6 ms·
A new day and a "new" air-gap exfiltration from this dude. What ENI generating buses and peripherals are left now that he's done sata, dram, cpu, fanspeed and e
by RF_Savage 4y ago
A new day and a "new" air-gap exfiltration from this dude.
What ENI generating buses and peripherals are left now that he's done sata, dram, cpu, fanspeed and ethernet?
- _8j50 4y agoBen-Gurion seems to generate a lot of papers like this. Makes me wonder about the secret spy stuff that doesn't get published.
- nibbleshifter 4y agoIts one guys lab there (Mordecai). They basically churn out a metric fuckload of the same thing, different bus. None of it makes for a practical attack.
- ivraatiems 4y agoThis feels like one of those classic things, though, where you read this and go "ha ha, that'll never be valuable or even work in real life", and then in ten years you read an article that's something like "Hackers Steal Ugandan President's Credit Card Data by Reading a Single Bit". Identifying attack vectors is just building up an arsenal of tools that can potentially be used depending on the circumstance.
- QuarterReptile 4y agoThe standardization of protocols and physical components on computers, paired with the accessibility of global wealth from computers, means that the payout is always there for obscure attacks. They just may have to be incorporated into large toolsets with significant automation to know when it's the right tool for the job.
- TedDoesntTalk 4y agoTheft of Bitcoin wallet private key from a well-known Bitcoin billionaire seems applicable.
- R0b0t1 4y agoIt's not that. It's more that it's just... obvious.
- selfhoster11 4y ago> This feels like one of those classic things, though, where you read this and go "ha ha, that'll never be valuable or even work in real life" Isn't this basically the exact thing that everyone thought before the Intel CPU bugs began emerging en-masse?
- duskwuff 4y ago> They basically churn out a metric fuckload of the same thing, different bus. Notably, most of the attacks from Mordechai's lab describe low-bandwidth channels for deliberate data exfiltration. These attacks would only apply in unusual situations where an attacker can run arbitrary code on a machine, but the machine is isolated from the outside world. (Scenarios like Iranian nuclear facilities come to mind.)
- _8j50 4y agoYou say that but I am actively dealing with a chinese malware(public info) I won't name that does just that but with USB. It sideloads a dll when a shortcut opens a legit app on a USB (shortcut is tricky in that it looke like a folder and opens a folder also when you click on it) it then collecte all kinds of documents and exfils to the internet but if there is no internet it archives it back to the USB so next time it runs with internet access it will also exfil any docs on the USB from the airgapped machines, fortunately just a spillover infection for us but these tricks in the paper would enable to not wait for a USB or internet access, it would be more realtime. Like if it is an ICS system for nuclear centrifuges it will send back what ir found and accept destructive tasks.
- userbinator 4y agoYou still need a receiver within range in order to do this.
- rtev 4y agoSomeone attacking a nuclear facility can get a receiver within range
- toomanybeersies 4y agoWouldn't there the small matter of a few meters of concrete attenuating any signals coming from a nuclear facility?
- RF_Savage 4y ago
- IncRnd 4y agoThey are practical, just not widespread. There is no reason for them to be widespread. One use-case is to obtain data from air-gapped machines that do not connect to the Internet. More broadly, these are for targeted attacks not for dumping JS onto everyone who visits wikipedia.
- thrashh 4y agoThese are all practical attacks. Most of us are just not the right customer for them For most people, if you are trying to exfiltrate some customer data to sell on the black market, are you going to spend a bunch of development time blinking a LED and setting up a receiver? Nah you’d just move to some other victim because you are trying to make a profit, not waste more money But someone like a government trying to spy on another country… the cost of spies is pretty high… but pay some engineers to spend all day trying to make a LED blink some data is relatively cheap That said, I think a lot of these attacks are kind of boring even if they were unpublished. If anyone here was paid 6 figures to do nothing all day but figure out some obscure variables in your computers to flip to exfiltrate some data, I’d be disappointed if you couldn’t figure anything out. I think most of these attacks are kind of obvious.
- goodpoint 4y agoThey are all very practical, just not often needed.
- synicalx 4y ago> None of it makes for a practical attack. None of what gets released publicly makes for a practical attack. No quicker way to get people to stop looking for your attack vector than to convince them it doesn't work. Now if you'll excuse me, I need to go and re-wrap my head in tin foil.
- kortex 4y agoHard drive access LED, optical disk servo, and the piezoelectric discharge due to thermal rise/fall of the GPU. I'm only half joking.
- klysm 4y ago> the piezoelectric discharge due to thermal rise/fall of the GPU now this is something id like to see!
- maicro 4y agoI don't remember which rule of the internet claims that there's always a relevant XKCD, but - relevant XKCD: https://xkcd.com/1172/ https://xkcd.com/1172/
- Maursault 4y agoThough that is probably true, it doesn't sound like it is one of the Rules of the Internet. But it does sound a lot like Rule 34.
- runnerup 4y agoThere was an exploit which caused "air-gapped" servers on the bottom of a rack to undergo heat/cool cycles so that servers above it in the same rack could sense the low-frequency digital temperature signal via their own temperature sensors.
- detaro 4y ago> Hard drive access LED He's done that one: https://arxiv.org/abs/1702.06715 https://arxiv.org/abs/1702.06715
- cyanydeez 4y agoJust aggregate them with a super spy wand and count how many attempts are possible