Necessity of physical access to air-gapped computers

Question

In an intriguing paper Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers (also see this summary) the authors demonstrate that they are able to exfiltrate data from an air-gapped computer by modulating the rotation speed of the cooling fan. A similar thing has been done using a computer's internal microphone. Obviously this type of attack requires physical access at some point to install the malware.

What I don't fully understand is this: why go to all this trouble if you need physical access to your target anyway, and could then just extract whatever data you're interested in? What am I missing?

Answer 1

What I think is important to point out about malware targetting air-gapped systems is that as much as these methods require physical access, it doesn't require that the attacker himself has physical access.

The idea is to spread the malware on as many computers as possible around the targeted system so that someone who is allowed to physically access it will eventually plug a contaminated USB key to the said system.

However, these methods seem to still require the attacker to be fairly close to the target to pick up the sounds produced. I think it is usually more efficient when the objective is to cause damage to the air-gapped system (erasing data, causing disfunction in automated industrial tools etc...).

Answer 2

One of possible answers is in the condition you noticed yourself: "this type of attack requires physical access at some point to install the malware". It doesn't require physical access at a later point in time.

An attacker might have had the physical access before the data was created or stored on a target machine and exfiltrate the data later.

Answer 3

I would be surprised if that kind of setup was ever used but the idea is that someone might install spying software on the machine which would broadcast the information obtained through fan speed modulation.

The transmission rate of such an approach would be extremely slow as fan control is not designed for precision. It would require having equipment to pick up that signal really close by.

A few advantages of this type of approach over getting a snapshot of the hard drive could be:

1. Allow continuous data retrieval, not just a static snapshot.
2. Bypassing data encryption by spying on the output devices or processes.
3. Faster to install than to copy the whole hard drive. Of course both cases require physical access to the machine and ways to gain access to the system.