Sonic and Ultrasonic Attacks Damage Hard Drives and Crash OSes (arstechnica.com)

Dan Goodin reports via Ars Technica: Attackers can cause potentially harmful hard drive and operating system crashes by playing sounds over low-cost speakers embedded in computers or sold in stores, a team of researchers demonstrated last week. The attacks use sonic and ultrasonic sounds to disrupt magnetic HDDs as they read or write data. The researchers showed how the technique could stop some video-surveillance systems from recording live streams. Just 12 seconds of specially designed acoustic interference was all it took to cause video loss in a 720p system made by Ezviz. Sounds that lasted for 105 seconds or more caused the stock Western Digital 3.5 HDD in the device to stop recording altogether until it was rebooted. The device uses flash storage to house its firmware, but by default it uses a magnetic HDD to store the large quantities of video it records. The attack used a speaker hanging from a ceiling that rested about four inches above the surveillance system's HDD. The researchers didn't remove the casing or otherwise tamper with the surveillance system. The technique was also able to disrupt HDDs in desktop and laptop computers running both Windows and Linux. In some cases, it even required a reboot before the PCs worked properly. The paper titled "Blue Note: How Intentional Acoustic Interference Damages Availability and Integrity in Hard Disk Drives and Operating Systems" can be found here (PDF).

Comments

4 inches?

[Bert64]

If you're within 4 inches of the drive you could use a hammer, or just unplug the power... Works against SSDs too!

Re:4 inches?

[jibjibjib]

The speaker doesn't necessarily have to be within 4 inches; perhaps with further tuning or a different speaker it could work from elsewhere within the room. And there are plenty of plausible scenarios where you don't have physical access to the hard drive, but you do have access to a nearby speaker.

e.g.

- you're running a website and you want to DoS your users' laptop hard drives using the laptop speakers

- you compromised one computer (or phone, or media player, or other device with speakers) and want to use it to attack another device sitting on the desk beside it.

- you rented datacenter space just above your target's server, and your server has an internal speaker which you can attack them with.

Re:4 inches?

[jibjibjib]

It sounds to me from the paper like a laptop's own speakers are capable of generating enough sound to disrupt the laptop's hard drive, in ultrasound ranges that most humans can't hear. Yes, it's a lot of sound energy, but still possible for it to be unnoticed, especially if you timed it for when the user isn't around, or mixed it into music or other legitimate sound.

Re: 4 inches?

[Spazmania]

Are you sure it's because of the initial hissing sound? I would expect it to be due to the sudden air pressure change. Halon and comparable systems work by rapidly adding enough gas to an area that the partial pressure of oxygen drops below what's needed to sustain a fire.

118 dB required

[Anonymous Coward]

As pointed out on ars, the volume required is much like putting your ear against a chainsaw at full throttle.

Nothing here, move along.

Re:118 dB required

[info6568]

To stop a hard disk ... yes ... but you can make a long term "attack" damaging the disks slowly with not so strong noise.

Everything depends on what it is your goal.

Who uses hard drives?

[slashmydots]

This is why I use SSDs. 800G impacts and 200G vibrations while in use are no problem. Then again, it depends how much storage you actually need.

Re:Who uses hard drives?

[swb]

Modern high quality SSDs have really good write durability, but do they have enough to really survive in a DVR that's recording constantly at least at the price points acceptable enough for warehouse store security camera bundles?

It'd be an interesting thing to try out. I could see where the increased throughput of flash media could make for enhanced DVR features, like high frame rate recording but extremely fast time lapse scanning, although I assume they've kind of figured out how to do that with slower rotational media.

Re:What speaker?

[Zocalo]

Case speakers are definitely a relic of a bygone age. No idea about all-in-one desktops since I don't do those, but other than laptops I don't think I've had a case with one for getting on for at least a decade now, although many motherboards do still seem to include a piezo-electric tweeter somewhere. That's pretty much redundant too, however, since anything sent to it is usually hijacked by the drivers for either the on-board sound chip or any add-on audio hardware pretty early in the boot process. Generally speaking, you're going to need to trigger some kind of pre-BIOS/UEFI failure to get anything out of it, and even that seems to be dying out as my last few mobos have all had a pair of seven-segment LED displays that show a sequence of hex status codes as the system progresses through the boot process.

So that's what's been going on

[Chrisq]

So that's what's been going on in the US embasies

Re:So that's what's been going on

[sabbede]

I had the same idea! Yesterday I was thinking that maybe the sonic attacks were intended to have some effect other than deafness, but the equipment was miscalibrated. Now here's something that might point to the intended effect.

Regardless of what the intended effect might be, I do have to wonder how many embassies might be under the influence of properly calibrated equipment, should that be the case.

Destructive resonances

[drdread66]

I saw a related phenomenon in ~2006. My employer was developing some software for a DoD system. Everything worked great in our lab but weird things happened when installed on the servers that the Government bought. It took us *months* to figure out that the problem was a resonance between the hard drives and the cooling fans. After an hour or so of running, the drives would stop working.

We contacted the manufacturer of the hardware and they (a) replaced the fans with fans of a different RPM and (b) isolated the fans with rubber mounts. The problem disappeared immediately and never returned.

Shouting in the datacenter

[ccool]

https://www.youtube.com/watch?...

I'm surprised no one mentioned this link before...