Transmitting malicious code over audio speakers

Question

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes:

... "badBIOS," as Ruiu dubbed the malware, has the ability to use high-frequency transmissions passed between computer speakers and microphones to bridge airgaps.

... It's also possible to use high-frequency sounds broadcast over speakers to send network packets. Early networking standards used the technique, said security expert Rob Graham. Ultrasonic-based networking is also the subject of a great deal of research, including this project by scientists at MIT.

... Then, when Ruiu removed the internal speaker and microphone connected to the airgapped machine, the packets suddenly stopped. With the speakers and mic intact, Ruiu said, the isolated computer seemed to be using the high-frequency connection to maintain the integrity of the badBIOS infection as he worked to dismantle software components the malware relied on.

This has me highly skeptical. As an attack-vector, is it in any way possible to exploit an uninfected computer via only an active microphone? Assuming such trickery is even possible, why didn't the researcher simply record the audio with an (analog) recorder to validate the claims?

Answer 1

You are misinterpreting the article. The author never claims the infection came from communication over a microphone, see this passage:

For most of the three years that Ruiu has been wrestling with badBIOS, its infection mechanism remained a mystery. A month or two ago, after buying a new computer, he noticed that it was almost immediately infected as soon as he plugged one of his USB drives into it. He soon theorized that infected computers have the ability to contaminate USB devices and vice versa.

So the initial infection came from USB, which is not a uncommon attack vector in todays post-stuxnet world.

The interesting part, while still hard to believe but is possible, is the fact that two already infected machines would use microphone and speakers to communicate with each other to potentially pass along command and control information between themselves across a airgap.

Answer 2

The original claim isn't that a computer was infected over the speakers, but rather information was transmitted between infected machines that way.

Specifically, he found that the malware evolved over time, changing its behavior in reaction to his reverse-engineering techniques. That alone is quite impressive, but he also found that the infected machines that he had physically isolated were still being updated. He went as far as to actually remove (not just disable) any radio hardware such as bluetooth and wifi devices, but the machine still was somehow getting updates. The communication stopped, he says, when the microphone and speakers were disconnected, though, which is where the packets-over-audio theory comes from.

Each of the features he discussed, including this one, is well within the realm of possibility, and in fact not even particularly difficult. What's impressive, and almost unbelievable, though, is having all of these features, all of this capability, altogether in one single infection. The larger and more complicated an infection agent like this gets, the more difficult it becomes to keep stable. The features start to crowd out the simplicity, and things get unwieldy.

Remember, this isn't a consumer product, not a database engine or browser; this is software built to take advantage of undocumented or flawed hardware interfaces, to hijack and replace core system functionality, hide itself from even the most skilled engineers, and to function perfectly without the benefit of bug reports or field-testing. High-end malware like this needs to work perfectly under very adverse conditions, and this is pushing the limits of engineering in terms of reliability.