4 ms·
Back a couple of decades, my alphabetic pager was going off but the messages were gibberish. It turned out the CPU in the PC I'd been asked to look at was a Pen
by cestith 9y ago
Back a couple of decades, my alphabetic pager was going off but the messages were gibberish. It turned out the CPU in the PC I'd been asked to look at was a Pentium running at 150 MHz. I'd set my pager directly on top of the case, and the nominal frequency for it was 150.5 MHz, frequency modulated.
The lines in the motherboard can be used as antennae and the CPU pins can produce a clock pulse and modulate it. There used to be a parallel port audio device for PCs which was mainly just different resistors. The driver for it just timed pulses to the different pins.
This software just shows a bit of a novel implementation to modulate the motherboard bus itself in an ordered way to produce a signal with useful data in it. I imagine FM may be easier to pull off cleanly than AM, actually.
This shows that an air gap has to be pretty large, and should probably be backed up by a Faraday cage if your data is that sensitive.
I don't suspect this will be used to get grandma's credit card number from her home desktop considering the logistics of the actual attack. Source code to something really important, military data, diplomatic dispatches, or something else of really high value would be the only sensible targets in a closed area. However, a university lab, Internet cafe, coffee shop, or public library might be easy enough. Most of the machines there will be on the network, and that's an easier way to exfiltrate. The main advantage of this in the common attacker's toolkit is it won't be seen by a host-based firewall. DNS, DHCP, or lots of other ways could be used to exfiltrate through most firewalls though.
This sort of thing is a great novelty for most of the computer-using world. It's kind of scary for people who are actually in need of an air gap, but I don't think it's unforeseen.
- gtufano 9y agoYears ago I was in the same building during the installation of a "NATO standard" (whatever that means) environment suitable for developing sensitive software, and the air gap was indeed pretty large, the entire 2 rooms were air gapped from the building (at 4th floor), enclosed in a Faraday cage and with special precautions (out of my clearance level) for electricity going in. It was very quiet inside (even cell phone did not have any signal, of course).
- netsharc 9y agoHopefully cellphones weren't allowed? Otherwise it would be interesting to hack the phone to go to "record AM signals" if there's no cell/wifi/FM/GPS signals (if it were on a plane it would still see GPS signals). Or maybe to announce its presence using ultrasonic, so if there's also compromised machines/CPUs/hypervisor environments inside the secured environment, it would detect the "Hello" and start uploading data to it. Later when the phone user reconnects to the cell network, it can upload your secret data..
- gtufano 9y agoOf course they were forbidden, as it was every not authorized device. The physical security was tight. I just entered it during the building, before the certification (I was in a manager role in the building)
- meatmanek 9y agoHave you seen the GSMem paper? They demonstrate pretty much exactly what you've proposed: https://www.usenix.org/node/190937 https://www.usenix.org/node/190937
- DKnoll 9y agohttps://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)
- exikyut 9y agoI'm very curious (from an academic thought-experiment standpoint) what sorts of mitigations could be used for electrical lines in an environment like this. My first thought - an alternate reality where you could turn power to (say) 100kW of light and then back again - would actually not be enough, as light can be pulsed so rapidly we're already using it to encode data. Welp. I'm guessing that UPS-type equipment was used as a form of powerline isolation, at least.
- beached_whale 9y agoMy understanding is that what capacitors would mitigate. Computers run on DC.
- deleted 9y ago[deleted]
- DanBC 9y ago> There used to be a parallel port audio device for PCs which was mainly just different resistors. The driver for it just timed pulses to the different pins. Resistor ladder DA converters are pretty fun. https://en.wikipedia.org/wiki/Covox_Speech_Thing https://en.wikipedia.org/wiki/Covox_Speech_Thing https://hackaday.com/2015/11/05/logic-noise-digital-to-analog-with-an-r-2r-dac/ https://hackaday.com/2015/11/05/logic-noise-digital-to-analo... https://www.tek.com/blog/tutorial-digital-analog-conversion-%E2%80%93-r-2r-dac https://www.tek.com/blog/tutorial-digital-analog-conversion-...
- Doxin 9y agoTurns out you don't really even need a DAC for audio. You can fairly easily bit-bang a single binary output and run it through an RC filter to get nice audio.
- deleted 9y ago[deleted]