3

In an intriguing paper Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers (also see this summary) the authors demonstrate that they are able to exfiltrate data from an air-gapped computer by modulating the rotation speed of the cooling fan. A similar thing has been done using a computer's internal microphone. Obviously this type of attack requires physical access at some point to install the malware.

What I don't fully understand is this: why go to all this trouble if you need physical access to your target anyway, and could then just extract whatever data you're interested in? What am I missing?

  • Physical access is not required. One of the servers may be connected to a network which can be used to infect it. Someone then copy some data from that server to the air-gapped server, resulting in an infection. – lepe Jul 1 '16 at 6:56
  • Like others mentioned. They indeed try to infect as many as machines, in the hope one will put an USB for infected machine A to air-grap B. This is also how they got Stuxnet on some air-gapped systems. – O'Niel Jul 1 '16 at 10:04
4

What I think is important to point out about malware targetting air-gapped systems is that as much as these methods require physical access, it doesn't require that the attacker himself has physical access.

The idea is to spread the malware on as many computers as possible around the targeted system so that someone who is allowed to physically access it will eventually plug a contaminated USB key to the said system.

However, these methods seem to still require the attacker to be fairly close to the target to pick up the sounds produced. I think it is usually more efficient when the objective is to cause damage to the air-gapped system (erasing data, causing disfunction in automated industrial tools etc...).

3

One of possible answers is in the condition you noticed yourself: "this type of attack requires physical access at some point to install the malware". It doesn't require physical access at a later point in time.

An attacker might have had the physical access before the data was created or stored on a target machine and exfiltrate the data later.

1

I would be surprised if that kind of setup was ever used but the idea is that someone might install spying software on the machine which would broadcast the information obtained through fan speed modulation.

The transmission rate of such an approach would be extremely slow as fan control is not designed for precision. It would require having equipment to pick up that signal really close by.

A few advantages of this type of approach over getting a snapshot of the hard drive could be:

  1. Allow continuous data retrieval, not just a static snapshot.
  2. Bypassing data encryption by spying on the output devices or processes.
  3. Faster to install than to copy the whole hard drive. Of course both cases require physical access to the machine and ways to gain access to the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.