Comment by peter_d_sherman | Hacker News Reader

Comment by peter_d_sherman | Hacker News Reader

peter_d_sherman

Excerpt:

"In past research, Guri and his team at the Ben-Gurion university's Cyber-Security Research Center have shown that attackers could steal data from secure systems using a plethora of techniques such as:

LED-it-Go - exfiltrate data from air-gapped systems via an

HDD's activity LED

USBee - force a USB connector's data bus give out electromagnetic emissions that can be used to exfiltrate data

AirHopper - use the local GPU card to emit electromagnetic signals to a nearby mobile phone, also used to steal data

Fansmitter - steal data from air-gapped PCs using sounds emanated by a computer's GPU fan

DiskFiltration - use controlled read/write HDD operations to steal data via sound waves

BitWhisper - exfiltrate data from non-networked computers using heat emanations

Unnamed attack - uses flatbed scanners to relay commands to malware infested PCs or to exfiltrate data from compromised systems

xLED - use router or switch LEDs to exfiltrate data

aIR-Jumper - use a security camera's infrared capabilities to steal data from air-gapped networks

HVACKer - use HVAC systems to control malware on air-gapped systems

MAGNETO & ODINI - steal data from Faraday cage-protected systems

MOSQUITO - steal data from PCs using attached speakers and headphones

PowerHammer - steal data from air-gapped systems using power lines

CTRL-ALT-LED - steal data from air-gapped systems using keyboard LEDs

BRIGHTNESS - steal data from air-gapped systems using screen brightness variations

> DiskFiltration - use controlled read/write HDD operations to steal data via sound waves

There is almost nothing I miss about spinning disks, but having an audible indication that something was going wrong was helpful. I refer to inappropriate disk usage (too little or too much) rather than the noises that preceded a disk death.

You know how some electric cars create fake engine noise at low speeds to avoid sneaking up on pedestrians?

I wish that was an option with SSDs. A little speaker included with the package that I could toggle on. All it does it make fake HDD sounds. Bonus if those sounds match the underlying logical distance and “shape” of the read/write activity.

I wonder if one could make something driven purely by the diskactivity LED that's mildly convincing

Seems like a quirky-fun sorta project!

If you've got an SSD connected by a power cord, presumably you could insert an electric-current-meter to see how much power it's drawing, then hook up a speaker to make corresponding sounds.

Maybe also put a temperature probe inside of the SSD's box (perhaps directly on a controller-IC?), then another probe just outside of the SSD's box (or inside of it, but away from the controller-IC?), then use that temperature difference too?

A software solution would probably be easier, but then you'd have to trust the system to give correct information, which I guess would defeat the point.

Someone who'd really want to go at this might make their own controller to place between the motherboard and SSD. But unless it's passive/transparent, allowing the normal SSD driver to be used, that'd seem to require writing a driver for the controller too.

Might still be working https://www.1014.org/code/nullsoft/nbeep/

It also works the other way around: sound will make harddrives malfunction.

This means that one could theoretically use a harddrive as a microphone!

See https://www.youtube.com/watch?v=tDacjrSCeq4 for a demo, yelling at harddrives increases their latency.

For a brief second I thought your link was the Radiohead cover that used old computer equipment, including hard drives as speakers. Here’s that link: https://youtu.be/pmfHHLfbjNQ

Thanks for sharing that! I had forgotten that Radiohead help a competition to remix Nude. Interesting tidbit from the YouTube summary:

Radiohead held an online contest to remix "Nude" from their album - "In Rainbows" This was quite a difficult task for everybody that entered, as Nude is in 6/8 timing, and 63bpm. Most music that's played in clubs is around 120bpm and usually 4/4 timing...

...I decided to take the piss a bit, as the contest seemed to be in that spirit. Based on the lyric (and alternate title) "Big Ideas: Don't get any" I grouped together a collection of old redundant hardware, and placed them in a situation where they're trying their best to do something that they're not exactly designed to do, and not quite getting there. It doesn't sound great, as it's not supposed to.

I personally disagree and think it sounds awesome but I get what he means.

Could be a fun little utility that produces magnetic HDD sounds when doing SSD IO.

I've slowly been moving all my classic machines over to solid state storage and the lack of sound does take something away.

I wonder if you could design something to sit inline on an IDE connection and emulate hard disk sounds in relation to read/write workloads...

Or maybe some software that can watch for unusual behavior and throw up an alert.

We have already seen these kinds of attacks in the early days of computing, where people could read a CRT from a nearby parked van.

https://en.wikipedia.org/wiki/Van_Eck_phreaking

(and if you have access to the machine, then this only makes it easier to get data out)

I remember reading about that in Cryptonomicon, I knew it was technically possible but I didn't realise it actually worked.

Also from the same group, GSMem: exfiltrate data by generating GSM signals using nothing but RAM access patterns.

https://www.usenix.org/node/190937

Is there a table of the associated bandwidths?

Can I get some clarity on the types of data they extract?

Looking at blinking LEDs tells me that the HDD is on and processing something, yes, but it doesn’t tell me the digits of the credit card number it’s processing (for example).

Do they researchers track the value of the information they “steal”? Or is any data at all valuable?

"Guri's research doesn't look at ways of compromising and planting malware on these super-secure systems" ... "malicious code planted on an air-gapped system can control the speed at which fans work"

If you control the blinking of the led you have established a very low bandwidth communication channel.

Ohhh I misunderstood; I thought they were stealing data by simply observing the blinking LED, not that they had infiltrated the computer and were controlling the LED.

The term "exfiltrate" implies that the data is being "pushed" or otherwise sent outward from the machine, as opposed to being harvested from the outside.

Thank you, because you wrote this, I too now understand what they meant. My train of thought was apparently on the same track as yours!

Allmost (or all?) of those attacks are only possible, if the target computer is infected. And the scenario is that the virus wants to send data out, to a nearby decice which is also infected.

Which is why this is "exfiltration", not "infiltration".

It's about how to get data out once you've already compromised the machine. You control the blinking of the LED to match match the data you want to capture out.

Basically the idea is that air gapped is still not secure. If someone plugs in a foreign flash drive into a computer that is air gapped one would think the data can’t leave the secure machine. With these methods though, it’s clear that any hardware observable to the outside world can be used to exfiltrate data

Well, I think anyone could have thought of the screen or speakers or, well the usb you achieved to plug to get data out of a computer. You have no network but I doubt you can consider airgapped a pc you just plugged a usb device into. Why not plug a mini wifi chip then ?

Reply on news.ycombinator.com