Acoustic Data Exfiltration from Speakerless Air-Gapped Computers via Covert Hard-Drive Noise (‘DiskFiltration’)

Abstract

Air-gapped computers are disconnected from the Internet physically and logically. This measure is taken in order to prevent the leakage of sensitive data from secured networks. In the past, it has been shown that malware can exfiltrate data from air-gapped computers by transmitting ultrasonic signals via the computer's speakers. However, such acoustic communication relies on the availability of speakers on a computer.In this paper, we present 'DiskFiltration,' a covert channel which facilitates the leakage of data from an air-gapped compute via acoustic signals emitted from its hard disk drive (HDD). Our method is unique in that, unlike other acoustic covert channels, it doesn't require the presence of speakers or audio hardware in the air-gapped computer. A malware installed on a compromised machine can generate acoustic emissions at specific audio frequencies by controlling the movements of the HDD's actuator arm. Digital Information can be modulated over the acoustic signals and then be picked up by a nearby receiver (e.g., smartphone, smartwatch, laptop, etc.). We examine the HDD anatomy and analyze its acoustical characteristics. We also present signal generation and detection, and data modulation and demodulation algorithms. Based on our proposed method, we developed a transmitter on a personal computer and a receiver on a smartphone, and we provide the design and implementation details. We also evaluate our covert channel on various types of internal and external HDDs in different computer chassis and at various distances. With DiskFiltration we were able to covertly transmit data (e.g., passwords, encryption keys, and keylogging data) between air-gapped computers to a smartphone at an effective bit rate of 180 bits/minute (10,800 bits/hour) and a distance of up to two meters (six feet).

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

“…Hanspach introduced a method called acoustical mesh networks in air, which enables the transmission of data via high frequency sound waves [13]. Guri et al also presented Fansmitter [3] and DiskFiltration [14], two methods enabling the exfiltration of data via sound waves, even when the computers are not equipped with speakers or audio hardware. This research showed how to utilize computer fans and hard disk drive actuator arms to generate covert sound signals.…”

Blue Note: How Intentional Acoustic Interference Damages Availability and Integrity in Hard Disk Drives and Operating Systems

“…Guri et al [33] utilized the HDD's built-in thermal sensors to receive data transmitted over the machine's heat emissions. Guri et al [1] used the movements of a hard drive's actuator arm to generate audible emissions that were used to exfiltrate data from airgapped machines. Since the head of a hard drive is made up of magnetic materials, the movement of the head can produce a sufficiently strong magnetic field that can be detected by a smartphone's magnetic field sensors.…”

“…Magnetic HDDs remain common [1] because of the long tail of legacy systems and the relatively inexpensive cost for high capacity storage. However, sudden movement can damage the hard drive or corrupt data because of the tight operating constraints on the read/write head(s) and disk(s).…”

MOSQUITO: Covert Ultrasonic Transmissions Between Two Air-Gapped Computers Using Speaker-to-Speaker Communication

“…In this method, the transmitting computer does not need to be equipped with audio hardware or an internal or external speaker. Guri et al also presented DiskFiltration a method that uses the acoustic signals emitted from the hard disk drive (HDD) moving arm to exfiltrate data from air-gapped computers [28].…”