Hacker News Reader

Comment by jjeaff | Hacker News Reader

I love these extreme air gap exploits. Detecting keyboard entry by analyzing the sound of the typing and reading CRT monitor radiation to mirror the screen from a distance come to mind.

But have any of these extreme exploits ever been used in the wild? They all seem impossible to pull off in anything but lab controlled conditions.

View on HN

> But have any of these extreme exploits ever been used in the wild?

I suspect you're going to find out in 50 years when government documents (not inherently US gov) are declassified.

State level spying is the only thing I can think of where the value of the information is so high (making the effort of this kind of attack is worth it) and where there are many scenarios where the volume of highly valuable information is comparatively tiny.

Just as some very off the cuff examples of what I mean by the latter. We don't need to exfiltrate satellite photos of things (gigabytes of data), but, it could be very valuable to exfiltrate the metadata of what they are looking at (coordinates and time)

Also, exfiltrating information like names of sources or meeting points or other methods can be trivial amounts of data but finding even a single compromised person on our side would be immensely valuable!

I'm reminded of "The Thing": https://en.wikipedia.org/wiki/The_Thing_%28listening_device%...

didn't stuxnet jump into an air gaped system? I'm curious if there is significant difference between egress and ingress into air gaped systems.

I thought a thumbdrive was the attack vector for stuxnet.

Correct:

https://www.theverge.com/2012/4/12/2944329/stuxnet-computer-...

> I'm curious if there is significant difference between egress and ingress into air gaped systems.

I would expect so. I'm fairly certain there's a big difference between pulling fuzzy data out and figuring out what it means as opposed to trying to electromagnetically fling fuzzy data into a system that's not supposed to have information flung at it and having the system accept what you mean.

Soviet agents secretly installed tiny sensing devices in about a dozen embassy typewriters. The devices picked up the contents of documents typed by embassy secretaries and transmitted them by antennas hidden in the embassy walls. The antennas, in turn, relayed the signals to a listening post outside the embassy. “Depending on the location of the bugged typewriters, the Soviets were able to receive copies of everything from routine administrative memos to highly classified documents. “One intelligence officer said the potential compromise of sensitive information should be viewed with ‘considerable seriousness.’ “Another intelligence expert said no one knows for sure how many or what secrets were compromised. A third official called the entire affair a fiasco.

https://media.defense.gov/2021/Jul/13/2002761779/-1/-1/0/LEA...

Not exactly the same thing, because it required modifying the devices in question, but during the Cold War the Soviets managed to implant some really fascinating bugs into typewriters used inside the US Embassy:

https://www.cryptomuseum.com/covert/bugs/selectric/

Yeah... it's hard to know what exactly they get up to in that world, but the floor put under their capabilities by what has been publicly exposed doesn't exactly support the "nah, it's all too hard and nobody would ever bother" argument at all. Even if we assume without real reason to do so that we've heard the most impressive stuff from them, but it's just a small sampling of the number of times they've used it, if your adversary is a state-level actor, you should assume the very, very worst. If you're wrong, it won't be by much.

Read Google's Project Zero blog, too: https://googleprojectzero.blogspot.com/ We don't know that these exploits in particular are used, but consider that Project Zero is the moral equivalent of a hobby for Google. What would it look like to have hundreds of people at that rough skill level, training each other, practicing all the time, and building software support for each other?

The capabilities of attackers are not bounded by your imagination.

Yeah, Snowden mentioned in his experience at NSA they did use tricks like this and this was late 2000's. There is an interview he gives where he goes under a blanket to type his password on a laptop to avoid the crt reader thingy.

Is there any source that it was the crt reading thing specifically? I remember that part of the documentary but I am still wondering if he had a specific attack in mind when he did that.

there is no crt on a laptop

not with that attitude

that said I've seen signal recovery from LVDS

Van Eck phreaking works through walls. I haven't seen the interview but most likely he was just hiding the physical act of typing, since that too can leak information about a password.

Password prompts usually don't show the passwords you're typing in.

Your fingers are hitting the keys.

What would that have to do with a CRT?

Sorry, the attack works in laptop monitors not crt.

Wouldnt that be audio or camera in room? I doubt a blanket would stop EMR from a crt.

> But have any of these extreme exploits ever been used in the wild? They all seem impossible to pull off in anything but lab controlled conditions.

Not at all. I've seen clearly with my own eyes the image of one persons VT100 CRT tube appearing on another across the room because the ground shielding had disconnected. If you have a high gain YAGI antenna, digital RF buffers and some fancy modern DSP lord only knows what you can snoop through the walls.

Most of this is solved by having a simple metal (steel) PC case and grounding the PSU though. Use good quality cables with FCC/IEC badges not the bargain bucket Chinese ones.

I used to see this happen with our old TV's at an old house with really bad grounding. I always wondered why it did that.

We could be playing a video game or movie, and set all the other tv's to channel 2 or something like that, while we played on channel 1. You could see the action on each of them. Almost 1:1 on the reaction times, albeit a little fuzzy.

"Yagi" isn't an acronym.

I learned something today.

  "The antenna was invented in 1926 by Shintaro Uda of Tohoku Imperial
  University, Japan, with a lesser role played by his colleague
  Hidetsugu Yagi." [1]

[1] https://en.wikipedia.org/wiki/Yagi%E2%80%93Uda_antenna#Origi...

We'll eventually find out when the latest iteration of something like Stuxnet is found in the wild...if it still leaves enough of a trace to be found.

Don't worry. The latest iteration will be running on the psp via the private key and will have ring -1 access.

This is not exactly that - this is the use of a SATA bus as an RF radiator to do a (very slow) covert exfiltration channel from an air-gapped computer.

Yeah... but I mean, if the computer is in a steel/aluminum box (likely) then both the distances and locations you can be to be able to intercept that 6ghz signal are pretty limited.

It's a neat attack, but to pull it off you pretty much need both physical access AND the ability to install virused software on the target. Perhaps something the CIA/NSA pull off such as stuxnet? Even then, the point of an air-gapped computer is that installing such software would be pretty difficult in the first place.

I mean if the stakes were high enough

If I told you that you could make 500 million dollars (after taxes) if you figured this out, suddenly you would be on top of this.

The stakes of Stuxnet was probably “the safety of the free world” in the eyes of the people who paid for the work

I don't mean that the attack isn't possible/wouldn't necessarily work. I'm saying it's impractical given that one of the steps to execute it is "have physical access to the machine, the ability to install software, and time to sit around and record the outbound data (or to be able to revisit the site and collect a recording device)."

With each of those requirements, there are easier and faster ways to get data off a machine. If you can install software you can likely download data that software would access. If you can access the machine twice and install software that runs in the background between visits, you can install your keylogger/data collectors and simply record the data on the device.

Stuxnet wasn't about getting data out of the machine, it was about breaking machines. It worked well because it didn't require physical access to the machines. It spread as a virus through the regular updates that Iran was doing for their machines.

If you had such a stuxnet virus in your back pocket, then you can likely steal the data and record it back on the USB device (or any plugged in USB device) on the system.

I was more referring to Stuxnet as an example of someone who is willing to spend the money on people to figure out some obscure techniques

Spy agencies have definitely used obscure data exfiltration techniques and they can afford spies.

I'd say it's a solid "no", and the author says as much in the paper.

> We transmitted the data with a bit rate of 1 bit/sec, which is shown to be the minimal time to generate a signal which is strong enough for modulation. The BER for PC-1 is presented in Table VI. As can be seen, the BER of 1% - 5% is maintained between 0 - 90 cm. With a greater distance of 120 cm, the BER is significantly higher and reaches 15%. With PC-2 and PC-3, the bit error rates (BER) are less than 5% only in short proximity up to 30 cm, and hence the attack is relevant only for short ranges in these computers.

This particular attack is a weak 6 GHz signal that can exfil about 1 bit/s from a metre away. It's neat, but impractical.

Pretty sure a ferrite beads can shut this down anyway. But this seems like a more practical question of "If they can get that close do they really need this?" They've already had USB or software access in some form already.

Yup, that's the part that makes this attack completely impractical. You are trying to leak information but first you have to install a virus on the computer? Neat concept, wildly impractical.

I mean, Stuxnet is an illustrative example that has been seen in the wild (and the rare exception of one that became public - in general, if you'd be the target of something like this and found out, the results of that analysis would be classified and unpublishable), and there have been almost 20 years to do improvements since Stuxnet was first developed, so there definitely are real attacks aiming to do stuff and/or exfiltrate data from air-gapped computers after "installing a virus on the computer" - and it's quite clear that Stuxnet did achieve a significant practical effect.

Enough for cryptographic key material, but not much else.

Still, publishing which methods are a risk, and which ones aren't, is quite useful.

van eck phreaking has been used successfully against electronic ballot machines.[0]

apparently it was demonstrated practically during the Korean War; but I can't find anything much about that.

[0]: https://yro.slashdot.org/story/09/11/22/027229/Brazilian-Bre...

I think Tom Cruise did this once in "Mission:Impossible 32"

Reply on news.ycombinator.com