Researchers figured out how to transmit/exfiltrate data using heat

Question

I read article about it here and it says:

Researchers at Ben-Gurion University have created a new piece of malware called BitWhisper. Infected machines can transmit data using heat they produce. Commands, for example, can be passed from one system to another by modulating its temperature. The target machine’s thermal sensors pick up on the fluctuations and execute a predefined action. Small bits of captured data (like passwords) can also be transmitted this way.

Can you please explain how this is possible in more simple and logical terms, and how can we protect yourself from this malware?

EDIT: please watch the youtube video on the website

Answer 1

This proof of concept is about communicating from a non-air gaped machine to an air-gaped (not on the network) machine. Both machines need to be infected with the malware. This would be like a stuxnet type of attack; it may be possible to get one time access to the air-gaped machine to install the malware, but you can't get continued access because you need to physically leave the air gap.

The way the communication works is by modulating heat on one machine and have the other machine pick up the change in ambient heat. It requires the two machines to be physically close. It may be possible to expand this to a greater range, but perhaps a more likely scenario is where you have networked controlled HVAC and temperature sensors all over the room which are also networked and which you can monitor. In this proof of concept, it posits that all of the servers are nearby, but some are airgaped; an organization may just not connect systems to a network, but not bother to put them in another room.This is more of a nation-state spying type thing then something a script kiddie or even criminal hacker would be up to.

The difference with other attacks where you remotely view the changes in power, etc is that the air-gaped computer is more likely to have temperature sensors to read input and also can control the fan, processors, etc to control heat. This means that the air-gaped machine does not require any additional hardware once compromised with malware to transmit messages back to the non-air-gaped machine. Also, because it takes a good amount of time to change temperatures and ensure its consistent, the communication is slower.

Again, this is a proof of concept. Check out the wired article, geeks.com is probably not the best place for deep technical reviews.

There are similar classes of "remote viewing" attacks with reading power levels, radar, etc.

Answer 2

Hacking is a completely inappropriate description for what is purportedly demonstrated that video, and I'm sure the term was only applied for the sake of creating a more appealing headline.

What the video is demonstrating is nothing more than communicating, there are no vulnerabilities being exploited, no unauthorized access being gained, and no information being unintentionally disclosed. This is nothing more than a novel way of communicating.

The only relation this has to security is that often systems are disconnected (ie. "air gapped") from computer networks to minimise exposure to threats that might exist on a network, and they are proposing this method could be used to communicate in the absence of a network.

However, I seriously question both the practicality and the threat of this as a malicious technique:

• The video only demonstrates two or three bits being communicated, ie. a "fire" or "move" command. You could probably do better using a microphone to detect when a CD drive spins up... Or even better just sound played through the speakers.
• Both computers have already had the software required to do this installed, therefore for this to be used in an actual attack the attacker would have to figure out how to compromise the air gap to get the software on there and however they did that would probably be more effective than this.
• It seems apparent that access to stress the CPU and read the CPU censor were given willingly, there is nothing malicious in how it actually communicates
• The "sending" machine would certainly raise suspicion via the heat (and presumably fan noise) it generates, unless it was already in a "noisy" environment with lots of background heat and I doubt this would be possible in that scenario.

Aside from those doubts, BitWhisper didn't return any results on Google scholar and you could fake this in dozens of ways. In my brief search I also didn't find anything about the parameters under which this is being achieved, for all we know this is taking place in a very cold room - which is obviously also very significant to whether this is a viable threat.