5 ms·

I love these extreme air gap exploits. Detecting keyboard entry by analyzing the sound of the typing and reading CRT monitor radiation to mirror the screen from

by jjeaff 4y ago

I love these extreme air gap exploits. Detecting keyboard entry by analyzing the sound of the typing and reading CRT monitor radiation to mirror the screen from a distance come to mind. But have any of these extreme exploits ever been used in the wild? They all seem impossible to pull off in anything but lab controlled conditions.

Tostino 4y ago
We'll eventually find out when the latest iteration of something like Stuxnet is found in the wild...if it still leaves enough of a trace to be found.
- Schroedingersat 4y ago
  Don't worry. The latest iteration will be running on the psp via the private key and will have ring -1 access.
serf 4y ago
van eck phreaking has been used successfully against electronic ballot machines.[0] apparently it was demonstrated practically during the Korean War; but I can't find anything much about that. [0]: https://yro.slashdot.org/story/09/11/22/027229/Brazilian-Breaks-Secrecy-of-Brazils-E-Voting-Machines-With-Van-Eck-Phreaking https://yro.slashdot.org/story/09/11/22/027229/Brazilian-Bre...
NovemberWhiskey 4y ago
This is not exactly that - this is the use of a SATA bus as an RF radiator to do a (very slow) covert exfiltration channel from an air-gapped computer.
- cogman10 4y ago
  Yeah... but I mean, if the computer is in a steel/aluminum box (likely) then both the distances and locations you can be to be able to intercept that 6ghz signal are pretty limited. It's a neat attack, but to pull it off you pretty much need both physical access AND the ability to install virused software on the target. Perhaps something the CIA/NSA pull off such as stuxnet? Even then, the point of an air-gapped computer is that installing such software would be pretty difficult in the first place.
  - thrashh 4y ago
    I mean if the stakes were high enough If I told you that you could make 500 million dollars (after taxes) if you figured this out, suddenly you would be on top of this. The stakes of Stuxnet was probably “the safety of the free world” in the eyes of the people who paid for the work
    - cogman10 4y ago
      I don't mean that the attack isn't possible/wouldn't necessarily work. I'm saying it's impractical given that one of the steps to execute it is "have physical access to the machine, the ability to install software, and time to sit around and record the outbound data (or to be able to revisit the site and collect a recording device)." With each of those requirements, there are easier and faster ways to get data off a machine. If you can install software you can likely download data that software would access. If you can access the machine twice and install software that runs in the background between visits, you can install your keylogger/data collectors and simply record the data on the device. Stuxnet wasn't about getting data out of the machine, it was about breaking machines. It worked well because it didn't require physical access to the machines. It spread as a virus through the regular updates that Iran was doing for their machines. If you had such a stuxnet virus in your back pocket, then you can likely steal the data and record it back on the USB device (or any plugged in USB device) on the system.
      - thrashh 4y ago
        I was more referring to Stuxnet as an example of someone who is willing to spend the money on people to figure out some obscure techniques Spy agencies have definitely used obscure data exfiltration techniques and they can afford spies.
jagger27 4y ago
I'd say it's a solid "no", and the author says as much in the paper. > We transmitted the data with a bit rate of 1 bit/sec, which is shown to be the minimal time to generate a signal which is strong enough for modulation. The BER for PC-1 is presented in Table VI. As can be seen, the BER of 1% - 5% is maintained between 0 - 90 cm. With a greater distance of 120 cm, the BER is significantly higher and reaches 15%. With PC-2 and PC-3, the bit error rates (BER) are less than 5% only in short proximity up to 30 cm, and hence the attack is relevant only for short ranges in these computers. This particular attack is a weak 6 GHz signal that can exfil about 1 bit/s from a metre away. It's neat, but impractical.
- leeter 4y ago
  Pretty sure a ferrite beads can shut this down anyway. But this seems like a more practical question of "If they can get that close do they really need this?" They've already had USB or software access in some form already.
  - cogman10 4y ago
    Yup, that's the part that makes this attack completely impractical. You are trying to leak information but first you have to install a virus on the computer? Neat concept, wildly impractical.
    - PeterisP 4y ago
      I mean, Stuxnet is an illustrative example that has been seen in the wild (and the rare exception of one that became public - in general, if you'd be the target of something like this and found out, the results of that analysis would be classified and unpublishable), and there have been almost 20 years to do improvements since Stuxnet was first developed, so there definitely are real attacks aiming to do stuff and/or exfiltrate data from air-gapped computers after "installing a virus on the computer" - and it's quite clear that Stuxnet did achieve a significant practical effect.
- lallysingh 4y ago
  Enough for cryptographic key material, but not much else. Still, publishing which methods are a risk, and which ones aren't, is quite useful.
_8j50 4y ago
Yeah, Snowden mentioned in his experience at NSA they did use tricks like this and this was late 2000's. There is an interview he gives where he goes under a blanket to type his password on a laptop to avoid the crt reader thingy.
- glenstein 4y ago
  Is there any source that it was the crt reading thing specifically? I remember that part of the documentary but I am still wondering if he had a specific attack in mind when he did that.
- ekianjo 4y ago
  there is no crt on a laptop
  - R0b0t1 4y ago
    not with that attitude that said I've seen signal recovery from LVDS
- FreakLegion 4y ago
  Van Eck phreaking works through walls. I haven't seen the interview but most likely he was just hiding the physical act of typing, since that too can leak information about a password.
- lallysingh 4y ago
  Password prompts usually don't show the passwords you're typing in.
  - jacquesm 4y ago
    Your fingers are hitting the keys.
    - lazide 4y ago
      What would that have to do with a CRT?
dylan604 4y ago
I think Tom Cruise did this once in "Mission:Impossible 32"
AdamJacobMuller 4y ago
> But have any of these extreme exploits ever been used in the wild? I suspect you're going to find out in 50 years when government documents (not inherently US gov) are declassified. State level spying is the only thing I can think of where the value of the information is so high (making the effort of this kind of attack is worth it) and where there are many scenarios where the volume of highly valuable information is comparatively tiny. Just as some very off the cuff examples of what I mean by the latter. We don't need to exfiltrate satellite photos of things (gigabytes of data), but, it could be very valuable to exfiltrate the metadata of what they are looking at (coordinates and time) Also, exfiltrating information like names of sources or meeting points or other methods can be trivial amounts of data but finding even a single compromised person on our side would be immensely valuable! I'm reminded of "The Thing": https://en.wikipedia.org/wiki/The_Thing_%28listening_device%29 https://en.wikipedia.org/wiki/The_Thing_%28listening_device%...
- moltude 4y ago
  didn't stuxnet jump into an air gaped system? I'm curious if there is significant difference between egress and ingress into air gaped systems.
  - legalcorrection 4y ago
    I thought a thumbdrive was the attack vector for stuxnet.
    - TedDoesntTalk 4y ago
      Correct: https://www.theverge.com/2012/4/12/2944329/stuxnet-computer-virus-planted-israeli-agent-iran https://www.theverge.com/2012/4/12/2944329/stuxnet-computer-...
  - SketchySeaBeast 4y ago
    > I'm curious if there is significant difference between egress and ingress into air gaped systems. I would expect so. I'm fairly certain there's a big difference between pulling fuzzy data out and figuring out what it means as opposed to trying to electromagnetically fling fuzzy data into a system that's not supposed to have information flung at it and having the system accept what you mean.
evan_ 4y ago
Not exactly the same thing, because it required modifying the devices in question, but during the Cold War the Soviets managed to implant some really fascinating bugs into typewriters used inside the US Embassy: https://www.cryptomuseum.com/covert/bugs/selectric/ https://www.cryptomuseum.com/covert/bugs/selectric/
- jerf 4y ago
  Yeah... it's hard to know what exactly they get up to in that world, but the floor put under their capabilities by what has been publicly exposed doesn't exactly support the "nah, it's all too hard and nobody would ever bother" argument at all. Even if we assume without real reason to do so that we've heard the most impressive stuff from them, but it's just a small sampling of the number of times they've used it, if your adversary is a state-level actor, you should assume the very, very worst. If you're wrong, it won't be by much. Read Google's Project Zero blog, too: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ We don't know that these exploits in particular are used, but consider that Project Zero is the moral equivalent of a hobby for Google. What would it look like to have hundreds of people at that rough skill level, training each other, practicing all the time, and building software support for each other? The capabilities of attackers are not bounded by your imagination.
orangepurple 4y ago
Soviet agents secretly installed tiny sensing devices in about a dozen embassy typewriters. The devices picked up the contents of documents typed by embassy secretaries and transmitted them by antennas hidden in the embassy walls. The antennas, in turn, relayed the signals to a listening post outside the embassy. “Depending on the location of the bugged typewriters, the Soviets were able to receive copies of everything from routine administrative memos to highly classified documents. “One intelligence officer said the potential compromise of sensitive information should be viewed with ‘considerable seriousness.’ “Another intelligence expert said no one knows for sure how many or what secrets were compromised. A third official called the entire affair a fiasco. https://media.defense.gov/2021/Jul/13/2002761779/-1/-1/0/LEARNINGFROMTHEENEMYGUNMAN.PDF https://media.defense.gov/2021/Jul/13/2002761779/-1/-1/0/LEA...
nonrandomstring 4y ago
> But have any of these extreme exploits ever been used in the wild? They all seem impossible to pull off in anything but lab controlled conditions. Not at all. I've seen clearly with my own eyes the image of one persons VT100 CRT tube appearing on another across the room because the ground shielding had disconnected. If you have a high gain YAGI antenna, digital RF buffers and some fancy modern DSP lord only knows what you can snoop through the walls. Most of this is solved by having a simple metal (steel) PC case and grounding the PSU though. Use good quality cables with FCC/IEC badges not the bargain bucket Chinese ones.
- ConstantVigil 4y ago
  I used to see this happen with our old TV's at an old house with really bad grounding. I always wondered why it did that. We could be playing a video game or movie, and set all the other tv's to channel 2 or something like that, while we played on channel 1. You could see the action on each of them. Almost 1:1 on the reaction times, albeit a little fuzzy.
- fortran77 4y ago
  "Yagi" isn't an acronym.
  - nonrandomstring 4y ago
    I learned something today. "The antenna was invented in 1926 by Shintaro Uda of Tohoku Imperial University, Japan, with a lesser role played by his colleague Hidetsugu Yagi." [1] [1] https://en.wikipedia.org/wiki/Yagi%E2%80%93Uda_antenna#Origins https://en.wikipedia.org/wiki/Yagi%E2%80%93Uda_antenna#Origi...

by jjeaff 4y ago

Tostino 4y ago

We'll eventually find out when the latest iteration of something like Stuxnet is found in the wild...if it still leaves enough of a trace to be found.

Schroedingersat 4y ago
Don't worry. The latest iteration will be running on the psp via the private key and will have ring -1 access.

serf 4y ago

van eck phreaking has been used successfully against electronic ballot machines.[0] apparently it was demonstrated practically during the Korean War; but I can't find anything much about that. [0]: https://yro.slashdot.org/story/09/11/22/027229/Brazilian-Breaks-Secrecy-of-Brazils-E-Voting-Machines-With-Van-Eck-Phreaking https://yro.slashdot.org/story/09/11/22/027229/Brazilian-Bre...

NovemberWhiskey 4y ago

This is not exactly that - this is the use of a SATA bus as an RF radiator to do a (very slow) covert exfiltration channel from an air-gapped computer.

cogman10 4y ago
Yeah... but I mean, if the computer is in a steel/aluminum box (likely) then both the distances and locations you can be to be able to intercept that 6ghz signal are pretty limited. It's a neat attack, but to pull it off you pretty much need both physical access AND the ability to install virused software on the target. Perhaps something the CIA/NSA pull off such as stuxnet? Even then, the point of an air-gapped computer is that installing such software would be pretty difficult in the first place.
- thrashh 4y ago
  I mean if the stakes were high enough If I told you that you could make 500 million dollars (after taxes) if you figured this out, suddenly you would be on top of this. The stakes of Stuxnet was probably “the safety of the free world” in the eyes of the people who paid for the work
  - cogman10 4y ago
    I don't mean that the attack isn't possible/wouldn't necessarily work. I'm saying it's impractical given that one of the steps to execute it is "have physical access to the machine, the ability to install software, and time to sit around and record the outbound data (or to be able to revisit the site and collect a recording device)." With each of those requirements, there are easier and faster ways to get data off a machine. If you can install software you can likely download data that software would access. If you can access the machine twice and install software that runs in the background between visits, you can install your keylogger/data collectors and simply record the data on the device. Stuxnet wasn't about getting data out of the machine, it was about breaking machines. It worked well because it didn't require physical access to the machines. It spread as a virus through the regular updates that Iran was doing for their machines. If you had such a stuxnet virus in your back pocket, then you can likely steal the data and record it back on the USB device (or any plugged in USB device) on the system.
    - thrashh 4y ago
      I was more referring to Stuxnet as an example of someone who is willing to spend the money on people to figure out some obscure techniques Spy agencies have definitely used obscure data exfiltration techniques and they can afford spies.

jagger27 4y ago

I'd say it's a solid "no", and the author says as much in the paper. > We transmitted the data with a bit rate of 1 bit/sec, which is shown to be the minimal time to generate a signal which is strong enough for modulation. The BER for PC-1 is presented in Table VI. As can be seen, the BER of 1% - 5% is maintained between 0 - 90 cm. With a greater distance of 120 cm, the BER is significantly higher and reaches 15%. With PC-2 and PC-3, the bit error rates (BER) are less than 5% only in short proximity up to 30 cm, and hence the attack is relevant only for short ranges in these computers. This particular attack is a weak 6 GHz signal that can exfil about 1 bit/s from a metre away. It's neat, but impractical.

leeter 4y ago
Pretty sure a ferrite beads can shut this down anyway. But this seems like a more practical question of "If they can get that close do they really need this?" They've already had USB or software access in some form already.
- cogman10 4y ago
  Yup, that's the part that makes this attack completely impractical. You are trying to leak information but first you have to install a virus on the computer? Neat concept, wildly impractical.
  - PeterisP 4y ago
    I mean, Stuxnet is an illustrative example that has been seen in the wild (and the rare exception of one that became public - in general, if you'd be the target of something like this and found out, the results of that analysis would be classified and unpublishable), and there have been almost 20 years to do improvements since Stuxnet was first developed, so there definitely are real attacks aiming to do stuff and/or exfiltrate data from air-gapped computers after "installing a virus on the computer" - and it's quite clear that Stuxnet did achieve a significant practical effect.
lallysingh 4y ago
Enough for cryptographic key material, but not much else. Still, publishing which methods are a risk, and which ones aren't, is quite useful.

_8j50 4y ago

Yeah, Snowden mentioned in his experience at NSA they did use tricks like this and this was late 2000's. There is an interview he gives where he goes under a blanket to type his password on a laptop to avoid the crt reader thingy.

glenstein 4y ago
Is there any source that it was the crt reading thing specifically? I remember that part of the documentary but I am still wondering if he had a specific attack in mind when he did that.
ekianjo 4y ago
there is no crt on a laptop
- R0b0t1 4y ago
  not with that attitude that said I've seen signal recovery from LVDS
FreakLegion 4y ago
Van Eck phreaking works through walls. I haven't seen the interview but most likely he was just hiding the physical act of typing, since that too can leak information about a password.
lallysingh 4y ago
Password prompts usually don't show the passwords you're typing in.
- jacquesm 4y ago
  Your fingers are hitting the keys.
  - lazide 4y ago
    What would that have to do with a CRT?

dylan604 4y ago

I think Tom Cruise did this once in "Mission:Impossible 32"

AdamJacobMuller 4y ago

> But have any of these extreme exploits ever been used in the wild? I suspect you're going to find out in 50 years when government documents (not inherently US gov) are declassified. State level spying is the only thing I can think of where the value of the information is so high (making the effort of this kind of attack is worth it) and where there are many scenarios where the volume of highly valuable information is comparatively tiny. Just as some very off the cuff examples of what I mean by the latter. We don't need to exfiltrate satellite photos of things (gigabytes of data), but, it could be very valuable to exfiltrate the metadata of what they are looking at (coordinates and time) Also, exfiltrating information like names of sources or meeting points or other methods can be trivial amounts of data but finding even a single compromised person on our side would be immensely valuable! I'm reminded of "The Thing": https://en.wikipedia.org/wiki/The_Thing_%28listening_device%29 https://en.wikipedia.org/wiki/The_Thing_%28listening_device%...

moltude 4y ago
didn't stuxnet jump into an air gaped system? I'm curious if there is significant difference between egress and ingress into air gaped systems.
- legalcorrection 4y ago
  I thought a thumbdrive was the attack vector for stuxnet.
  - TedDoesntTalk 4y ago
    Correct: https://www.theverge.com/2012/4/12/2944329/stuxnet-computer-virus-planted-israeli-agent-iran https://www.theverge.com/2012/4/12/2944329/stuxnet-computer-...
- SketchySeaBeast 4y ago
  > I'm curious if there is significant difference between egress and ingress into air gaped systems. I would expect so. I'm fairly certain there's a big difference between pulling fuzzy data out and figuring out what it means as opposed to trying to electromagnetically fling fuzzy data into a system that's not supposed to have information flung at it and having the system accept what you mean.

evan_ 4y ago

Not exactly the same thing, because it required modifying the devices in question, but during the Cold War the Soviets managed to implant some really fascinating bugs into typewriters used inside the US Embassy: https://www.cryptomuseum.com/covert/bugs/selectric/ https://www.cryptomuseum.com/covert/bugs/selectric/

jerf 4y ago
Yeah... it's hard to know what exactly they get up to in that world, but the floor put under their capabilities by what has been publicly exposed doesn't exactly support the "nah, it's all too hard and nobody would ever bother" argument at all. Even if we assume without real reason to do so that we've heard the most impressive stuff from them, but it's just a small sampling of the number of times they've used it, if your adversary is a state-level actor, you should assume the very, very worst. If you're wrong, it won't be by much. Read Google's Project Zero blog, too: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ We don't know that these exploits in particular are used, but consider that Project Zero is the moral equivalent of a hobby for Google. What would it look like to have hundreds of people at that rough skill level, training each other, practicing all the time, and building software support for each other? The capabilities of attackers are not bounded by your imagination.

orangepurple 4y ago

Soviet agents secretly installed tiny sensing devices in about a dozen embassy typewriters. The devices picked up the contents of documents typed by embassy secretaries and transmitted them by antennas hidden in the embassy walls. The antennas, in turn, relayed the signals to a listening post outside the embassy. “Depending on the location of the bugged typewriters, the Soviets were able to receive copies of everything from routine administrative memos to highly classified documents. “One intelligence officer said the potential compromise of sensitive information should be viewed with ‘considerable seriousness.’ “Another intelligence expert said no one knows for sure how many or what secrets were compromised. A third official called the entire affair a fiasco. https://media.defense.gov/2021/Jul/13/2002761779/-1/-1/0/LEARNINGFROMTHEENEMYGUNMAN.PDF https://media.defense.gov/2021/Jul/13/2002761779/-1/-1/0/LEA...

nonrandomstring 4y ago

> But have any of these extreme exploits ever been used in the wild? They all seem impossible to pull off in anything but lab controlled conditions. Not at all. I've seen clearly with my own eyes the image of one persons VT100 CRT tube appearing on another across the room because the ground shielding had disconnected. If you have a high gain YAGI antenna, digital RF buffers and some fancy modern DSP lord only knows what you can snoop through the walls. Most of this is solved by having a simple metal (steel) PC case and grounding the PSU though. Use good quality cables with FCC/IEC badges not the bargain bucket Chinese ones.

ConstantVigil 4y ago
I used to see this happen with our old TV's at an old house with really bad grounding. I always wondered why it did that. We could be playing a video game or movie, and set all the other tv's to channel 2 or something like that, while we played on channel 1. You could see the action on each of them. Almost 1:1 on the reaction times, albeit a little fuzzy.
fortran77 4y ago
"Yagi" isn't an acronym.
- nonrandomstring 4y ago
  I learned something today. "The antenna was invented in 1926 by Shintaro Uda of Tohoku Imperial University, Japan, with a lesser role played by his colleague Hidetsugu Yagi." [1] [1] https://en.wikipedia.org/wiki/Yagi%E2%80%93Uda_antenna#Origins https://en.wikipedia.org/wiki/Yagi%E2%80%93Uda_antenna#Origi...