SoylentNews is people
SoylentNews
OK, so you've air-gapped that PC. Cut the speakers. Covered the LEDs. Disconnected the monitor. Now, about the data-leaking power supply unit...
Video Israeli cyber-security side-channel expert Mordechai Guri has devised a way to pilfer data from devices that have been air-gapped and silenced.
[...] An obvious defense against acoustic data transmission is to disable any speakers on the protected device, a practice known as audio-gapping.
But Guri's latest research shows that's not enough. He and his team have found a way to turn the power supply in an isolated, muted machine into a speaker of sorts, one capable of transmitting data at a rate of 50 bits/sec.
He calls the attack POWER-SUPPLaY. The technique has the potential to be used against PC workstations and servers, as well as embedded systems and IoT devices that have no addressable audio hardware.
"We show that malware running on a PC can exploit its power supply unit (PSU) and use it as an out-of-band speaker with limited capabilities," a paper [PDF] detailing the technique explained. "The malicious code intentionally manipulates the internal switching frequency of the power supply and hence controls the waveform generated from its capacitors and transformers."
[...] Guri and others have developed a handful of similar TEMPEST attack schemes, such as luminance signaling via LCD screen fluctuations (BRIGHTNESS), acoustic signaling using fan modulation (FANSMITTER), data exfiltration via power cables (POWERHAMMER), and covert signaling via keyboard lights (CTRL-ALT-LED).
(Score: 0) by Anonymous Coward on Wednesday May 06 2020, @08:15AM (3 children)
With all these loops to go through to completely silence a system. Why not install a second (air-gapped) system in the room, with speakers, where input from /dev/random (or some other randomness generater) outputs into the speaker? This way you create a lot of random noise, making the signal you want to detect harder to snoop from.
(Score: 2) by Dr Spin on Wednesday May 06 2020, @09:09AM
Why not install a second (air-gapped) system in the room
Or run a second thread on the same machine? - preferably hacking large blocks of contiguous ffs or 00s to deliberately create surges in the PSU load?
Or, just run N concurrent tasks? (You might already be doing this - check with "ps -ax" - This might not work if you are using Windows, but if you are using
Windows and expecting security, you should apply for a brain transplant immediately).
Warning: Opening your mouth may invalidate your brain!
(Score: 0) by Anonymous Coward on Wednesday May 06 2020, @09:16AM (1 child)
We already do that with three layers. Every system and cage has sound dampening insulation. Every fan runs at full speed. And there is the noise generator that makes a sound I cannot really describe as it somehow goes beyond static, to the point where that doesn't really describe what comes out of it.
(Score: 1, Interesting) by Anonymous Coward on Wednesday May 06 2020, @08:04PM
I asked a coworker and the term I was looking for was https://en.wikipedia.org/wiki/Colors_of_noise [wikipedia.org]