2

Is it a requirement to infect the air-gapped pc with malware at first to get all needed functions for a communication path between air gapped pc and attacker pc?

For example: Stuxnet, first was the infected USB-stick on air-gapped pc then the communication over side-channel. Or are there any side channel attacks that don't require malware on air-gapped pc?

When malware is a requirement to communicate (see upper question), does the malware do write functions? I think so because it doesn't make sense "when malware is required" (see upper question) but don't need to work/write/execute any code, is that right?

With air-gapped pc i mean: A brandnew tower computer or laptop/netbook etc. (very simple) Just FYI all communications devices (bluetooth, wlan etc.) are physical destroyed/removed

  • Need some clarification here. When you say "on air gapped pc," what do you mean? Do you mean a PC, or any devices on the network? For example, supply-chain interdiction of server hardware, or any other non-PC devices or peripherals can assist with compromise of airgapped networks and are some of the more common ways to do it. You don't need to compromise a PC if the IT team's server (such as domain controller) was compromised. – Mark Buffalo Aug 19 '18 at 20:47
  • Just a brandnew tower computer or laptop/netbook etc. (very simple) Just FYI all communications devices (bluetooth, wlan etc.) are physical destroyed/removed. – user183457 Aug 19 '18 at 22:52
2

Or are there any side channel attacks that don't require malware on air gapped pc?

Of course.

Let me just quote from Wikipedia as simple source:

General classes of side channel attack include:

Cache attack — attacks based on attacker's ability to monitor cache accesses made by the victim in a shared physical system as in virtualized environment or a type of cloud service.
Timing attack — attacks based on measuring how much time various computations (such as, say, comparing an attacker's given password with the victim's unknown one) take to perform.
Power-monitoring attack — attacks that make use of varying power consumption by the hardware during computation.
Electromagnetic attack — attacks based on leaked electromagnetic radiation, which can directly provide plaintexts and other information. Such measurements can be used to infer cryptographic keys using techniques equivalent to those in power analysis or can be used in non-cryptographic attacks, e.g. TEMPEST (aka van Eck phreaking or radiation monitoring) attacks.
Acoustic cryptanalysis — attacks that exploit sound produced during a computation (rather like power analysis).
Differential fault analysis — in which secrets are discovered by introducing faults in a computation.
Data remanence — in which sensitive data are read after supposedly having been deleted. (i.e. Cold boot attack)
Software-initiated fault attacks — Currently a rare class of side-channels, Row hammer is an example in which off-limits memory can be changed by accessing adjacent memory too often (causing state retention loss).
Optical - in which secrets and sensitive data can be read by visual recording using a high resolution camera, or other devices that have such capabilities (see examples below).

Eg. getting information by measuring power consumption (of the intended non-malicious software) doesn't need malicious software in any way.

  • So every light, acoustic etc. emission can be captured by the attacker which be transfer to digital? – user183457 Aug 19 '18 at 23:17
  • @Anything sure, but most of the time the data would have too much noise to be of use as a side-channel. If you want a great read on side channel attacks like this, pick up Silence On the Wire. nostarch.com/silence.htm – Angelo Schilling Aug 20 '18 at 22:23
1

You have actually two questions here:

... are there any side channel attacks that don't require malware on air-gapped pc?

This first question essentially asks if there are any side-channel attacks at all possible which can be used to get sensitive information from the machine. @deviantfan correctly pointed out a variety of attacks which might be used to extract interesting data from an machine, even if it is air gapped. But these are accidental leaks, not leaks on purpose.

Is malware on an air gapped computer a requirement to communicate over side-channels?

This second question instead asks for active communication using side-channels. Contrary to the first question side-channels are not seen here as something which accidentally leak information but which are used on purpose as a communication channel to get collected information out of the machine. This needs of course something which collected these information on the machine in the first place and which then knowingly "modulates" these information onto the side channels so that they can be read by a partner outside the machine. Thus in this case the machine has to be either infected by some software which does the active communication or the machine has to come pre-installed with such software.

0

Comparing something akin to a moon landing to your own machine being attacked, is likely over stating the risk. I would not be worried about other vectors of attack on a offline PC.

what needs this level of protection?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy