5 ms·

You're mixing up two scenarios. The "international spy agency" scenario is using custom hardware listening to side channel noise from an untouched computer. Tha

You're mixing up two scenarios. The "international spy agency" scenario is using custom hardware listening to side channel noise from an untouched computer. That's stuff like decoding screen images from EMI from VGA/HDMI cables, or getting crypto keys from EMI from a CPU running standard code. That's what the whole TEMPEST thing was about decades ago. Those demos are interesting. We also use them in device security research, e.g. power or EMI analysis to extract crypto keys from a secure SoC. This guy just puts malware on the airgapped computer to force it to broadcast its secrets in the slowest, simplest, easiest to pick up way through some channel. That is not hard. His entire clickbait operation is basically predicated on the fact that people confuse these two scenarios, while they are two completely different things.

giantg2 6y ago
Exactly. It's impressive when the computer is untouched and air gapped. If you can load malware on the PC, you might as well just extract/copy the data while you're in there.
- giantg2 6y ago
  Why is this downvoted?
- ceejayoz 6y ago
  > If you can load malware on the PC, you might as well just extract/copy the data while you're in there. Not necessarily. There might be scenarios where you're permitted to bring software in, but not take anything out.
  - giantg2 6y ago
    Fair enough. You have to add taking in hardware too to read the signal.
    - ceejayoz 6y ago
      That hardware could be in the presumed-safe next room, though.
      - giantg2 6y ago
        Assuming it's a strong/clean enough RF signal and they aren't using any countermeasures, sure.
        ceejayoz 6y ago
        The point is not "this will work in every scenario". The point is "this will work in some scenarios".
        giantg2 6y ago
        I'm not saying it can't work. My point is that it's unimpressive because it won't work very well for the types of targets that they are intending it for (air gapped systems usually have a lot of other countermeasures as part of their system, especially targeting unknown RF sources).
- vlovich123 6y ago
  Stuxnet destroyed Iran’s air gapped nuclear reactors. I agree data exfil might look differently, but I’m not 100% confident there will never be a scenario where an attack like this is combined with others.
  - giantg2 6y ago
    The article was talking specifically about exfil on air gapped systems. I guess I'm just trying to say that non-intrusive side channels are more impressive to me since you cut out the need for any form of system access to plant the malware.
    - vlovich123 6y ago
      My point specifically of mentioning Stuxnet is that it’s an impressive stack up of various complex exploits. They released a neutered, self-replicating version of the virus into the wild to mask their intrusion into Iran. The virus in the wild had all the code needed to attack Siemens microcontrollers for the reactor cooling (if I recall correctly) but it was neutered unless running in the Iranian reactor (imagine trying to write such code that would correctly detect the Iranian reactors). They then used social engineering to actually get a contracted on prem to infect the air gapped computers. This created confusion in the Iranian security services long enough that Iran was brought to the negotiating table for the nuclear deal. My point here is that seemingly innocuous (or previously innocuous) methods can still be utilized. The overall attack is the thing that’s impressive (at least to me). Technical attacks are impressive. So are social ones. Ones that combine the two in novel ways to accomplish audacious goals can only be more so and having a view of “this isn’t a complete attack by itself and is therefore uninteresting” seems myopic to me. I’m more curious about how this could be leveraged to be a piece of an overall attack. For example, with very little time you could “permanently” compromise devices your victim has and spy on them without them knowing about it. Sure you don’t get C&C but if you’re just looking to monitor what’s happening may not be so bad. I definitely agree with ops point that if this is a basic technique and just a routine transformation to apply to different sensors, academically this is not interesting and a corruption of the principles of scientific publishing. As a proof of concept though it’s still valuable because you are characterizing the bitrate you’re able to get from different sensor types.
deleted 6y ago
[deleted]

giantg2 6y ago

Exactly. It's impressive when the computer is untouched and air gapped. If you can load malware on the PC, you might as well just extract/copy the data while you're in there.

giantg2 6y ago
Why is this downvoted?
ceejayoz 6y ago
> If you can load malware on the PC, you might as well just extract/copy the data while you're in there. Not necessarily. There might be scenarios where you're permitted to bring software in, but not take anything out.
- giantg2 6y ago
  Fair enough. You have to add taking in hardware too to read the signal.
  - ceejayoz 6y ago
    That hardware could be in the presumed-safe next room, though.
    - giantg2 6y ago
      Assuming it's a strong/clean enough RF signal and they aren't using any countermeasures, sure.
      - ceejayoz 6y ago
        The point is not "this will work in every scenario". The point is "this will work in some scenarios".
        giantg2 6y ago
        I'm not saying it can't work. My point is that it's unimpressive because it won't work very well for the types of targets that they are intending it for (air gapped systems usually have a lot of other countermeasures as part of their system, especially targeting unknown RF sources).
vlovich123 6y ago
Stuxnet destroyed Iran’s air gapped nuclear reactors. I agree data exfil might look differently, but I’m not 100% confident there will never be a scenario where an attack like this is combined with others.
- giantg2 6y ago
  The article was talking specifically about exfil on air gapped systems. I guess I'm just trying to say that non-intrusive side channels are more impressive to me since you cut out the need for any form of system access to plant the malware.
  - vlovich123 6y ago
    My point specifically of mentioning Stuxnet is that it’s an impressive stack up of various complex exploits. They released a neutered, self-replicating version of the virus into the wild to mask their intrusion into Iran. The virus in the wild had all the code needed to attack Siemens microcontrollers for the reactor cooling (if I recall correctly) but it was neutered unless running in the Iranian reactor (imagine trying to write such code that would correctly detect the Iranian reactors). They then used social engineering to actually get a contracted on prem to infect the air gapped computers. This created confusion in the Iranian security services long enough that Iran was brought to the negotiating table for the nuclear deal. My point here is that seemingly innocuous (or previously innocuous) methods can still be utilized. The overall attack is the thing that’s impressive (at least to me). Technical attacks are impressive. So are social ones. Ones that combine the two in novel ways to accomplish audacious goals can only be more so and having a view of “this isn’t a complete attack by itself and is therefore uninteresting” seems myopic to me. I’m more curious about how this could be leveraged to be a piece of an overall attack. For example, with very little time you could “permanently” compromise devices your victim has and spy on them without them knowing about it. Sure you don’t get C&C but if you’re just looking to monitor what’s happening may not be so bad. I definitely agree with ops point that if this is a basic technique and just a routine transformation to apply to different sensors, academically this is not interesting and a corruption of the principles of scientific publishing. As a proof of concept though it’s still valuable because you are characterizing the bitrate you’re able to get from different sensor types.

deleted 6y ago

[deleted]