ODINI: Escaping Sensitive Data From Faraday-Caged, Air-Gapped Computers via Magnetic Fields

IEEE Trans.Inform.Forensic Secur.

Zadov

Bykhovsky

et al. 2020

Self Cite

In this paper we provide an implementation, evaluation, and analysis of PowerHammer, a malware (bridgeware [1]) that uses power lines to exfiltrate data from air-gapped computers. In this case, a malicious code running on a compromised computer can control the power consumption of the system by intentionally regulating the CPU utilization. Data is modulated, encoded, and transmitted on top of the current flow fluctuations, and then it is conducted and propagated through the power lines. This phenomena is known as a 'conducted emission'. We present two versions of the attack. Line level powerhammering: In this attack, the attacker taps the in-home power lines 1 that are directly attached to the electrical outlet. Phase level power-hammering: In this attack, the attacker taps the power lines at the phase level, in the main electrical service panel. In both versions of the attack, the attacker measures the emission conducted and then decodes the exfiltrated data. We describe the adversarial attack model and present modulations and encoding schemes along with a transmission protocol. We evaluate the covert channel in different scenarios and discuss signal-to-noise (SNR), signal processing, and forms of interference. We also present a set of defensive countermeasures. Our results show that binary data can be covertly exfiltrated from air-gapped computers through the power lines at bit rates of 1000 bit/sec for the line level power-hammering attack and 10 bit/sec for the phase level power-hammering attack. Power stationStep up transformerStep down transformerStep down transformer Residential building 22kV output 400 kV 132 kV 11 kV Fig. 1: A (simplified) schematic diagram of the electricity network C. Exfiltration through Power LinesIn this paper, we present a new type of electric (current flow) covert channel. The method, dubbed PowerHammer, enables attackers to exfiltrate information from air-gapped networks through AC power lines. We show that a malware running on a computer can regulate the power consumption of the system by controlling the workload of the CPU. Binary data can be modulated on the changes of the current flow, propagated through the power lines, and intercepted by an attacker. We present two versions of the attack. In line level power-hammering the adversary taps the power cables feeding the transmitting computer. In phase level power-hammering the adversary taps the power lines at the phase level, in the main electrical service panel. Using a non-invasive tap, the attacker measures the emission conducted on the power cables. Based on the signal received, the transmitted data is demodulated and decoded back to a binary form.

Section: B Air-gap Covert Channelsmentioning

confidence: 99%

“…In 2018, Guri et al presented ODINI [17], a malware that can exfiltrate data from air-gapped computers via low frequency magnetic signals generated by the computer's CPU cores. They showed that the low-frequency magnetic fields bypass Faraday cages and metal shields.…”

Section: B Magneticmentioning

confidence: 99%

PowerHammer: Exfiltrating Data From Air-Gapped Computers Through Power Lines

IEEE Trans.Inform.Forensic Secur.

Zadov

Bykhovsky

et al. 2020

Self Cite

“…In 2018, Guri et al presented ODINI [31], a malware that can exfiltrate data from air-gapped computers via low frequency magnetic signals generated by the computer's CPU cores. The magnetic fields bypass Faraday cages and metal shields.…”

Section: B Magneticmentioning

confidence: 99%

MOSQUITO: Covert Ultrasonic Transmissions Between Two Air-Gapped Computers Using Speaker-to-Speaker Communication

2018 IEEE Conference on Dependable and Secure Computing (DSC)

Solewicz

Elovici

2018

Self Cite

In this paper we show how two (or more) airgapped computers in the same room, equipped with passive speakers, headphones, or earphones can covertly exchange data via ultrasonic waves. Microphones are not required. Our method is based on the capability of a malware to exploit a specific audio chip feature in order to reverse the connected speakers from output devices into input devices -unobtrusively rendering them microphones [29]. We discuss the attack model and provide technical background and implementation details. We show that although the reversed speakers/headphones/earphones were not originally designed to perform as microphones, they still respond well to the near-ultrasonic range (18kHz to 24kHz). We evaluate the communication channel with different equipment, and at various distances and transmission speeds, and also discuss some practical considerations. Our results show that the speaker-tospeaker communication can be used to covertly transmit data between two air-gapped computers positioned a maximum of nine meters away from one another. Moreover, we show that two (microphone-less) headphones can exchange data from a distance of three meters apart. This enables 'headphones-to-headphones' covert communication, which is discussed for the first time in this paper.

“…1) ODINI and MAGNETO: The ODINI [55] and MAG-NETO [56] attacks enable the exfiltration of data via magnetic signals generated by the computer processors. Magnetic signals can also be generated from the reading/writing heads of hard disk drives [57].…”

Section: Magenticmentioning

confidence: 99%

“…The Fansmitter and Diskfiltration methods can be used to leak the private keys from an air-gapped wallet in a few minutes. Electromagnetic GSMem (cellular interferences emitted from the CPU-RAM bus) [50] Mobile phone ∼300 sec Electromagnetic RADIoT (radio signals generated by embedded and IoT devices) [51] Mobile phone/ Dedicated receiver ∼1-50 sec Electric PowerHammer (data exfiltrated thorough the power lines) [54] Dedicated receiver ∼ 30-300 sec Magnetic MAGNETO (magnetic signals generated by the CPU to smartphone) [56] ODINI (magnetic signals generated by the CPU) [55] HDD (Magnetic signals emitted from the HDD) -laptops [57] Mobile phone ∼70-1000 sec Acoustic Ultrasonic (generated by loudspeakers) […”

Section: F Acousticmentioning

confidence: 99%

BeatCoin: Leaking Private Keys from Air-Gapped Cryptocurrency Wallets

2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and I

2018

Self Cite

demo video (1): https://youtu.be/2WtiHZNeveY demo video (2): https://youtu.be/ddmHOvT866oAbstract-Cryptocurrency wallets store the wallets private key(s), and hence, are a lucrative target for attackers. With possession of the private key, an attacker virtually owns all of the currency in the compromised wallet. Managing cryptocurrency wallets offline, in isolated ('air-gapped') computers, has been suggested in order to secure the private keys from theft. Such air-gapped wallets are often referred to as 'cold wallets.'In this paper we show how private keys can be exfiltrated from air-gapped wallets. In the adversarial attack model, the attacker infiltrates the offline wallet, infecting it with malicious code. The malware can be preinstalled or pushed in during the initial installation of the wallet, or it can infect the system when removable media (e.g., USB flash drive) is inserted into the wallet's computer in order to sign a transaction. These attack vectors have repeatedly been proven feasible in the last decade (e.g., [1],[2],[3],[4],[5],[6],[7],[8],[9],[10]). Having obtained a foothold in the wallet, an attacker can utilize various air-gap covert channel techniques (bridgeware [ 11]) to jump the airgap and exfiltrate the wallets private keys. We evaluate various exfiltration techniques, including physical, electromagnetic, electric, magnetic, acoustic, optical, and thermal techniques. This research shows that although cold wallets provide a high degree of isolation, its not beyond the capability of motivated attackers to compromise such wallets and steal private keys from them. We demonstrate how a 256-bit private key (e.g., bitcoin's private keys) can be exfiltrated from an offline, air-gapped wallet of a fictional character named Satoshi within a matter of seconds 1 .