Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers

Guri, Mordechai; Solewicz, Yosef A.; Daidakulov, Andrey; Elovici, Yuval

doi:10.48550/arxiv.1606.05915

Cited by 17 publications

(23 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this method, a malware controls the electromagnetic emission from a computer and modulates data on top of it. It also have been shown that attackers can exfiltrate data from air-gapped computers using ultrasound, magnetic signals, and even heat emission [3]- [6].…”

Section: A Air-gap Exfiltrationmentioning

confidence: 99%

“…Hanspach introduced a method called acoustical mesh networks in air, which enables the transmission of data via high frequency sound waves [13]. Guri et al also presented Fansmitter [3] and DiskFiltration [14], two methods enabling the exfiltration of data via sound waves, even when the computers are not equipped with speakers or audio hardware. This research showed how to utilize computer fans and hard disk drive actuator arms to generate covert sound signals.…”

Section: A Electromagnetic Magnetic Acoustic and Thermalmentioning

confidence: 99%

See 1 more Smart Citation

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

Guri

Zadov

Bykhovsky

et al. 2019

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Self Cite

View full text Add to dashboard Cite

Using the keyboard LEDs to send data optically was proposed in 2002 by Loughry and Umphress [1] (Appendix A). In this paper we extensively explore this threat in the context of a modern cyber-attack with current hardware and optical equipment. In this type of attack, an advanced persistent threat (APT) uses the keyboard LEDs (Caps-Lock, Num-Lock and Scroll-Lock) to encode information and exfiltrate data from airgapped computers optically. Notably, this exfiltration channel is not monitored by existing data leakage prevention (DLP) systems. We examine this attack and its boundaries for today's keyboards with USB controllers and sensitive optical sensors. We also introduce smartphone and smartwatch cameras as components of malicious insider and 'evil maid' attacks. We provide the necessary scientific background on optical communication and the characteristics of modern USB keyboards at the hardware and software level, and present a transmission protocol and modulation schemes. We implement the exfiltration malware, discuss its design and implementation issues, and evaluate it with different types of keyboards. We also test various receivers, including light sensors, remote cameras, 'extreme' cameras, security cameras, and smartphone cameras. Our experiment shows that data can be leaked from air-gapped computers via the keyboard LEDs at a maximum bit rate of 3000 bit/sec per LED given a light sensor as a receiver, and more than 120 bit/sec if smartphones are used. The attack doesn't require any modification of the keyboard at hardware or firmware levels.

show abstract

Section: A Air-gap Exfiltrationmentioning

confidence: 99%

Section: A Electromagnetic Magnetic Acoustic and Thermalmentioning

confidence: 99%

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

Guri

Zadov

Bykhovsky

et al. 2019

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Self Cite

View full text Add to dashboard Cite

show abstract

“…All of the acoustic methods presented above require speakers. In 2016, Guri et al introduced Fansmitter, a malware which facilitates the exfiltration of data from an air-gapped computer via noise intentionally emitted from the PC fans [27]. In this method, the transmitting computer does not need to be equipped with audio hardware or an internal or external speaker.…”

Section: E Acousticmentioning

confidence: 99%

“…Magnetic MAGNETO [20] (CPU-generated magnetic fields) ODINI [31] (Faraday shields bypass) Hard-disk-drive [39] Acoustic Fansmitter [27] (computer fan noise) DiskFiltration [28] (hard disk noise) Ultrasonic [33], [13] MOSQUITO (speaker-to-speaker)…”

Section: E Acousticmentioning

confidence: 99%

MOSQUITO: Covert Ultrasonic Transmissions Between Two Air-Gapped Computers Using Speaker-to-Speaker Communication

Guri

Solewicz

Elovici

2018

2018 IEEE Conference on Dependable and Secure Computing (DSC)

Self Cite

View full text Add to dashboard Cite

In this paper we show how two (or more) airgapped computers in the same room, equipped with passive speakers, headphones, or earphones can covertly exchange data via ultrasonic waves. Microphones are not required. Our method is based on the capability of a malware to exploit a specific audio chip feature in order to reverse the connected speakers from output devices into input devices -unobtrusively rendering them microphones [29]. We discuss the attack model and provide technical background and implementation details. We show that although the reversed speakers/headphones/earphones were not originally designed to perform as microphones, they still respond well to the near-ultrasonic range (18kHz to 24kHz). We evaluate the communication channel with different equipment, and at various distances and transmission speeds, and also discuss some practical considerations. Our results show that the speaker-tospeaker communication can be used to covertly transmit data between two air-gapped computers positioned a maximum of nine meters away from one another. Moreover, we show that two (microphone-less) headphones can exchange data from a distance of three meters apart. This enables 'headphones-to-headphones' covert communication, which is discussed for the first time in this paper.

show abstract

“…The network covert channels through which sensitive data are hidden in network packages with steganography were surveyed by Zander [43] in 2007. A physically separated covert channel, also called an air-gapped covert channel, leaks data directly via a physical emitting source such as an LED [29,38,15,14,44,45], an acoustic source [18,35,26,12,13] or an antenna [24,10,9,11,31] etc. No any normal channel can be utilized for such air-gapped covert channels.…”

Section: Introductionmentioning

confidence: 99%

Data Exfiltration via Multipurpose RFID Cards and Countermeasures

Zhou,

Zhang,

2019

Preprint

View full text Add to dashboard Cite

Radio-frequency identification(RFID) cards are widely applied in daily human life. The information security of RFID cards, such as data confidentiality, tag anonymity, mutual authentication etc, has been fully studied. In the paper, using the RFID cards in MIFARE Classic and DESFire families, a bidirectional covert channel via multipurpose RFID cards between service providers is built to leak sensitive data between two simulation systems. Furthermore, by calculations and experiments, the daily channel capacity to leak data of the channel is obtained. Although the storage capacity of a single RFID card is very small, a large user base can still bring about a considerable amount to leak data. Then, the reasons for the existence of such channels are discussed. To eliminate this type of covert channels, a new authentication protocol between RFID cards and card readers are proposed. Our experimental results show a significant security improvement in prevention of such covert communications while keeping user convenience.

show abstract

Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers

Cited by 17 publications

References 0 publications

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

MOSQUITO: Covert Ultrasonic Transmissions Between Two Air-Gapped Computers Using Speaker-to-Speaker Communication

Data Exfiltration via Multipurpose RFID Cards and Countermeasures

Contact Info

Product

Resources

About