Hacker News Reader

Comment by pdonis | Hacker News Reader

The question that came to my mind was, how is he capturing these "network packets" that are being transmitted over the audio channel?

View on HN

Presumably the infection includes a driver to turn the audio system into an acoustic coupler, which would appear as a network device on the target machine. At that point any packet sniffer should be able to attach to it.

I'm guessing of course, there's not much real details to go on, and that would mean this infection is more then just a malicious BIOS.

EDIT: Or he's full of shit. Honestly I said that several times reading it, the story was clearly written for sensationalism and made many seemingly impossible claims. I'm no where near an expert but it still set off the bullshit meter too many times.

Beyond capturing it locally, if the goal was to actually forward messages out to the internet a simple sniffer at the gateway would see attempts to phone home. This is definitely an area where more information would be needed but it's entirely plausible that someone would choose to have a way for targeted air-gapped systems to smuggle data out slowly if no better option is available.

Exactly. From the article: "Forensic tools showed the packets continued to flow over the airgapped machine." How do they know? Where do they hook in to log these packets?

Not difficult. Wireshark running on either PC will tell you this.

Wireshark doesn't listen on audio devices though. You have to choose an interface. There is no obvious way to capture what he claims to be seeing, and if he used wireshark or tcpdump, he would have a log. Furthermore, if you had a covert audio channel, you wouldn't encapsulate it in TCP or IP. Under close examination, these claims don't make any sense.

Wireshark can also capture raw Ethernet and raw USB frames, but it still needs an interface from which to capture. Maybe it was the loopback interface?

The loopback interface is localhost only; it doesn't see any packets coming from or going to any other host.

Software infecting the running system could send packets received via audio to localhost. I'm not saying it's likely, but it's a remotely plausible explanation for the article's description of the attack and investigation.

Software infecting the running system could send packets received via audio to localhost.

Hm. I suppose this is theoretically possible, but I don't see why it would be done in a practical sense. If the malware needs to "phone home", it doesn't need to send packets via localhost; it just sends them out on whatever interface is connected to the Internet. (But how would you distinguish those packets from any others being sent out to the Internet?) If the malware is divided up into multiple processes that need to communicate with each other, why would they betray themselves by connecting via localhost? If they are on OS X or Linux, they can use Unix sockets, which don't need to go through any network interface. If they are on Windows, they can use any of several Windows IPC mechanisms that don't require a network interface.

On which interface do you have Wireshark listen? Not eth0, not wlan0. As far as anything outside the virus can tell, audio in and out is just sounds.

Probably by monitoring the hardware when the machines were supposed to be doing nothing. If you get activity with certain timing you can be pretty sure that the machines are sending packets to each other.

Would one not be able to read that energy was transmitted, but not know exactly what it was if you measured in a Faraday Cage?

Reply on news.ycombinator.com