" only means you can not rationally rebut their argument.