16 ms·
Escaping Data from Faraday-Caged, Air-Gapped Computers via Magnetic Fields
- ac2u 9y ago40bits/s from 100cm away, cool hack.
- dralley 9y agoWhy would they say 100cm instead of just... 1 meter...
- grzm 9y agoOne reason is to convey precision.
- funcSoulBrother 9y agoThe unit indicates the precision at which the scale is represented. So for this, the distribution is probably not very useful at a resolution of 0m, 1m, and 2m and is normalized between the 0 and 1XXcm range.
- rdtsc 9y agoBecause the other distances are less than 1m and measured in cm, like 20cm, 50cm, etc. See their paper.
- rdtsc 9y agoThis is brilliant - magnetic TEMPEST. Though magnetic field intensity drops off with an inverse cute law, they mention that in the paper, which restricts the distance. It seems they got up to 100cm but it's 1bps at that point. For 10bps need to be only about 10cm way. Seems hard to exploit but imagine server being next to a wall/floor and someone placing a bug right next to the wall on the other side. Seems just leaving enough space around the server would be enough. Put it 1m away from floor and walls and it should mitigate it. I knew about the light and ultrasound before, but also learned from the paper there is apparently a thermal TEMPEST attack as well.
- schoen 9y agoKragen Sitaker's post that was featured on HN recently mentioned the idea of simply slowing down communications to increase distance without increasing power. Can that be demonstrated for air gap penetrating malware (with or without electrical shielding)? Can I run software on my computer that successfully sends a message wirelessly to Kragen over on another continent (albeit at some absurdly low data rate)? https://news.ycombinator.com/item?id=16232509 https://news.ycombinator.com/item?id=16232509
- cperciva 9y agoI realize it was a typo, but I love the idea of an "inverse cute law".
- schoen 9y agoSame here, but I expect it's the wrong law for magnetism. People's magnetism is roughly proportional to the logarithm of their cuteness, isn't it?
- rdtsc 9y agoHa! Silly typo. Thanks for pointing it out. "Inverse cute law" works as you said as well, it's when you're trying to exfiltrate data but physics conspires against you.
- dboreham 9y agoI thought it had something to do with Schrodinger's Cat.
- Florin_Andrei 9y agoCompletely isolated systems seem more and more like a theoretical abstraction, not a reality. If you want true isolation, place it inside the event horizon of a black hole. Or spin up a child universe then cut off the connection. Even then some clever cookie might find ways for information to percolate from one continuum to another.
- schoen 9y ago
- jaclaz 9y agoAs often happens, very nice, but of no practical use whatever, I mean first thing you have to BOTH infect the PC AND place a "magnetic receiver" within 100 cm, but the "magnetic receiver" needs anyway to transmit the data, and that is IMHO the unresolved problem, as this method of transmission would be easily detected (if electromagnetic/radio) or impossible to deploy (cable/wire) in 99.9999% of the "secure sites" where actually an air-gapped computer is used inside a faraday cage.
- titzer 9y agoThe magnetic receiver could as well be under the floor, in the wall, in a picture, etc. It doesn't have to immediately transmit, either. It'd be easy enough to put 128gb flash on it and then come collect it later, sneaker-net style.
- ChuckMcM 9y agoThis. Secure facilities might not be used 24/7/365 and so going in to collect the bug would be the mode used. It is yet another clever way to extract information and I expect to see CPU coolers with ferrite flux redirectors to appear at some point to counter it.
- jandrese 9y agoSeems to me that if you're talking about smuggling hardware into a SCIF and installing exploits on the servers then doing this exotic form of data collection seems like overkill. There should be faster and more reliable options at that point, like turning the keyboard cable into a crude transmitter by banging bit patterns over it. I've never seen a SCIF where going in after hours is the "easy route". They're full of motion detectors and the entrance is typically a heavy metal door with a combination lock. The air ducts are too small to crawl through. :)
- olivermarks 9y agoCurrently the only way to exploit this would be a Hollywood style infiltration of a human, at which point a usb stick might be easier to use to get in and out quick... https://youtu.be/ar0xLps7WSY https://youtu.be/ar0xLps7WSY
- myrandomcomment 9y agoDid you ever think when stuff like this come out there is some guy at the NSA going "Damn it, there goes another one" as they have know about this and been using if for years :)
- schoen 9y agoUnfortunately, mitigating a vulnerability can take a long time and might never happen. When the Imperfect Forward Secrecy paper about weak Diffie-Hellman exchanges came out in 2015, not all systems using the vulnerable groups upgraded immediately, and some systems couldn't be easily upgraded either because they were hard-coded or because they had other software limitations. The IT security situation in many developing countries is also pretty alarming, for example if you look at the prevalence of old unsupported operating systems and browsers in many places. Even thinking about traditional emanations issues, the "van Eck phreaking" attacks were publicly demonstrated years ago https://www.youtube.com/watch?v=ZZ5HS8GWIec https://www.youtube.com/watch?v=ZZ5HS8GWIec but have still not been widely mitigated in practice. Neither have the emanations problems documented by Tromer. https://www.cs.tau.ac.il/~tromer/ https://www.cs.tau.ac.il/~tromer/ And we know that the vendors were notified about Spectre in June of last year and the public was told over a month ago, but pretty much all of us continue to be potentially vulnerable to it in some settings, even more than seven months after vendor notifications! It can be nice for infosec researchers to think that attackers only gain power and capability by knowing secrets, and that if those secrets are exposed the attackers will lose their capabilities, but a number of people have been pointing out that it doesn't always work that way -- or at least there can be quite a long window of vulnerability. (However, exposing secrets is definitely an important prerequisite for denying capabilities to attackers.)
- myrandomcomment 9y agoThe thing I love about HN is that you say something to be amusing and the engineering types (I am one, so I am making fun of myself) always make some logical argument in response. The best part is 90% of the time you learn something!
- jacquesm 9y ago
- crankylinuxuser 9y agoThat's neat. It does remind me a few things. They're only related by this topic. 1. A buddy was experimenting with 3d printers, and was measuring the spin on a magnet superglued on the back of a NEMA 17 shaft. He had weird interference going on. We eventually figured out the sensor was sensitive enough to measure the magnetic field in the stepper itself. Our solution was to take a spinning rust HD case, and cut/wrap it around the stepper. Spinning rust cases are made out of MU-Metal. Think of them as magnetic shielding. And in our case, it worked with nothing more than scrap we had around. 2. There was a company I ran across a year ago that was selling chips that could communicate over a personal magnetic area network. They didn't give hard numbers, but claimed they could transmit audio and video within a 2m bubble. They also worked through stuff like water (which kills most radio). I asked for some samples, but fell on deaf ears. I'd still love to have/purchase a few chips to experiment with.
- Gargoyle 9y agoI wonder what ever happened to that idea of a PAN (personal area network) that was touted a few years back.
- Anarch157a 9y agoDoes your phone talking with you Fitbit and wireless earbuds, then unlocking and starting your car when get close counts ?
- skykooler 9y agoHuh. I didn't know mu-metal was a real thing; I always assumed it was something Guardians of Ga'Hoole made up.
- crankylinuxuser 9y agoYep, sure is legit stuff. There's quite a few things made out of mu-metal, but spinning rust hard drive cases are the most readily accessible. https://en.wikipedia.org/wiki/Mu-metal https://en.wikipedia.org/wiki/Mu-metal
- arcaster 9y agoAs obnoxious as randomly pulsating RGB led's are, it seems like a great way to defeat data exfiltration with status LED's of any kind. I'm also curious why air-gapped data centers don't blast the air-waves both inside and outside of the faraday cages with randomized signal noise.
- AndrewKemendo 9y agoI can only speak for the DoD/IC but we do blast the air-waves with randomized noise in the form of white/pink noise or radios in and around our SCIFs. It's not really cost effective or critical to add further EM radiative sources to that, as the intention is primarily to reduce risk of voice bugs.
- arcaster 9y agoCool! I can't wait to see data centers that are pulsating with RGB light in a seizure inducing "Linus Tech Tips - THE MOST INSANE RGB DATA CENTER EVER" kind of way. With all the lights there for "security reasons"
- nisten 9y agoSo what, do I just set on the bios to run my CPU at 100% all the time now?
- asterius 9y agoThe real benefit from this work is not exfiltrating from airgapped computers, but from code running inside Intel SGX or similar isolated computation modes.
- ridgeguy 9y agoIt seems this data leakage mode could be dealt with by combining the Faraday cage material (which blocks EM radiation) with a high magnetic permeability material (blocks B-fields, as discussed in the paper's ref [50] (paywalled)). Mu-metal screen is a thing, so maybe copper plating over the mu-metal to combine both shielding mechanisms?
- foobarian 9y agoI did a project once where I needed to block RF interference from a battery-powered Raspberry Pi board. I thought back to physics classes and Faraday cages when we learned that no electric fields can come in or out, so I went and put the board into a metal box thinking it would completely block all RF. Boy was I wrong. The box was only enough to attenuate about -10 or -15dB of the WiFi signal! I figured the box had seams so it was behaving as a repeater from outside to inside. I wonder if a perfect seamless box would have done better.
- ridgeguy 9y agoSeamless might have helped. Seams can act as slot radiators. In plasma deposition chambers I've built, getting continuous electrical contact all the way around mechanical access ports was essential to keep microwave power from getting out of the box.
- nearbuy 9y agoYou forgot an important detail from your physics classes: the electric field inside a Faraday cage is only zero when it's exposed to static electric fields. Changing electric fields, like radio waves, can pass through, although they'll be attenuated. Also, if you place an electric charge inside a Faraday cage, it will cause an electric field outside the cage, and the electric field inside the cage will still be zero.
- madengr 9y agoMRI rooms are well shielded for both RF and static B field. Multiple layers of air and mu metal gives good B shielding.
- stcredzero 9y agoIf we extrapolate this into the future, we'll eventually have, "Escaping data from Computers through an Event Horizon."
- oxymoran 9y agoWow. This is pretty mind blowing to someone that is not an engineer. My take away from this is that if the information is valuable enough and if someone wants the data enough, there is no way to truly make anything 100% secure. There will always be something to exploit. Is this accurate? Can we ever make something that is “invincible “?
- empath75 9y agoI guess we need to upgrade our tinfoil hats.
- mchahn 9y ago> We introduce a malware How do you get malware onto one of these things? I guess social-hacking could be used but if you have that then no technical solution is needed.