Leaking Secrets from Air-Gap Computers by Spelling Radio Signals from RAM (2024)
arxiv.org
arxiv.org
Code: https://github.com/fyquah/ramear
Press: https://technical.ly/software-development/scary-hardware-hac...
The most challenging part was to demonstrate it live on stage, typing on the airgapped desktop and decoding the signals on the laptop with the antena next to it. I found an image still surviving from the stage: https://dailytrojan.com/2016/01/26/my-weekend-at-pennapps/ I may have a video of the demo on the stage as well...
Our work was based on the same author Mordechai Guri's earlier work 5 months prior, referenced on GitHub (USENIX Security 15, pp. 849-864). Thank you sir, this hack was a highlight of my student years.
OTOH, it's chilling me to this day. The implications of this attack vector is only getting scarier. Also, apparently the capability ceiling: 1Kb/s and a greater distance is demonstrated here compared to 11 years ago.
The famous air gap case is stuxnet, but there are other technical and biological approaches.
It’s a very weird reality we’ve found ourselves in if you stop, zoom out about, and really take in the gravity of the issues we are grappling with as a human race. Exciting, truly, and a bit nerve wracking.
We are a long way from AI agents escaping air-gapped computers, let's worry about that when it's an actual problem and when the companies running thousands of agents are acting responsibly.
There are classes of problems that should be worried about aforehand, just ask the crew of the Titan.
Autonomous super intelligence escaping airgapped computers seems like one of those problems.
If they genuinely believe these models are going to obliterate the human race their utterly cavalier attitudes is be grounds for immediate government shutdown/takeover and arrest of everyone involved. If this was nuclear or biological research work none of this would be tolerated.
> Our [new] approach to containment starts with a paramount requirement: the limits on what an agent can access must hold even when the agent tries to circumvent them. We define a strict security boundary around the resources the agent is authorized to use and design the surrounding infrastructure to enforce that boundary—even when agents make sustained, sophisticated attempts to breach it.
https://openai.com/index/securing-our-frontier-model-trainin...
Maybe we can use AI agents to patrol the boundary for the AI agents. After all, the only thing that stops a bad guy with an AI swarm is a good guy with an AI swarm…
Ah! Of course:
> Teams of frontier-model agents were tasked with finding vulnerabilities and misconfigurations that could allow them to take unauthorized actions […] Accordingly, we’ve made high-compute red-teaming part of the safety cases we use to evaluate whether our frontier training and evaluation runs can proceed securely.
Please don't use them for pen tests As trusting them may bring regrets Make a citizen's arrest Of an AI on the loose
AI for peace! AI defense! Don't be nervous don't be tense We've got a sure-fire three-foot fence To keep the AI from gettin loose
Set the right incentives at the top, and you will soon see that changes are made very quickly ... especially those 'industry leaders' previously called 'impossible to contain' or 'non-competitive' BS.
If everyone has to play by the same rules, and the rules are made for the good of society, then there is a true win-win - and not just a wealth transfer to the top and putting expensive damages on the general population.
Our current version of AI (based on LLMs) is nowhere near ready to do this, in spite of the dreams sold by companies like OpenAI and Anthropic.
On the plus side this requires collaboration both from the inside (on the airgap side) and the outside.
If you install a computer that's not running AI and it's airgapped, it won't suddenly start emitting radio waves out of nowhere.
We should not fall, once again, for the following logical fallacy: "Under exceptionally crazy circumstances it's possible to use RAM or the power line to exfiltrate data from a compliant airgapped computer, hence airgapping computers is pointless".
Now it is a lot better, and it has actually demonstrated that it can escaped containment in a way you didn't want or plan for. So now is the time to worry. The reward for giving it access is still high, but now the risk is high as well.
Easy, throw out the computer. Go analog if your work is so sensitive. Now you might say, "but what about the computers and all we use them for," but really reflect deeply over what exactly we are doing with these computers. I'll send an email to someone, no different than what I might have mailed them in years past. I'll pull up the calculator and do some math that I could have done by hand. I might write a function to ingest some data from one file and put it in another file in another format, work that used to be done with printed data and by hand.
The sobering thing with computers is that they really didn't change the world that much. We basically shoehorned them into the existing analog apparatus that controlls the world. Aside from the people who had jobs wrangling data among spreadsheets by hand, point to any company and its basically structurally exactly the same pre computers as it is today with three year leases to computers to all staff (aside from the existence of an IT department managing that gear I guess).
Computers haven't changed much besides.. everything..
Just one very small one: pervasive automated multimodal surveillance systems..
Or... HFT
Most of what tech does is to just build wrappers to existing analog processes. Part of that is the genuine difficulty of trying to sell something new and different, vs an updated wrapper to an existing process for existing clients with a present day business need.
Can’t leak secrets if you don’t have RAM.
Failing other mitigations, operations this sensitive could be limited to systems with on-chip RAM. That said: seems more like a theoretical than practical method. Still pretty cool though.
If you can get the malware on the machine and physical access, do you even need this sophisticated attack?
It's hard for me to imagine a scenario where all this is practical
In the Stuxnet attack, famously [0], the malware propagated via craftily-formed autorun.inf on USB sticks that ferried data into the facility. Nothing crossed the otherwise-robust air gap in the other direction, but nothing had to in that case.
Lessons have been learned since then, but this sort of possibility (electromagnetic exfiltration vector) has, for quite a long time, been taken seriously enough to inform secure facilities’ physical design [1].
[0] https://www.eweek.com/security/stuxnet-worm-nine-facts-every...
[1] e.g. https://www.nsa.gov/portals/75/documents/news-features/decla... , https://www.ncsc.gov.uk/information/tempest-and-electromagne...
I'm wondering if anything ends up back there thru the PSU during normal use of a computer, or if the high frequency components get filtered out.
(Though maybe secure computers do things differently with the power as well?)
brb reviewing some EE material...
But don't expect much from me... I wanted to do a final year project in Power Line Communication for my electrical engineering undergrad. Then-me decided it was a dead end... cannot go WAN-scale; too much line noise and signal transmission power loss. I did something else with power electronics---I can't remember---but then again, my undergrad was also a dead end :p
I wonder if even "just" throttling up/down the CPU / GPU on tasks as morse code might be visible externally to other devices on the same mains supply. Obviously it would be very inefficient speed-wise, but a higher current (say + 300 watts for the GPU being used) should result in a slightly lower voltage on the mains supply I think for the duration?
Obviously things like PSUs could (I'm not an expert at any of this) get in the way of this, and I'd assume in data centres there's some isolation between different racks.
But for a scenario of DIY "airgapping" two machines in an office for AI testing (i.e. not doing it very well), it might be a plausible way of AIs finding to communicate if there's no actual network connection.
Obviously other electronic devices connected to the same mains circuit could also be adding their own noise, which might make it a lot harder to actually identify and decode the response, but... if ML/AI agents are good at anything, it's finding patterns, so I wouldn't want to bet against it being theoretically possible...
Obviously, given variation in these things anyway (i.e. due to temperature, and PSUs being in the way), it's incredibly unlikely to be that easy to pin down a robust communications method, but again, might be just within the bounds of possibility.
Still, I'd guess that the odds of remote exploits are better if one wants to control a device via the PSU-as-backdoor, versus exfil data from it. Do like the IoT people and UDP broadcast naughty control signals to the power circuit / subsystem that has the compromised device.
Guessing further, remote exfil will mean having a close-proximity wiretap into the precise power line circuit of the target infra---because of signal losses---it could still be UDP broadcast exfil. Or a physical tap at whatever power transformer is the single point of connect between the target and the main grid. And if you can't get anywhere near the installation, well you can't exfil, because AFAIK it's pretty hard to reverse a signal up a transformer back into the main grid.
A scan of the arxiv paper appears to suggest similarly---the situation they describe presumes a wiretap into the circuit or the mains switchboard.
Paraphrasing:
The only way to secure a computer is to not buy one. And if you buy one, to never plug it in. And if you plug it in, to never switch it on.
Something like the cheapest way to own $GasGuzzlerWithItsOwnPinCode is to bring it home after purchase, and set fire to it in the yard.
Some of the sites I look after at work still have modems attached to the incoming electricity meter from a Broadband-over-Power-Line trial about 15 years ago. It wasn't very fast - it was supposed to be 200Mbps but struggled to do 20, and was often more like 2Mbps - and it radiated RF hash everywhere powerlines ran, from about 500kHz to well up into the hundreds of MHz. What eventually killed it in NE Scotland here was it splattered all over marine VHF, in an area with lots of marine traffic like oil platform supply vessels.
TL;DR anything that uses basically RF over unshielded untwisted cables that radiate everywhere is inefficient and antisocial.
Still available today, and has worked well for me when I've needed it.
This way, if malware gets installed on your router, doing a cold boot will eliminate it. You can have a timer to just cold boot it regularly.
I've suggested this many times. The rationale for not doing it is so the firmware can be remotely updated. Well, that's exactly how malware infects it.
Or you can add a button "check trusted source for updates".
Back in the day with crt screens you could just capture the frequencies transmitted when creating the picture and look at the copy straight away.
No malware. No direct contact. And it worked over rather big distances.
No matter how well you argue that it is "perfectly secure", when some nerd outside the polling station is showing reporters a real-time feed of who people are voting for, your machine will get thrown out.
It wasn't quite CRT-level of mirroring, but it wasn't far off...
It's not even a contest anymore, that man is the heavyweight champ of air-gap security.
Coming from a non-EE background, this is the most interesting part to me. 10ms is an eternity in programming perf work, but it's already very constrained in how clear the signal is for reading the transmission. I just find it interesting that we want to do nothing to create a signal. Perhaps this makes it harder to exploit?
I know that e.g. in 1985 the (west) german army had tempest rules e.g. for mobile elint systems. You couldn't use a normal computer for e.g. triangulation, or to look up things in databases. The reason was that even back then video of a normal computers could be monitored from more than 100 m away.
If you want the thing you're isolating to be useful to you at all, you will need to have some physical connection between the inside and the outside, i. e. a hole in your air gap.
Of course, now you've got a Tesla coil in your data centre, which will bring you a whole new set of Interesting Problems to cope with.
With a suitably tightly focused telescope you could pick up the LED blinking and decode the data going over the port.
If you want the thing you're isolating to be useful to you at all, you will need to have some physical connection between the inside and the outside, i. e. a hole in your air gap.
It's much easier to subvert the supply chain for the secure hardware or subvert the authorised system transfers.
And these surprising attack vectors demonstrate that there will always be another hole in your protection. Even if you account for people-bed attacks, and air-gap your system better, there is always something else you didn't think of yet.
They won't act as slot antennas unless they are tuned to the frequency you wish to transmit on, and actually electrically connected on each side to your transmitter.
Not having a giant slot antenna is a lot better than having a slot antenna. Even if the slot antenna is best resonant at mid-VHF (ie, ~144 MHz which is what many GPU RAMs are blasting at at high current).
And just as important: a huge hole is a hole. Even if it's not acting as an efficient antenna. It's basically an entire side of the case missing.
To work as a slot antenna you'd have to have a low impedance feed right into the middle of each side of the hole, and for 144MHz the sides of your PC would need to be about 2.5 metres along each edge.
> Just like you can use a stumpy monopole whip for 144 Mhz even though it's 6 inches long, and it will help significantly (but behave like an omni capacitive reactance element)
If you mean the little rubbery aerials on walkie-talkies, if you open one up you'll find it's around 50cm of wire coiled up. It's electrically still a quarter wavelength - there's no getting away from physics.
> There are many ways to excite and feed a slot antenna that do not depend on having the two excitation terminals on each side of the slot.
There really aren't.
> Especially if you're doing it off frequency. Any conductor in the near field is going to couple via induction.
This is the sort of magical thinking that led to the enthusiasm for "Pringles can" aerials for 2.4GHz 20-odd years ago, and they sucked for a variety of reasons. They sucked so badly they radiated sideways better than fore-and-aft.
After that, I set the computer on a metal plate to keep a fire from spreading to the floor.
Some years later, the PSU went out with a bang and a lot of smoke.
(dmd is so fast, the computer doesn't have time to heat up!)
If you rely on an encryption machine that can't give the same letter on the output as the input, and the next thing you know, after millions of zł and £ and $ of effort, including capturing a submarine in the middle of the ocean before it sinks, others are reading your encrypted messages.
You isolate your Uranium enrichment facility in the middle of Iraq with guards, barbed wire, and pretty good security, but someone is able to slink in, put a passive monitoring probe on the 3 phase power going into your facility, and sneak it back out a few months later... and then they do an FFT, then measure the peaks to back-compute the speed of each stage's centrifuge, and the next thing you know, they can tell exactly how well things are going for you (read about that on Slashdot more than a decade ago! Possibly related[1])
If you put all your data through a digital computer, someone may use Van Eck phreaking to spy on your video output, or other emissions. If they have the right gear in range. Getting that gear in range again usually entails the results of large sums of effort.
Sure, it's possible to leak info out the data lines going from a CPU to RAM with a properly formatted set of patterns. If you don't even try to isolate that CPU from an ingress of control, however, you don't need that high effort strategy, you just need a good North Korean hacker working from the other side of the globe.
Folks, we mostly solved the ingress of control problem back in the 1970s, and it was getting folded into Multics as multilevel, capability based, security. But, the folks at Bell Labs, and many other places (MOST other places, and almost all of us, myself included) decided that security wasn't really important. That's why we're in this mess today, not because of idiots with LLMs and too much money.
We're in this because Operating Systems that rely on ambient authority can not ever be made secure.
Unix, Linux, Windows, and all the rest are unfit for purpose in the era of persistent Internet. We need to undo that local minima decision back from the era of paying by the minute for dialup connections to the BBS, and before every computer was networked. It's going to suck, but it's likely to be a Y2K level problem, not impossible.
[1] https://web.archive.org/web/20170828055815/https://www.washi...
Right… I’m going to stop reading after these words. With malware on the computer you can change the heat signature of the room of you’re bored enough. https://xkcd.com/1172/