Hacker News Reader

Comment by tptacek | Hacker News Reader

The audio channel doesn't make any sense to me; when I heard it from Dragos on Facebook the first time, I was actually a little worried about him. It's not that I think it's impossible to create a covert channel over audio; it obviously isn't. It's that for the malware story to play out, the covert receiver needs to already exist; if it does, you're already infected, so what does "air gapping" matter?

View on HN

I think it means that the infected airgapped computer can communicate with an infected non-airgapped computer over audio. The malicious code would already need to be there but once it's there it could (albeit slowly given the transmission rate) send data out from the air gapped machine.

I was going to add a line like "Who has a mic and speakers on their airgapped machine?!" but obviously every laptop does.

And next to every PC has at least a speaker for the BIOS beep. I'm not sure how good the DAC driver chip is (especially, how they perform at ultrasonic or subsonic frequencies).

I was thinking about this too. If it's possible to send out arbitrary frequencies with it you could have a one way channel even if the air gapped machine doesn't have a mic. Only the receiver would need one. The air gapped machine would just be transmitting 24/7 hoping another machine is in range.

Quite like a navigation beacon...

The PC speaker does not have much of a DAC. Before the common use of ASIC chipsets, the PC speaker was connected to one of the channels of a clock divider chip. The other channel was used to drive the timer IRQ.

When a program wanted to produce a tone, the program took the input frequency of the clock divider divided by the desired frequency and programmed it into the clock divider. To control the duration of the tone, a DOS or BIOS call was available delay the program or the program could hook the timer interrupt vector. The program would then turn the speaker off or start the next tone.

Programs could also turn the output bit on and off manually. Some programs could turn the bit on and off rapidly to play arbitrary sounds. There was even a Windows driver to play sound through the PC speaker, but it disabled interrupts, causing the clock, keyboard, mouse, and network to stop while the sound was playing.

Now that's an interesting piece of history. Thanks!

If the speaker is physically capable of that, the same technique can output ultrasound - with modern processor speeds, you probably could twiddle that output bit while still leaving room for normal system operation.

Schneier admitted his airgapped machine was laptop. But I supposed he has the good sense to physically damage the mic, speakers and wifi and Bluetooth.

Creating a network connection over audio allows an infected, but airgapped, computer to remain in contact with the malware controllers. This would enable the exfiltration of information, as well as the infiltration of updates to the malware.

Yeah, maybe. That isn't the sense I got from reading all this stuff, but I've been wrong about bigger things before.

From TA (emphasis added):

Ruiu said he arrived at the theory about badBIOS's high-frequency networking capability after observing encrypted data packets being sent to and from an infected laptop that had no obvious network connection with—but was in close proximity to—another badBIOS-infected computer. The packets were transmitted even when the laptop had its Wi-Fi and Bluetooth cards removed. Ruiu also disconnected the machine's power cord so it ran only on battery to rule out the possibility it was receiving signals over the electrical connection. Even then, forensic tools showed the packets continued to flow over the airgapped machine. Then, when Ruiu removed the internal speaker and microphone connected to the airgapped machine, the packets suddenly stopped.

With a staged payload, the ability to communicate across an airgap could allow successive stages to be delivered in the presence of counter-measures. It could also facilitate minimization of the spore's footprint during initial infection and thereby reduce the likelihood that the spore will be detected.

The conclusion that for communications across the air-gap to work, the receiver must already be infected is the only alternative to "No, it isn't happening."

Now I'm not in a position to say, that it is happening. But I'm not in a position to say that the supply chain for electronic devices is hardened against an attack by a state sponsored agency seeking to inject spores into devices at the time of manufacture. If an agency is interested in maximizing backdoor accesses, having infected devices roll off the assembly line and straight to end users certainly seems like an ideal outcome. It's map reduce.

Don't get me wrong, I know I'm furiously folding Reynolds Wrap. But I also know that there is a cognitive gap between the furniture of everyday experience and large scale phenomena - e.g. collecting meta data on all phone calls simultaneously and then storing and searching it doesn't fit with the MOS 6510 mental model of computing I habitually use.

>>>> If an agency is interested in maximizing backdoor accesses, having infected devices roll off the assembly line and straight to end users certainly seems like an ideal outcome.

And we already have proof that manufacturers in China have been doing this:

http://www.theguardian.com/technology/2012/sep/14/malware-in...

"Microsoft researchers in China investigating the sale of counterfeit software found malware pre-installed on four of 20 brand new desktop and laptop PCs they bought for testing. They found forged versions of Windows on all the machines."

This would be the easiest way to do this, and since it's already been demonstrated, I would hasten to say your tinfoil folding is certainly is not being done in vein.

This seems nonsensical to me. The microphone and speakers in a typical laptop(yes even a macbook air) are hardly quality enough to a) transmit any data at a high enough frequency to have any bandwidth and be "undetectable" and b) the microphone would be of even worse quality.

A typical laptop has a +- 3db audio frequency response of 200hz - 8khz if you are lucky, even if you wanted -10 or 20db I doubt you would get much above 12khz which is detectable by most people without significant hearing damage. I'm very skeptical about this article...

It was actually hearable but could be mistaken for crappy electronic noise

https://plus.google.com/u/0/103470457057356043365/posts/3reW...

There is no audio in the link you provided.

There are pressure sensitive pens that work with any Android/iOS cell phone via ultrasound. So I don't know about laptops, but all smartphones are capable of data transmission via ultrasound. I can't recall the last laptop I used that didn't work fine for Skype, so I don't think laptops are any worse, personally. Maybe 5 years ago one employer went cheap on a model without the built-in webcam on a laptop that usually had it, but even that had speakers and mic.

I just tested the built in speakers and mic on my 3 year old MacBook Pro using sine waves and a spectrum analyser.

It's perfectly capable of sending and picking up a 20kHz signal by itself. The frequency response starts dropping off drastically at around 14kHz. Around 21kHz seems to be the practical limit.

However, there seems to be a bit of distortion going on. I'm not sure it's possible to send a clean inaudible signal without introducing lower frequency components.

I've worked in computer music/audio for years. Most people and PCs can reach 20kHz. It's no coincidence, human hearing drops off around that point and thus the 44.1kHz sample rate was chosen to match that (you can transmit frequencies at max of 1/2 the sample rate, thus 22.05kHz). But modern sound cards can reach 96 or even 192kHz sample rate, able to transmit ~50-100kKHz tones (other factors aside). Further, modern sound cards can have amplitudes expressed as 24-bit numbers, providing very high fidelity/accuracy.

So, you may be able to hear higher than 20kHz. Even if you increase your sound card sample rate, best test would be to try something analog to eliminate other bottlenecks in the audio processing. But you can easily tweak your audio settings and generate sine waves with this program:

http://audacity.sourceforge.net/

Quite a few people can hear 20kHz. I can still clearly hear 18.5kHz (or what my laptop's speakers emit when I feed a 18.5kHz sine) and 19-20kHz gives me headaches.

Ok so maybe it's possible to send audio and receive it via a MacBook Pro. However, how much data could that low bandwidth signal carry? I'm even more curious how randomly transmitting "evil bits" this way could spontaneously infect a PC at the lowest levels. Something just doesn't add up here.

Absolutely no one is suggesting that audio is being used to spontaneously infect previously uninfected systems. No one has ever suggested that except for people who have failed to carefully and completely read the article. The claim is infected machines are using it to communicate, not that uninfected machines are being infected by it.

The article is awkwardly formulated, but gets clear later on: the attack happens over a USB flash drive, but air gap doesn’t remove communications from the infected machine until you remove the mike/speakers.

Yeah this really reads like quite paranoid delusions. Connecting events but ignoring the incredible leaps that have to be made.

I don't understand why he hasn't posted 'infected' USB sticks to a bunch of high profile security folk with "POTENTIAL BIOS MODIFYING TROJAN ONBOARD" written on it? It would be a matter of a day or two before someone monitored all communications with it passively and proved or disproved his theory.

@PaxNoxNomPox - @dragosr How can #badBIOS spread if rcvr doesn't know what to listen for? Something has to be listening and know what to listen for. Thnx.

@dragosr - @PaxNoxNomPox no evidence of "spreading" via audio. Just comms between infected machines.

https://twitter.com/dragosr/status/395959517243928576

Imagine a ton of laptops passing through Starbucks. The infection is being established via something on an unprotected (or compromised router) wifi network. That infection is dormant with only one function: listen on the microphone. You could create an army of laptops that receives its orders through proximity completely bypassing any firewall system you have. It's pretty insidious.

The audio system is not the attack vector. It is a means of staying in contact with command-and-control by communicating with other already-infected machines.

The question that came to my mind was, how is he capturing these "network packets" that are being transmitted over the audio channel?

Presumably the infection includes a driver to turn the audio system into an acoustic coupler, which would appear as a network device on the target machine. At that point any packet sniffer should be able to attach to it.

I'm guessing of course, there's not much real details to go on, and that would mean this infection is more then just a malicious BIOS.

EDIT: Or he's full of shit. Honestly I said that several times reading it, the story was clearly written for sensationalism and made many seemingly impossible claims. I'm no where near an expert but it still set off the bullshit meter too many times.

Exactly. From the article: "Forensic tools showed the packets continued to flow over the airgapped machine." How do they know? Where do they hook in to log these packets?

Not difficult. Wireshark running on either PC will tell you this.

Wireshark doesn't listen on audio devices though. You have to choose an interface. There is no obvious way to capture what he claims to be seeing, and if he used wireshark or tcpdump, he would have a log. Furthermore, if you had a covert audio channel, you wouldn't encapsulate it in TCP or IP. Under close examination, these claims don't make any sense.

Wireshark can also capture raw Ethernet and raw USB frames, but it still needs an interface from which to capture. Maybe it was the loopback interface?

The loopback interface is localhost only; it doesn't see any packets coming from or going to any other host.

Software infecting the running system could send packets received via audio to localhost. I'm not saying it's likely, but it's a remotely plausible explanation for the article's description of the attack and investigation.

Software infecting the running system could send packets received via audio to localhost.

Hm. I suppose this is theoretically possible, but I don't see why it would be done in a practical sense. If the malware needs to "phone home", it doesn't need to send packets via localhost; it just sends them out on whatever interface is connected to the Internet. (But how would you distinguish those packets from any others being sent out to the Internet?) If the malware is divided up into multiple processes that need to communicate with each other, why would they betray themselves by connecting via localhost? If they are on OS X or Linux, they can use Unix sockets, which don't need to go through any network interface. If they are on Windows, they can use any of several Windows IPC mechanisms that don't require a network interface.

On which interface do you have Wireshark listen? Not eth0, not wlan0. As far as anything outside the virus can tell, audio in and out is just sounds.

Probably by monitoring the hardware when the machines were supposed to be doing nothing. If you get activity with certain timing you can be pretty sure that the machines are sending packets to each other.

Would one not be able to read that energy was transmitted, but not know exactly what it was if you measured in a Faraday Cage?

Beyond capturing it locally, if the goal was to actually forward messages out to the internet a simple sniffer at the gateway would see attempts to phone home. This is definitely an area where more information would be needed but it's entirely plausible that someone would choose to have a way for targeted air-gapped systems to smuggle data out slowly if no better option is available.

The way I read this article, two infected computers can communicate via these means, but the means of initial infection of airgapped computers are still partially unknown. You may have more context, but that's how I understood the article on its own.

Reply on news.ycombinator.com