BitWhisper: Covert Signaling Channel between Air-Gapped Computers Using Thermal Manipulations

Guri, Mordechai; Monitz, Matan; Mirski, Yisroel; Elovici, Yuval

doi:10.1109/csf.2015.26

Cited by 138 publications

(77 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Using this technique they established socalled speaker-to-speaker air-gap communication between two computers in the same room via ultrasonic waves. BitWhisper [16], presented in 2015, exploits the computer's heat emissions and PC thermal sensors to create a thermal covert channel between computers. This method enabled bidirectional covert communication between two adjacent air-gapped computers.…”

Section: A Electromagnetic Magnetic Acoustic and Thermalmentioning

confidence: 99%

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

Guri

Zadov

Bykhovsky

et al. 2019

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Self Cite

View full text Add to dashboard Cite

Using the keyboard LEDs to send data optically was proposed in 2002 by Loughry and Umphress [1] (Appendix A). In this paper we extensively explore this threat in the context of a modern cyber-attack with current hardware and optical equipment. In this type of attack, an advanced persistent threat (APT) uses the keyboard LEDs (Caps-Lock, Num-Lock and Scroll-Lock) to encode information and exfiltrate data from airgapped computers optically. Notably, this exfiltration channel is not monitored by existing data leakage prevention (DLP) systems. We examine this attack and its boundaries for today's keyboards with USB controllers and sensitive optical sensors. We also introduce smartphone and smartwatch cameras as components of malicious insider and 'evil maid' attacks. We provide the necessary scientific background on optical communication and the characteristics of modern USB keyboards at the hardware and software level, and present a transmission protocol and modulation schemes. We implement the exfiltration malware, discuss its design and implementation issues, and evaluate it with different types of keyboards. We also test various receivers, including light sensors, remote cameras, 'extreme' cameras, security cameras, and smartphone cameras. Our experiment shows that data can be leaked from air-gapped computers via the keyboard LEDs at a maximum bit rate of 3000 bit/sec per LED given a light sensor as a receiver, and more than 120 bit/sec if smartphones are used. The attack doesn't require any modification of the keyboard at hardware or firmware levels.

show abstract

Section: A Electromagnetic Magnetic Acoustic and Thermalmentioning

confidence: 99%

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

Guri

Zadov

Bykhovsky

et al. 2019

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Self Cite

View full text Add to dashboard Cite

show abstract

“…In 2018, Guri et al presented PowerHammer [16], a method to exfiltrate data from airgapped computers through power lines. Other types of air-gap covert channels based on acoustic [17]- [20], optical [21]- [28] and thermal [29] emissions have also been investigated.…”

Section: Related Workmentioning

confidence: 99%

Brightness: Leaking Sensitive Data from Air-Gapped Workstations via Screen Brightness

Guri

Bykhovsky

Elovici³

2019

2019 12th CMI Conference on Cybersecurity and Privacy (CMI)

Self Cite

View full text Add to dashboard Cite

Air-gapped computers are systems that are kept isolated from the Internet since they store or process sensitive information. In this paper, we introduce an optical covert channel in which an attacker can leak (or, exfiltlrate) sensitive information from air-gapped computers through manipulations on the screen brightness. This covert channel is invisible and it works even while the user is working on the computer. Malware on a compromised computer can obtain sensitive data (e.g., files, images, encryption keys and passwords), and modulate it within the screen brightness, invisible to users. The small changes in the brightness are invisible to humans but can be recovered from video streams taken by cameras such as a local security camera, smartphone camera or a webcam. We present related work and discuss the technical and scientific background of this covert channel. We examined the channel's boundaries under various parameters, with different types of computer and TV screens, and at several distances. We also tested different types of camera receivers to demonstrate the covert channel. Lastly, we present relevant countermeasures to this type of attack.

show abstract

“…Moreover, the authors could also use this information to determine which VMs share this infrastructure. Power related covert channels have been shown by Guri et al [6]. The authors established a covert channel between two air-gapped systems by only using the temperature sensors on the two systems.…”

Section: Related Workmentioning

confidence: 99%

“…The number of possible paths is calculated as shown in Equation (5), where c (N ) s is element s of the vector c (N ) . We can now use Equation (4) and Equation (5) in Equation (1) to obtain Equation (6). Inserting the parameters for…”

Section: Channel Capacity Boundmentioning

confidence: 99%

The security risks of power measurements in multicores

Miedl

Thiele

2018

Proceedings of the 33rd Annual ACM Symposium on Applied Computing

View full text Add to dashboard Cite

Two of the main goals of power management in modern multicore processors are reducing the average power dissipation and delivering the maximum performance up to the physical limits of the system, when demanded. To achieve these goals, hardware manufacturers and operating system providers include sophisticated power and performance management systems, which require detailed information about the current processor state. For example, Intel processors offer the possibility to measure the power dissipation of the processor. In this work, we are evaluating whether such power measurements can be used to establish a covert channel between two isolated applications on the same system; the power covert channel.We present a detailed theoretical and experimental evaluation of the power covert channel on two platforms based on Intel processors. Our theoretical analysis is based on detailed modelling and allows us to derive a channel capacity bound for each platform. Moreover, we conduct an extensive experimental study under controlled, yet realistic, conditions. Our study shows, that the platform dependent channel capacities are in the order of 2000 bps and that it is possible to achieve throughputs of up to 1000 bps with a bit error probability of less than 15%, using a simple implementation. This illustrates the potential of leaking sensitive information and breaking a systems security framework using a covert channel based on power measurements. CCS CONCEPTS• Security and privacy → Security in hardware; Operating systems security; KEYWORDS covert channel; power; capacity bound; empirical study ACM Reference Format:

show abstract

BitWhisper: Covert Signaling Channel between Air-Gapped Computers Using Thermal Manipulations

Cited by 138 publications

References 8 publications

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

Brightness: Leaking Sensitive Data from Air-Gapped Workstations via Screen Brightness

The security risks of power measurements in multicores

Contact Info

Product

Resources

About