4 ms·

A few months ago I read a comment lamenting about all of these "novel" airgap "attacks" that are just all variants on the same theme of "figure out a new side-c

by fouric 5y ago

A few months ago I read a comment lamenting about all of these "novel" airgap "attacks" that are just all variants on the same theme of "figure out a new side-channel to send data between two complicit devices over". You can use memory module busses, power/camera/keyboard LEDs, fan speeds, ultrasound emitted from speakers...it's not very interesting, at this point. I bet that I can come up with a new one off the top of my head...alright, how about malware that imperceptibly dims/brightens the screen, which could be interpreted as a 1-bit symbol and picked up even when the screen is facing away from the receiver (by observing the reflection off of a nearby surface)? See also https://news.ycombinator.com/item?id=28394826 https://news.ycombinator.com/item?id=28394826. These aren't "attacks" - these are methods of data exfiltration between two compromised devices. There are attacks that e.g. steal private RSA keys by capturing the EM radiation during cryptographic operations, but this is not that.

ddtaylor 5y ago
exfacetrate
suifbwish 5y ago
It’s also worth noting that the resolution of the receiver or level of sensitivity required for actually receiving the data from these mediums from any considerable distance (from within a metal computer chassis case) even if it exists, will not be something that is likely attainable by a non nation state. Also the amount of man hours required to set up a working receiver that is outside of detectable range would be too expensive to consider using this tech against anything but an extremely valuable target. There are of course other possible methods of pulling this off such as if a nearby mobile device is compromised it could be used to listen and repeat the weak RF signal coming from the memory but that would be another level of complexity keeping this from being an efficient technique. Also of note is that there would be no way for the listener to reliably communicate with the compromised airgapped device to update their code if there is a problem so the communication would be similar to one way UDP.
na85 5y ago
>You can use memory module busses, power/camera/keyboard LEDs, fan speeds, ultrasound emitted from speakers...it's not very interesting, at this point. This is why classified information is typically handled in a SCIF (Sensitive Compartmentalized Information Facility, "skiff"). It's an implementation of defense-in-depth; the idea that an adversary must breach several layers of physical and digital security to compromise your secrets. These attacks are of little use at the National Defense level because they would require installing e.g. a receiving antenna within 6 feet of a compromised machine. In other words, to leverage this attack you'd have to achieve a total collapse of your adversary's classified processing security posture. Well, if you can effect that then you don't need this attack.
pessimizer 5y ago
Is that particularly insightful? What other form would attacks take between computers that lack a traditional communication channel than to create another communication channel?

by fouric 5y ago

ddtaylor 5y ago

exfacetrate

suifbwish 5y ago

It’s also worth noting that the resolution of the receiver or level of sensitivity required for actually receiving the data from these mediums from any considerable distance (from within a metal computer chassis case) even if it exists, will not be something that is likely attainable by a non nation state. Also the amount of man hours required to set up a working receiver that is outside of detectable range would be too expensive to consider using this tech against anything but an extremely valuable target. There are of course other possible methods of pulling this off such as if a nearby mobile device is compromised it could be used to listen and repeat the weak RF signal coming from the memory but that would be another level of complexity keeping this from being an efficient technique. Also of note is that there would be no way for the listener to reliably communicate with the compromised airgapped device to update their code if there is a problem so the communication would be similar to one way UDP.

na85 5y ago

>You can use memory module busses, power/camera/keyboard LEDs, fan speeds, ultrasound emitted from speakers...it's not very interesting, at this point. This is why classified information is typically handled in a SCIF (Sensitive Compartmentalized Information Facility, "skiff"). It's an implementation of defense-in-depth; the idea that an adversary must breach several layers of physical and digital security to compromise your secrets. These attacks are of little use at the National Defense level because they would require installing e.g. a receiving antenna within 6 feet of a compromised machine. In other words, to leverage this attack you'd have to achieve a total collapse of your adversary's classified processing security posture. Well, if you can effect that then you don't need this attack.

pessimizer 5y ago

Is that particularly insightful? What other form would attacks take between computers that lack a traditional communication channel than to create another communication channel?