Hacker News Reader

Comment by noname120 | Hacker News Reader

Previously: GSMem, BitWhisper, AirHopper, ODINI, PowerHammer, LED-it-GO, USBee, Bridgeware, MAGNETO, etc etc.

See the other ≈50 copycat papers of the author: https://www.semanticscholar.org/author/Mordechai-Guri/226003...

At some point the author is going to run out of clever puns...

So all of these attacks work? Targeting different systems? Probably took non-zero effort to develop? What exactly is the problem?

Let me tell you about these chemists that publish paper after paper involving carbon bonds. Like, give it a rest.

My takeaway is: if an air-gapped system is compromised, just assume all data on it is at high risk of exfiltration.

I won't be surprised if even the power connection becomes a future (unintended) means of data transmission.

No need to wait for the future. It already is:

https://en.wikipedia.org/wiki/Power-line_communication

Stock hardware, they mean.

Powerline communications usually needs dedicated Ethernet (or what have you) <-> power line converter... I think they meant something more like powerhammer [1] which works by controlling processor workload, causing the power draw of the system to throttle up and down in such a way that it becomes a useful exfiltration channel (assuming your adversary can tap into a distribution board and measure power usage).

[1] https://arxiv.org/pdf/1804.04014.pdf - by the same guy as the OP paper

Somewhere, Spacebar Heat Guy[0] is sending coded messages to his handlers via spacebar presses that linger for just 100ms or so too long...

[0] https://xkcd.com/1172/

Every now and then we fix some side-effect-having bug in our codebase that makes me think of SHG. What a lad.

> I won't be surprised if even the power connection becomes a future (unintended) means of data transmission.

That's already a thing. From the same author as the TFA, PowerHammer [1] exfiltrates data using current flow fluctuations. There's also Powermitter [2] (from some researchers at Wuhan University), which is exfiltration via power supply EMF leakage.

[1] https://arxiv.org/pdf/1804.04014.pdf

[2] https://ieeexplore.ieee.org/document/8300280

These attacks work against defenders that can’t be bothered to implement WW2 era defences. These kinds of “attacks” have been well understood for a good 70 years now.

It’s simply restating the obvious. Nothing has changed, unshielded electronics continue to let out measurable EM emissions. The people who worry about this sort of thing have been shielding their electronics since well before computers as we know them existed.

> Probably took non-zero effort to develop?

In the sense that doing anything takes non-zero effort by definition.

What do you mean by copycat? As in he takes someone else's paper and gives it a clever name? Or do you just mean he is using lots of silly methods of doing data exfil?

I think they mean lots of people are copying the mentioned author.

Nope, that same author has tons of papers about exfiltrating data from air gapped systems using many different mechanisms. Copycat is the wrong way of thinking about it. All different but do the same kind of thing.

Cookie-cutter would be better.

Repeatedly applying the question "can we leverage <computer hardware subsystem> to exfiltrate data?" is valuable research.

The value is pretty limited when the answer is consistently and predictably "Yes".

The author is clearly an expert in exfiltration and has deep insights in the area. But instead of working on presenting the big picture, prefers to throw breadcrumbs to the community. After a dozen of "exfiltration using X" papers, one would at least expect an SoK paper.

> The value is pretty limited when the answer is consistently and predictably "Yes".

If the answer was "we tried really hard, but couldn't figure it out" pretty sure the paper would not get published.

I know of at least two security-related workshops that explicitly call for "negative results". So, even failures in this research field are definitely publishable, if accompanied with adequate insights.

It’s really not, the answer tends to be obvious.

This feels really unfair.

If it was so trivial other people would be doing it.

Nonsense, most people don’t try to maximize the quantity of their academic publications.

The list you gave quite neatly illustrates why EMSEC zones exist. If your security posture includes physical exclusion out to a distance where these signals are no longer discernible above the background noise, and/or you have faraday cages built into the walls as in the case of a standard SCIF, then these attacks aren't likely to be effective.

Correct. In combination with TEMPEST hardware if your information to be protected requires it.

Pretty sure that the point of an EMSEC zone is to enable the use of commercial off the shelf (COTS) computing gear for classified processing. TEMPEST equipment is very expensive and a SCIF obviates the need for it.

None of the SCIFs I've been in had TEMPEST gear.

Reply on news.ycombinator.com