6 ms·

Previously: GSMem, BitWhisper, AirHopper, ODINI, PowerHammer, LED-it-GO, USBee, Bridgeware, MAGNETO, etc etc. See the other ≈50 copycat papers of the author: h

Previously: GSMem, BitWhisper, AirHopper, ODINI, PowerHammer, LED-it-GO, USBee, Bridgeware, MAGNETO, etc etc. See the other ≈50 copycat papers of the author: https://www.semanticscholar.org/author/Mordechai-Guri/2260033 https://www.semanticscholar.org/author/Mordechai-Guri/226003... At some point the author is going to run out of clever puns...

blobbers 4y ago
What do you mean by copycat? As in he takes someone else's paper and gives it a clever name? Or do you just mean he is using lots of silly methods of doing data exfil?
- bcook 4y ago
  I think they mean lots of people are copying the mentioned author.
  - spullara 4y ago
    Nope, that same author has tons of papers about exfiltrating data from air gapped systems using many different mechanisms. Copycat is the wrong way of thinking about it. All different but do the same kind of thing.
    - sasaf5 4y ago
      Cookie-cutter would be better.
      - na85 4y ago
        Repeatedly applying the question "can we leverage <computer hardware subsystem> to exfiltrate data?" is valuable research.
        m000 4y ago
        The value is pretty limited when the answer is consistently and predictably "Yes". The author is clearly an expert in exfiltration and has deep insights in the area. But instead of working on presenting the big picture, prefers to throw breadcrumbs to the community. After a dozen of "exfiltration using X" papers, one would at least expect an SoK paper.
        bawolff 4y ago
        > The value is pretty limited when the answer is consistently and predictably "Yes". If the answer was "we tried really hard, but couldn't figure it out" pretty sure the paper would not get published.
        m000 4y ago
        I know of at least two security-related workshops that explicitly call for "negative results". So, even failures in this research field are definitely publishable, if accompanied with adequate insights.
        prvit 4y ago
        It’s really not, the answer tends to be obvious.
      - bawolff 4y ago
        This feels really unfair. If it was so trivial other people would be doing it.
        prvit 4y ago
        Nonsense, most people don’t try to maximize the quantity of their academic publications.
5d8767c68926 4y ago
So all of these attacks work? Targeting different systems? Probably took non-zero effort to develop? What exactly is the problem? Let me tell you about these chemists that publish paper after paper involving carbon bonds. Like, give it a rest.
- TimTheTinker 4y ago
  My takeaway is: if an air-gapped system is compromised, just assume all data on it is at high risk of exfiltration. I won't be surprised if even the power connection becomes a future (unintended) means of data transmission.
  - ByThyGrace 4y ago
    No need to wait for the future. It already is: https://en.wikipedia.org/wiki/Power-line_communication https://en.wikipedia.org/wiki/Power-line_communication
    - sneak 4y ago
      Stock hardware, they mean.
    - waste_monk 4y ago
      Powerline communications usually needs dedicated Ethernet (or what have you) <-> power line converter... I think they meant something more like powerhammer [1] which works by controlling processor workload, causing the power draw of the system to throttle up and down in such a way that it becomes a useful exfiltration channel (assuming your adversary can tap into a distribution board and measure power usage). [1] https://arxiv.org/pdf/1804.04014.pdf https://arxiv.org/pdf/1804.04014.pdf - by the same guy as the OP paper
      - bitwize 4y ago
        Somewhere, Spacebar Heat Guy[0] is sending coded messages to his handlers via spacebar presses that linger for just 100ms or so too long... [0] https://xkcd.com/1172/ https://xkcd.com/1172/
na85 4y ago
The list you gave quite neatly illustrates why EMSEC zones exist. If your security posture includes physical exclusion out to a distance where these signals are no longer discernible above the background noise, and/or you have faraday cages built into the walls as in the case of a standard SCIF, then these attacks aren't likely to be effective.
- nicholasbraker 4y ago
  Correct. In combination with TEMPEST hardware if your information to be protected requires it.
  - na85 4y ago
    Pretty sure that the point of an EMSEC zone is to enable the use of commercial off the shelf (COTS) computing gear for classified processing. TEMPEST equipment is very expensive and a SCIF obviates the need for it. None of the SCIFs I've been in had TEMPEST gear.

blobbers 4y ago

What do you mean by copycat? As in he takes someone else's paper and gives it a clever name? Or do you just mean he is using lots of silly methods of doing data exfil?

bcook 4y ago
I think they mean lots of people are copying the mentioned author.
- spullara 4y ago
  Nope, that same author has tons of papers about exfiltrating data from air gapped systems using many different mechanisms. Copycat is the wrong way of thinking about it. All different but do the same kind of thing.
  - sasaf5 4y ago
    Cookie-cutter would be better.
    - na85 4y ago
      Repeatedly applying the question "can we leverage <computer hardware subsystem> to exfiltrate data?" is valuable research.
      - m000 4y ago
        The value is pretty limited when the answer is consistently and predictably "Yes". The author is clearly an expert in exfiltration and has deep insights in the area. But instead of working on presenting the big picture, prefers to throw breadcrumbs to the community. After a dozen of "exfiltration using X" papers, one would at least expect an SoK paper.
        bawolff 4y ago
        > The value is pretty limited when the answer is consistently and predictably "Yes". If the answer was "we tried really hard, but couldn't figure it out" pretty sure the paper would not get published.
        m000 4y ago
        I know of at least two security-related workshops that explicitly call for "negative results". So, even failures in this research field are definitely publishable, if accompanied with adequate insights.
      - prvit 4y ago
        It’s really not, the answer tends to be obvious.
    - bawolff 4y ago
      This feels really unfair. If it was so trivial other people would be doing it.
      - prvit 4y ago
        Nonsense, most people don’t try to maximize the quantity of their academic publications.

5d8767c68926 4y ago

So all of these attacks work? Targeting different systems? Probably took non-zero effort to develop? What exactly is the problem? Let me tell you about these chemists that publish paper after paper involving carbon bonds. Like, give it a rest.

TimTheTinker 4y ago
My takeaway is: if an air-gapped system is compromised, just assume all data on it is at high risk of exfiltration. I won't be surprised if even the power connection becomes a future (unintended) means of data transmission.
- ByThyGrace 4y ago
  No need to wait for the future. It already is: https://en.wikipedia.org/wiki/Power-line_communication https://en.wikipedia.org/wiki/Power-line_communication
  - sneak 4y ago
    Stock hardware, they mean.
  - waste_monk 4y ago
    Powerline communications usually needs dedicated Ethernet (or what have you) <-> power line converter... I think they meant something more like powerhammer [1] which works by controlling processor workload, causing the power draw of the system to throttle up and down in such a way that it becomes a useful exfiltration channel (assuming your adversary can tap into a distribution board and measure power usage). [1] https://arxiv.org/pdf/1804.04014.pdf https://arxiv.org/pdf/1804.04014.pdf - by the same guy as the OP paper
    - bitwize 4y ago
      Somewhere, Spacebar Heat Guy[0] is sending coded messages to his handlers via spacebar presses that linger for just 100ms or so too long... [0] https://xkcd.com/1172/ https://xkcd.com/1172/

na85 4y ago

The list you gave quite neatly illustrates why EMSEC zones exist. If your security posture includes physical exclusion out to a distance where these signals are no longer discernible above the background noise, and/or you have faraday cages built into the walls as in the case of a standard SCIF, then these attacks aren't likely to be effective.

nicholasbraker 4y ago
Correct. In combination with TEMPEST hardware if your information to be protected requires it.
- na85 4y ago
  Pretty sure that the point of an EMSEC zone is to enable the use of commercial off the shelf (COTS) computing gear for classified processing. TEMPEST equipment is very expensive and a SCIF obviates the need for it. None of the SCIFs I've been in had TEMPEST gear.