22 ms·
PowerHammer: Exfiltrating Data from Air-Gapped Computers Through Power Lines
- gonmf 9y agoThis should be named: Data transfer through power lines. The rest is just accessory since the machine has to have the exploit already installed.
- titzer 9y agoThe name "PowerHammer" is also a bit of a mismatch. It's basically a covert channel via power consumption, which has been known. The transmission mechanism (write) is to idle the CPU for specific intervals of time in order to transmit bits. Impressive engineering, impressive bitrate, but not so novel an idea, overall.
- debt 9y agoTrue, but I've never seen software open a physical hole to the machine. That is, air gap means there's no physical way to access the machine. But this exploit would create, out of thin air, a physical connection to the outside world using the power outlet the machine is connect to. So unless data centers become powered by solar panels or generators that are themselves under the same level of physical security as the server racks, then this is a pretty serious exploit.
- dbasedweeb 9y agoTEMPEST shielding ranges from not at all cheap, to breathtakingly expensive, and what you’re describing is just one part of high level shielding. It’s not just the facilities that cost, but the fact that your electricians and janitors need clearance as much as your devs and analysts. Even if data centers wanted to go that route, it would have to pass the costs on to the customer, who would need to be s very particular kind of customer with deep pockets.
- debt 9y agoyeah but well-funded adversaries could easily exploit this and we're talking like a full-blown data leak so it might be worth it to protect against it.
- JoshTriplett 9y ago> True, but I've never seen software open a physical hole to the machine. That is, air gap means there's no physical way to access the machine. See https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/guri https://www.usenix.org/conference/usenixsecurity15/technical... by some of the same authors.
- pixelcloud 9y agoYou would need to be pretty close to the server/storage/etc to get a clean enough signal to be useful though. So physical security might be enough to protect against this type of attack. You probably can't just dig up the powerline outside and start tapping it thankfully.
- zaarn 9y agoGet a dirty pickup truck, a warning vest with the text "CONSTRUCTION" on the back and a pair of those laser device to measure out the land. Then also put some shovels, pickaxes and other construction and digging gear into the back of the pickup truck. Lastly, learn how to not behave like you're doing something forbidden or bad. You can try it out in less secured areas if you want to train up a bit. Once you've mastered that you can drive up to any place and start digging. Nobody will question it. The same is also true for IT security. Pentesters do that sometimes; walk into the bank, walk up to the manager office or similar, wait for a few minutes, then walk back. Everyone will now assume that you talked to the manager (provided they didn't see you standing there) and you can do things like "can I plug this USB stick in? I'm from IT and were updating the anti malware software in all branches." (that actually worked, there is a DEFCON talk somewhere) So in conclusion; don't be confident someone won't dig up your powerline and start tapping it. Unless you have a habit of talking to the construction workers if they're allowed to do dig up the road.
- jamespo 9y agothis depends on the country, some are a lot more officious than others
- pixl97 9y agoEh, Couldn't you do some kind of power smoothing by DC to DC conversion over a large capacitor bank?
- FractalLP 9y agoThey had pilot BPL (broadband over power lines) projects (I think ibec comes to mind) back in the day, but the FCC doesn't like interference and the BRU (broadband regenerator units) that have to be installed every so often to fix signal degradation weren't cheap if I recall properly.
- ChuckMcM 9y agopowerbleed?
- deleted 9y ago[deleted]
- ccostes 9y agoI think you're stretching the definition (at least at a conceptual level) of "Air-Gapped" when your means of communication are connections that go through the air-gap. I guess there are probably real systems referred to as "air-gapped" that don't have power isolation they could be addressing, but it still feels a little disingenuous.
- williamscales 9y agoI would agree with your assessment. If it's connected to _something_, then it's not air-gapped, right? I've never built an air-gapped system before but I imagine that I would want to start with a room lined with copper mesh and a big battery bank.
- 3pt14159 9y agoOutside of a military context (and often even there too) air-gaps don't mean nearly as much as programmers think they do. There are too many possible ways in / out.
- BillinghamJ 9y agoPerhaps we should start going with vacuum gapping ;)
- williamscales 9y agoYes! We have to rule out the acoustic factor entirely. Better put big graphite blocks around it too for good measure.
- ClassyJacket 9y agoI'll take it a step further and suggest that highly secure applications should be causality gapped - the system is only activated when more than 5 billion light years from Earth, so no data could make it back before the sun destroys the planet. For critical applications, the system should be launched far enough from the edge of all observable matter, that it is causality gapped to the heat death of the universe.
- elliottcarlson 9y agoVan Eck phreaking came to mind immediately - which wouldn't require any remotely malicious code to be run. Anyone with more knowledge than myself know if Van Eck phreaking is still an attack vector on modern technology?
- skykooler 9y agoHigh pixel density of modern screens makes it very difficult to reconstruct the signal. That, combined with the fact that LCD displays are far less susceptible than CRT displays, makes it virtually irrelevant for many new displays. Exceptions may include TVs, which use much more power per pixel, and lower-resolution screens like those on netbooks, though now that even phones have >1080p screens these are much less common.
- SEJeff 9y agovery difficult against a state actor with effectively unlimited budget?
- roywiggins 9y agoWhat are the odds that there isn't some other, easier way? It's not that it is necessarily impossible, but if it's really quite difficult, it might not ever happen just because there's always some other, easier way. Even if you have an effectively unlimited budget.
- debt 9y agoIt’s likely that whomever exploits this would do both easier way and this way. This one is particularly great because an air gap is assumed by default to be very secure. So you may think things are fine and dandy cause you gotta fancy lil air gap but lo and behold your data has been exfiltrated through the power lines for years.
- 21 9y ago
- anfractuosity 9y agoIt sounds like they're doing something similar to this - https://pushstack.wordpress.com/2017/07/24/data-exfiltration-from-air-gapped-systems-using-power-line-communication/ https://pushstack.wordpress.com/2017/07/24/data-exfiltration... And the github page: https://github.com/dimhoff/powercom https://github.com/dimhoff/powercom
- cma 9y agoYour AI in a box is going to need batteries.
- deleted 9y ago[deleted]
- basicplus2 9y agoUPS
- jf 9y agoI was going to mention the same thing. Wouldn't using a UPS mitigate this attack?
- streb-lo 9y agoPresumably a UPS is still using a switching power supply just with a battery backup.
- pixl97 9y agoThere are many kinds of UPS's http://www.apc.com/us/en/faqs/FA157448/ http://www.apc.com/us/en/faqs/FA157448/
- deleted 9y ago[deleted]
- lainga 9y agoI knew this was Dr. Guri and his team [0] before I even opened the link. He's like a one-man factory for clever airgap traversal exploits, I don't know how he does it. I first ran into his work in a security class, covering a similar exploit using SIMD write instructions [1]. [0] https://www.researchgate.net/profile/Mordechai_Guri https://www.researchgate.net/profile/Mordechai_Guri [1] https://www.usenix.org/node/190937 https://www.usenix.org/node/190937
- newsbinator 9y agoPerhaps he built an AI on an air-gapped machine, and simply documents what it's been trying to do to escape.
- trendia 9y agoOne day the AI will escape and he won't be able to stop it that time.
- sohkamyung 9y agoIf he's smart enough, he's make a component of the AI hardwired into the air-gapped computer. Without it physically present on a system, the AI cannot operate. (This is equivalent to making genetically engineered animals or plants dependent on a nutrient that is only supplied in the lab to make sure they can't survive in the wild.)
- spitfire 9y ago> (This is equivalent to making genetically engineered animals or plants dependent on a nutrient that is only supplied in the lab to make sure they can't survive in the wild.) Nothing can go wrong with that. [1] [1] https://www.imdb.com/title/tt0107290/ https://www.imdb.com/title/tt0107290/
- labster 9y agoTechnology will always find a way.
- deleted 9y ago[deleted]
- luc_ 9y agoThis is nuts.
- basementcat 9y agoSomething like this was explored on Stack Exchange Code Golf. https://codegolf.stackexchange.com/questions/33059/draw-with-your-cpu https://codegolf.stackexchange.com/questions/33059/draw-with...
- tagh 9y agoIn this paper, we live out our secret agent fantasies...
- deleted 9y ago[deleted]
- emmelaich 9y agoNot to give people ideas, but you could hide your own computer / asic / fpga on someone's property and steal their power for bitcoin mining. Then communicate the result via powerlines.
- smt88 9y agoYeah, but where does the listening device need to be in relation to that property's power lines? I'm sure you can't listen from, say, across a city... If this is really what you want to do, you'd probably be better off siphoning power from properties that are within range of public WiFi (or semi-public, like Xfinity hotspots).
- godelmachine 9y agoThis is very interesting. Would you kindly point me towards any project/ research paper/ blog/ web site where I could learn more about this, right from the basics?
- deleted 9y ago[deleted]
- 1024core 9y ago> Then communicate the result via powerlines. Why? Just put a WiFi dongle on your machine; you control the hardware anyways. Or, put a cellular modem on it, and talk to it from anywhere in the world.
- TeMPOraL 9y agoOr plug the machine into an Ethernet-over-Powerline box, and plug the receiver outside, before the first transformer. Communicating data via powerlines is a very old thing.
- emmelaich 9y agoThe why is for concealment. If you discover a power drain you might scan for wifi. But you'd be less likely to look for a signal over power lines.
- tuxxy 9y agoThis is very interesting! In fact, I think NSA TEMPEST standards already protect against this kind of attack. For example, here is a TEMPEST certified powerline filter that protects against conducted emissions that this paper relies on: http://apitech.com/products/tempest-sdip-27-level-b-6a-ac-inline-power-filter http://apitech.com/products/tempest-sdip-27-level-b-6a-ac-in... I would love to hear more about this from someone who has experience in this.
- terminado 9y agoI think tempest hardening is probably just entry level protection for man-portable devices and vehicles. This sort of program probably crosses over into PERFECT CITIZEN territory. [0,1] [0] https://www.wsj.com/articles/SB10001424052748704545004575352983850463108 https://www.wsj.com/articles/SB10001424052748704545004575352... [1] https://twitter.com/treekisser/status/286555593307742208 https://twitter.com/treekisser/status/286555593307742208 (paywall/seo referrer hack)
- chayesfss 9y agoso, airgap and use a laptop that's charged and unplugged...got it