Researchers from the University of Shandong have recently demonstrated in a paper that they can transmit data from an air-gapped PC by using a Trojan to implement imperceptible pixel modulation in a monitor.
Every electronic device unintentionally emits RF, and PC monitors, TVs, and screens are no exception. In the past, we have shown that with simple TEMPEST tools, it is easy to recover the image on a screen over a distance using an RTL-SDR or Airspy SDR.
TrojPix relies on the unintentional emitted RF from a PC monitor's video cable. By subtly modulating the pixels on a screen, it is possible to enable data transfer via the unintentional emissions. This means that any PC infected with the TrojPix Trojan could transfer data wirelessly to a snooper, even if the PC is totally disconnected from any wired or wireless network. The only way to stop such an attack would be to completely shield the PC with a faraday cage.
The team note that they were able to achieve a peak data throughput of 8.1 MBps over a max range of 208 meters. They tested nine commercially available monitors and fifteen digital video cables, each demonstrating significant usable RF leakage.
The receiver hardware used was a USRP X310 software-defined radio sampling at 10 MHz and the transmissions appear to have been at 148.5 MHz and 297 MHz.
(Score: 3, Interesting) by looorg on Thursday July 30, @10:14AM (5 children)
Forget goldplated audio cables. The new thing among the monitor enthusiasts will be shielded cables and monitor casing.
208m. Is that if it's nothing in between the receiver and the machine or? One would assume large walls, concrete, iron rebar and all kind of junk between them would have a somewhat detrimental effect on the signal, as to not be crispy 208m away.
(Score: 3, Informative) by janrinok on Thursday July 30, @10:42AM (4 children)
The source article (yes, I know, you don't bother to read them) shows that the test was done in a long corridor. They also acknowledge that other obstacles would reduce the distance significantly.
(Score: 2) by OrugTor on Thursday July 30, @01:38PM (2 children)
What I'm missing is, if the device is air-gapped how to you get a trojan into it?
(Score: 2) by Username on Thursday July 30, @02:43PM (1 child)
If I was a fed, I'd get a job at Microsoft and roll it into explorer.exe. Then when they update the air gaped pc to be security standard compliant, it will get on there. This assumes it's a company and not an individual who doesn't care about security standards.
(Score: 0) by Anonymous Coward on Thursday July 30, @06:08PM
Yeah, that might be good enough for government work. Real spies build what they need into the hardware and blend their signal into the noise.
(Score: 2) by looorg on Thursday July 30, @07:07PM
I normally read them. In this case? I made an exception. Since unless there was magic involved I don't see how they would get a signal to travel 208m from a monitor to a receiver. I guess half the comment in that regard was just snark.
So while this might be "spy cool" if you can get right up there, or at least be in the same room. Beyond that? Dubious usability. Unless some other very specific scenarios are enacted. But then for those scenarios we have had all the other data leak stories across the years -- spying on keyboard clicks, various other electrical radiation, led lights that blink on some drive or whatever. All with the same or equal dubious conditions setup for the experiment that usually does not ever happen in real life scenarios.
(Score: 5, Funny) by gringer on Thursday July 30, @02:03PM
I'll buy an adapter that can plug into the monitor and transmit its signal to the computer wirelessly. No cables involved, so no chance of data leakage through those cables.
It's so secure, even the monitor is air-gapped!
</sarcasm>
Ask me about Sequencing DNA [youtube.com]
(Score: 2) by VLM on Thursday July 30, @03:36PM (1 child)
Table 1 page 2 is a list of unintended output devices.
There was a cyberpunk / cypher punk type novel, maybe a quarter century ago, where the plot was using the numlock LED as a back channel to blink out something covert in morse code but I'm not having a lot of luck finding this vague idea.
That's not in the list on Table 1.
The paper seems to avoid the meme of computer generated music by parsing strange assembly code while listening to an AM radio which is vaguely what this paper is about, except manipulating some pixels on the screen instead of raw code execution.
It would be trivial to send slow morse code and listen using a scanner. The paper has a super elaborate SDR system involving CRC codes or whatever to pull the signal out of the noise, which is creative.
Note that if you have control of the screen you don't need a RF solution you can just blink it out on the screen and look at total room brightness and extract data that way.
You can see why SCIFs are all into room shielding and fences with big gaps.
(Score: 3, Interesting) by namefags_are_jerks on Thursday July 30, @11:29PM
The blinkenlights channel is used by the CHDK project (Canon Powershot Camera alt firmware) to exfiltrate the stock ROM of a new camera.
(Score: 2) by VLM on Thursday July 30, @03:47PM
The fixation in the copycat media seems to be about it being air-gapped. Everyone copies everyone's headline about being air gapped.
It doesn't have to be air gapped, technically, and the point seems to be that based upon the files at https://zenodo.org/records/17905407 [zenodo.org] (the URL in the preprint paper) the entire trojan thing is about 2.5 gigs as a zip file so its quite plausible to buy a "larger than 4 gig" USB flash drive in 2026.
Of course if you're inserting and extracting multi-gig USB flash drives on the target, you could just put the data on the flash drive...
On the other hand, as currently shipped, its a bit large, so its not like you could accidentally fit it into a typical BIOS chip, its not going to have enough free space. So there are some supply chain attacks that at present seem irrelevant although I don't see why the code has to be that huge.
Its quite plausible that something along the lines of the "install monitor get adware" story from a couple weeks ago could apply. Insert USB mouse that has a flash drive soldered across the contacts so it also contains a flash drive... or plug in a "special" monitor that provides USB ports and some extra payload...
(Score: 4, Interesting) by namefags_are_jerks on Thursday July 30, @11:36PM
The article site also has an article about a TEMPEST-LoRa method. That to me is more interesting, as that lets the attacker use commodity cheap (and fairly sensitive) LoRa modules as a receiver.
Amateur Radio's APRS telemetry system has been adapted to work with LoRa. I'm imagining driving past an APRS-LoRA iGate and sending a packet without a radio. :)