SATAn: Air-Gap Exfiltration Attack via Radio Signals from SATA Cables

So all of these attacks work? Targeting different systems? Probably took non-zero effort to develop? What exactly is the problem?

Let me tell you about these chemists that publish paper after paper involving carbon bonds. Like, give it a rest.

What do you mean by copycat? As in he takes someone else's paper and gives it a clever name? Or do you just mean he is using lots of silly methods of doing data exfil?

The list you gave quite neatly illustrates why EMSEC zones exist. If your security posture includes physical exclusion out to a distance where these signals are no longer discernible above the background noise, and/or you have faraday cages built into the walls as in the case of a standard SCIF, then these attacks aren't likely to be effective.

Hard drive access LED, optical disk servo, and the piezoelectric discharge due to thermal rise/fall of the GPU.

I'm only half joking.

Ben-Gurion seems to generate a lot of papers like this. Makes me wonder about the secret spy stuff that doesn't get published.

Just aggregate them with a super spy wand and count how many attempts are possible

> But have any of these extreme exploits ever been used in the wild?

I suspect you're going to find out in 50 years when government documents (not inherently US gov) are declassified.

State level spying is the only thing I can think of where the value of the information is so high (making the effort of this kind of attack is worth it) and where there are many scenarios where the volume of highly valuable information is comparatively tiny.

Just as some very off the cuff examples of what I mean by the latter. We don't need to exfiltrate satellite photos of things (gigabytes of data), but, it could be very valuable to exfiltrate the metadata of what they are looking at (coordinates and time)

Also, exfiltrating information like names of sources or meeting points or other methods can be trivial amounts of data but finding even a single compromised person on our side would be immensely valuable!

I'm reminded of "The Thing": https://en.wikipedia.org/wiki/The_Thing_%28listening_device%...

Soviet agents secretly installed tiny sensing devices in about a dozen embassy typewriters. The devices picked up the contents of documents typed by embassy secretaries and transmitted them by antennas hidden in the embassy walls. The antennas, in turn, relayed the signals to a listening post outside the embassy. “Depending on the location of the bugged typewriters, the Soviets were able to receive copies of everything from routine administrative memos to highly classified documents. “One intelligence officer said the potential compromise of sensitive information should be viewed with ‘considerable seriousness.’ “Another intelligence expert said no one knows for sure how many or what secrets were compromised. A third official called the entire affair a fiasco.

https://media.defense.gov/2021/Jul/13/2002761779/-1/-1/0/LEA...

Not exactly the same thing, because it required modifying the devices in question, but during the Cold War the Soviets managed to implant some really fascinating bugs into typewriters used inside the US Embassy:

https://www.cryptomuseum.com/covert/bugs/selectric/

Yeah, Snowden mentioned in his experience at NSA they did use tricks like this and this was late 2000's. There is an interview he gives where he goes under a blanket to type his password on a laptop to avoid the crt reader thingy.

> But have any of these extreme exploits ever been used in the wild? They all seem impossible to pull off in anything but lab controlled conditions.

Not at all. I've seen clearly with my own eyes the image of one persons VT100 CRT tube appearing on another across the room because the ground shielding had disconnected. If you have a high gain YAGI antenna, digital RF buffers and some fancy modern DSP lord only knows what you can snoop through the walls.

Most of this is solved by having a simple metal (steel) PC case and grounding the PSU though. Use good quality cables with FCC/IEC badges not the bargain bucket Chinese ones.

We'll eventually find out when the latest iteration of something like Stuxnet is found in the wild...if it still leaves enough of a trace to be found.

This is not exactly that - this is the use of a SATA bus as an RF radiator to do a (very slow) covert exfiltration channel from an air-gapped computer.

I'd say it's a solid "no", and the author says as much in the paper.

> We transmitted the data with a bit rate of 1 bit/sec, which is shown to be the minimal time to generate a signal which is strong enough for modulation. The BER for PC-1 is presented in Table VI. As can be seen, the BER of 1% - 5% is maintained between 0 - 90 cm. With a greater distance of 120 cm, the BER is significantly higher and reaches 15%. With PC-2 and PC-3, the bit error rates (BER) are less than 5% only in short proximity up to 30 cm, and hence the attack is relevant only for short ranges in these computers.

This particular attack is a weak 6 GHz signal that can exfil about 1 bit/s from a metre away. It's neat, but impractical.

van eck phreaking has been used successfully against electronic ballot machines.[0]

apparently it was demonstrated practically during the Korean War; but I can't find anything much about that.

[0]: https://yro.slashdot.org/story/09/11/22/027229/Brazilian-Bre...

I think Tom Cruise did this once in "Mission:Impossible 32"

Don't let an attacker run code on your system in the first place. (yes, shielding would of course help against this specific attack, but you have a long list of things to worry about before this kind of thing even becomes relevant)

It wouldn't take much shielding at all for this specific one... you could line a case with a faraday mesh material which would probably me enough for most similar attacks.

That said, for most of these kinds of things, you have to get a malicious payload on such a system. The stuxnet approach is one way, if you have specific targets. Aside from that, you pretty much need phyxical access and be able to load a malicious software. At that point, you may as well stick a small usb bluetooth/wireless dongle, depending on the situation... assuming it's a standard desktop, there's a good chance of unused USB 2 header you could piggy back on.

At that point, an actual faraday cage or mesh on the room in question would be the next practical vector. Some secure buildings are up to 6' thick walls, no communications out except through known devices on wired ports with software checking in place (seen this in finance).

Same as with all attacks, you protect against them by making the return lower than the cost...

Isn't a metal PC case already a faraday cage?

Gain physical access to a machine, install malware that gathers data and transmits it using this vulnerability. Only works if you can set up a listening post within range of the PC.

Certainly very limited utility, and definitely not something any of us should actually be worried about. But it probably is something to be aware of if you run IT for an embassy or any other entity that could be targeted by a highly motivated state sponsored actor.

There are various ways how you can push in malware to isolated systems (compromised USB drives used to be common, and still seem to work in some penetration tests; but in general, you might succeed in getting someone to deliver a malicious document file to such a system with some zero-day in it. Also, compromised hardware - e.g. ship them a USB mouse that 12 hours after plugging in technically becomes also a USB storage device and a USB keyboard to send commands to install stuff), but then you have the trouble of what that malware should do once on those systems - being able to establish a communications channel is useful in such a scenario. So there's definitely a role for such tools, only these scenarios are relevant only to quite expensive targeted attacks, essentially spycraft by state actors, not for e.g. commercial ransomware operators.

That's what "exfiltration" generally means, yes

You don't need physical access, but you can't do it via Internet. An intercepted/faked software CD/USB would probably be a good vector. They have to install software somehow.

To my understanding (haven't yet read the paper, just the abstract) - most full-disk encryption schemes are implemented in OS as opposed to in-hardware, so if the attacker has deep access to the system they could probably find a way to write unencrypted data to disk? That may not work inside a VM though

It probably does. In the code example on page 5, disk activity is only generated to send a "1", while a "0" is encoded as a time with no disk activity.

They write only random data and discard any data they read, so FDE should not have any effect.

Cost yes, but also inflexible cables, more space required for transducers, harder to have a bus where multiple devices access the same transmission medium, can't include power in the same connector etc.

You can use optical for ethernet but it's expensive and mostly for long distances as I understand it. There's no need for that with SATA.

Ironically, I was thrown off (briefly) because I remember reading about the original SATAN back in the day. I may be wrong, but I think it was a precursor to nmap? I haven't looked it up and this was in the late 90's.