AirHopper: Bridging the air-gap between isolated networks and mobile phones using radio frequencies

Abstract

Information is the most critical asset of modern organizations, and accordingly coveted by adversaries. When highly sensitive data is involved, an organization may resort to air-gap isolation, in which there is no networking connection between the inner network and the external world. While infiltrating an air-gapped network has been proven feasible in recent years (e.g., Stuxnet), data exfiltration from an air-gapped network is still considered to be one of the most challenging phases of an advanced cyberattack.In this paper we present "AirHopper", a bifurcated malware that bridges the air-gap between an isolated network and nearby infected mobile phones using FM signals. While it is known that software can intentionally create radio emissions from a video display unit, this is the first time that mobile phones are considered in an attack model as the intended receivers of maliciously crafted radio signals. We examine the attack model and its limitations, and discuss implementation considerations such as stealth and modulation methods. Finally, we evaluate AirHopper and demonstrate how textual and binary data can be exfiltrated from physically isolated computer to mobile phones at a distance of 1-7 meters, with effective bandwidth of 13-60 Bps (Bytes per second).

An Approach to Secure Air-gap system from Intentional Radio Transmission

“…[9], demonstrates a method of bridging the air-gap between adjacent compromised computers by using their heat emissions and built-in thermal sensors to create a covert communication channel. [10], discusses bridging air-gap system by intentionally creating FM (Frequency Modulation) radio emissions from a Video Display Unit which will be received by nearby mobile phone FM receiver, and this received signal will be further decoded into original data.…”

“…With appropriate software, compatible radio signals can be produced by a compromised computer, using the electromagnetic radiation associated with the video display adapter. The combination of a transmitter with a widely used mobile receiver creates a potential covert channel that is not being monitored by ordinary security instrumentation [10]. In this paper we propose a method to deny successful data transmission generated by radio emissions from Video Display Units.…”

“…Lots of researchers have discussed radio signal generation from Video cards [1], [2], [5], [10], [11], [12]. Data intentionally modulated on these video signals will be transmitted by computer's monitor cable.…”

“…Possible attack vectors are (a) through removable media or (b) through outsourced software or hardware components [10]. In the case of Stuxnet, removable media acted as propagation framework [13].…”

“…In Linux, xvidtune utility is helpful to determine these values. To test data transmission by emanating radio waves from Video Displays, we used variant of code from Tempest for Eliza [10], [11]. To improve quality of transmitted signals we reduced Horizontal and Vertical sync times as per [12].…”