Information leakage behind the curtain: Abusing anti-EMI features for covert communication

Abstract

Abstract-We present a new class of covert channels which can be created by utilizing common hardware but that cannot be detected by such. Our idea is to abuse anti-EMI features of a processor to create a covert channel on the physical layer. Thus, the sender uses the invariants in how digital signals are encoded over analog channels to covertly transport information. This leaked data is present on the wire bound connections of the compromised device, but is also by definition present in the vicinity of the device and can be picked up by radio equipment. As the covert channel is present only on the physical layer, the data on all layers above, as well as the timing behavior on those layers is indistinguishable from uncompromised devices. We present two example implementations of such channels using RS-232 as the carrier and use a common oscilloscope to decode the resulting covert channel. Using this setup, we observed symbol rates of around 5 baud. We derive the theoretical upper bound of the covert channels bandwidth and discuss the factors by which it is influenced.

ETHERLED: Sending Covert Morse Signals from Air-Gapped Devices via Network Card (NIC) LEDs

“…Other types of magnetic and electric covert channels have been discussed in recent years [12]. Bauer et al discussed the exploitation of anti-EMI features of processors for covert communication [11]. Camurati presented a covert channel that affects mixed-signal chips, where electromagnetic leakage from digital logic is modulated with the radio carrier [13].…”

Leaky Wires: Information Leakage and Covert Communication Between FPGA Long Wires

“…Research on side-and covert-channels on FPGAs and other embedded devices has primarily focused on communications between the device and the outside world. Techniques include varying the power consumption of a device and measuring the impulse response [37], changing how much Electromagnetic Interference is emitted by the device [3], or, in the other direction of communication, measuring voltage [27] and temperature changes [31]. These side-channels can be employed in the context of creating Hardware Trojans (HTs) [19], or as ways to watermark circuits and offer IP protection [5,27].…”