Escaping Data from Faraday-Caged, Air-Gapped Computers via Magnetic Fields

https://arxiv.org/abs/1802.02700

by air7 • 8 years ago

161 72 8 years ago

arxiv.org

ac2u• 8 years ago

40bits/s from 100cm away, cool hack.

dralley• 8 years ago

Why would they say 100cm instead of just... 1 meter...

grzm• 8 years ago

One reason is to convey precision.

funcSoulBrother• 8 years ago

The unit indicates the precision at which the scale is represented. So for this, the distribution is probably not very useful at a resolution of 0m, 1m, and 2m and is normalized between the 0 and 1XXcm range.

rdtsc3• 8 years ago

Because the other distances are less than 1m and measured in cm, like 20cm, 50cm, etc. See their paper.

rdtsc3• 8 years ago

This is brilliant - magnetic TEMPEST.

Though magnetic field intensity drops off with an inverse cute law, they mention that in the paper, which restricts the distance. It seems they got up to 100cm but it's 1bps at that point. For 10bps need to be only about 10cm way. Seems hard to exploit but imagine server being next to a wall/floor and someone placing a bug right next to the wall on the other side.

Seems just leaving enough space around the server would be enough. Put it 1m away from floor and walls and it should mitigate it.

I knew about the light and ultrasound before, but also learned from the paper there is apparently a thermal TEMPEST attack as well.

schoen5• 8 years ago

Kragen Sitaker's post that was featured on HN recently mentioned the idea of simply slowing down communications to increase distance without increasing power. Can that be demonstrated for air gap penetrating malware (with or without electrical shielding)? Can I run software on my computer that successfully sends a message wirelessly to Kragen over on another continent (albeit at some absurdly low data rate)?

https://news.ycombinator.com/item?id=16232509

cperciva• 8 years ago

I realize it was a typo, but I love the idea of an "inverse cute law".

schoen5• 8 years ago

Same here, but I expect it's the wrong law for magnetism. People's magnetism is roughly proportional to the logarithm of their cuteness, isn't it?

rdtsc3• 8 years ago

Ha! Silly typo. Thanks for pointing it out.

"Inverse cute law" works as you said as well, it's when you're trying to exfiltrate data but physics conspires against you.

dboreham• 8 years ago

I thought it had something to do with Schrodinger's Cat.

Florin_Andrei2• 8 years ago

Completely isolated systems seem more and more like a theoretical abstraction, not a reality.

If you want true isolation, place it inside the event horizon of a black hole. Or spin up a child universe then cut off the connection. Even then some clever cookie might find ways for information to percolate from one continuum to another.

schoen5• 8 years ago

If you want true isolation, place it inside the event horizon of a black hole.

There's a hypothesis supported by some physicists that black holes in some way export the information content of the things they previously swallowed via Hawking radiation. Hawking himself apparently has not endorsed this interpretation.

https://en.wikipedia.org/wiki/Black_hole_information_paradox...

knodi123• 8 years ago

Or spin up a child universe then cut off the connection.

Unfortunately, even that doesn't always work;

https://en.wikipedia.org/wiki/Continuity_changes_during_Infi...

jaclaz3• 8 years ago

As often happens, very nice, but of no practical use whatever, I mean first thing you have to BOTH infect the PC AND place a "magnetic receiver" within 100 cm, but the "magnetic receiver" needs anyway to transmit the data, and that is IMHO the unresolved problem, as this method of transmission would be easily detected (if electromagnetic/radio) or impossible to deploy (cable/wire) in 99.9999% of the "secure sites" where actually an air-gapped computer is used inside a faraday cage.

titzer• 8 years ago

The magnetic receiver could as well be under the floor, in the wall, in a picture, etc. It doesn't have to immediately transmit, either. It'd be easy enough to put 128gb flash on it and then come collect it later, sneaker-net style.

ChuckMcM3• 8 years ago

This. Secure facilities might not be used 24/7/365 and so going in to collect the bug would be the mode used.

It is yet another clever way to extract information and I expect to see CPU coolers with ferrite flux redirectors to appear at some point to counter it.

djtriptych• 8 years ago

This sort of exploit is attractive to state actors with virtually unlimited budgets. For them, it might be quite practical. The CIA has been toying with insect-sized remote controllable flying vehicles for decades. Stick a USB stick and magnetic receiver on one of them and you've basically got your exploit.

You and I wouldn't spend 20 man-years and $50 million to do that, but our government definitely would if there were a chance to, say, disrupt Iran's nuclear ambitions for a few months.

conbandit• 8 years ago

easier to just write stuxnet

mirimir• 8 years ago

Yes. And properly secured air-gapped devices don't get malware.

myrandomcomment2• 8 years ago

Did you ever think when stuff like this come out there is some guy at the NSA going "Damn it, there goes another one" as they have know about this and been using if for years :)

schoen5• 8 years ago

Unfortunately, mitigating a vulnerability can take a long time and might never happen.

When the Imperfect Forward Secrecy paper about weak Diffie-Hellman exchanges came out in 2015, not all systems using the vulnerable groups upgraded immediately, and some systems couldn't be easily upgraded either because they were hard-coded or because they had other software limitations.

The IT security situation in many developing countries is also pretty alarming, for example if you look at the prevalence of old unsupported operating systems and browsers in many places.

Even thinking about traditional emanations issues, the "van Eck phreaking" attacks were publicly demonstrated years ago

https://www.youtube.com/watch?v=ZZ5HS8GWIec

but have still not been widely mitigated in practice. Neither have the emanations problems documented by Tromer.

https://www.cs.tau.ac.il/~tromer/

And we know that the vendors were notified about Spectre in June of last year and the public was told over a month ago, but pretty much all of us continue to be potentially vulnerable to it in some settings, even more than seven months after vendor notifications!

It can be nice for infosec researchers to think that attackers only gain power and capability by knowing secrets, and that if those secrets are exposed the attackers will lose their capabilities, but a number of people have been pointing out that it doesn't always work that way -- or at least there can be quite a long window of vulnerability.

(However, exposing secrets is definitely an important prerequisite for denying capabilities to attackers.)

myrandomcomment2• 8 years ago

The thing I love about HN is that you say something to be amusing and the engineering types (I am one, so I am making fun of myself) always make some logical argument in response. The best part is 90% of the time you learn something!

jacquesm• 8 years ago

The IT security situation in many developing countries is also pretty alarming

It's pretty alarming in most of the developed countries as well.

lawlessone• 8 years ago

I kind of think its so impractically hard that there are easier exploits they could find.

LargeWu• 8 years ago

Right. Seems more practical to just use social engineering or an inside man.

GCU-Empiricist• 8 years ago

If you think that you might want to read the tempest security standard, think about how much extra building compliant facilities cost, and realize that someone who already understood the cost approved the requirement because of a credible threat, or a capability they had and weren't sure if the other team would have.

gist• 8 years ago

Did you ever think when stuff like this come out there is some guy at the NSA going "Damn it, there goes another one"

Maybe the opposite. Have other spend time on something that has little practical use given the actual utility instead of spending budget dollars on something else.

jloughry5• 8 years ago

I have first-hand experience:

Around 1999, I wrote a paper about information leakage from blinking LEDs on devices (one DES link encryption box, used by banks, for example, was sending out plaintext on the LEDs).

I was working for a defense contractor at the time on a classified project, and so, following procedures, we submitted the paper to NSA for approval to publish.

It took a year and a half to approve. [1]

Eventually NSA wrote back and said, "No problem! Go ahead and publish." I kind of wonder what they spent all that time doing.

[1] Actually, it didn't quite happen that way. Our paper was approved for publication very quickly, in only a few weeks; we submitted it to the USENIX Security Symposium, where it was immediately accepted. Later, NSA called us back, and in a panic, demanded we withdraw the paper from the conference. I had to apologize to the conference committee; it was terribly embarrassing, and the delay in publishing was two years.

sesutton• 8 years ago

I kind of wonder what they spent all that time doing.

Putting tape over all their LEDs?

nickpsecurity2• 8 years ago

You been alright, Joe? Ever get the new ideas on certification or guards published you were working on when we talked on Schneier's blog?

I ended up pivoting into trying to figure out how to secure the hardware. Deep submicron effects, supply chain compromises, and Clive's energy gapping recommendation led me to devise concept of putting TCB or monitors in 0.35 micron or up process node that's visually inspectable. Tear down random sample using others if they're clean. Trusted foundries for packaging. SOI for EMF/fault reductions. Bunch of little CPU's like Clive recommended with CHERI or SAFE extensions working over optical links with filtered/masked power.

That's about where past year or two of ideas have led me. Havent built anything: just forwarding concepts to people making guards and such. Curious what others csme up with since most guards have dropped to using Linux on x86 or whatever. Shouldve all been decertified for that shit.

jey• 8 years ago

one DES link encryption box [...] was sending out plaintext on the LEDs

What? Care to elaborate? Did they just set the LED brightness based on the current octet being encoded or something? But that seems like it's too high frequency to work.

crankylinuxuser2• 8 years ago

That's neat. It does remind me a few things. They're only related by this topic.

1. A buddy was experimenting with 3d printers, and was measuring the spin on a magnet superglued on the back of a NEMA 17 shaft. He had weird interference going on. We eventually figured out the sensor was sensitive enough to measure the magnetic field in the stepper itself. Our solution was to take a spinning rust HD case, and cut/wrap it around the stepper.

Spinning rust cases are made out of MU-Metal. Think of them as magnetic shielding. And in our case, it worked with nothing more than scrap we had around.

2. There was a company I ran across a year ago that was selling chips that could communicate over a personal magnetic area network. They didn't give hard numbers, but claimed they could transmit audio and video within a 2m bubble. They also worked through stuff like water (which kills most radio). I asked for some samples, but fell on deaf ears. I'd still love to have/purchase a few chips to experiment with.

Gargoyle• 8 years ago

I wonder what ever happened to that idea of a PAN (personal area network) that was touted a few years back.

Anarch157a• 8 years ago

Does your phone talking with you Fitbit and wireless earbuds, then unlocking and starting your car when get close counts ?

skykooler• 8 years ago

Huh. I didn't know mu-metal was a real thing; I always assumed it was something Guardians of Ga'Hoole made up.

crankylinuxuser2• 8 years ago

Yep, sure is legit stuff. There's quite a few things made out of mu-metal, but spinning rust hard drive cases are the most readily accessible.

https://en.wikipedia.org/wiki/Mu-metal

arcaster2• 8 years ago

As obnoxious as randomly pulsating RGB led's are, it seems like a great way to defeat data exfiltration with status LED's of any kind. I'm also curious why air-gapped data centers don't blast the air-waves both inside and outside of the faraday cages with randomized signal noise.

AndrewKemendo• 8 years ago

I can only speak for the DoD/IC but we do blast the air-waves with randomized noise in the form of white/pink noise or radios in and around our SCIFs. It's not really cost effective or critical to add further EM radiative sources to that, as the intention is primarily to reduce risk of voice bugs.

arcaster2• 8 years ago

Cool! I can't wait to see data centers that are pulsating with RGB light in a seizure inducing "Linus Tech Tips - THE MOST INSANE RGB DATA CENTER EVER" kind of way. With all the lights there for "security reasons"

nisten• 8 years ago

So what, do I just set on the bios to run my CPU at 100% all the time now?

asterius• 8 years ago

The real benefit from this work is not exfiltrating from airgapped computers, but from code running inside Intel SGX or similar isolated computation modes.

ridgeguy2• 8 years ago

It seems this data leakage mode could be dealt with by combining the Faraday cage material (which blocks EM radiation) with a high magnetic permeability material (blocks B-fields, as discussed in the paper's ref [50] (paywalled)).

Mu-metal screen is a thing, so maybe copper plating over the mu-metal to combine both shielding mechanisms?

foobarian• 8 years ago

I did a project once where I needed to block RF interference from a battery-powered Raspberry Pi board. I thought back to physics classes and Faraday cages when we learned that no electric fields can come in or out, so I went and put the board into a metal box thinking it would completely block all RF. Boy was I wrong. The box was only enough to attenuate about -10 or -15dB of the WiFi signal! I figured the box had seams so it was behaving as a repeater from outside to inside. I wonder if a perfect seamless box would have done better.

ridgeguy2• 8 years ago

Seamless might have helped. Seams can act as slot radiators.

In plasma deposition chambers I've built, getting continuous electrical contact all the way around mechanical access ports was essential to keep microwave power from getting out of the box.

nearbuy• 8 years ago

You forgot an important detail from your physics classes: the electric field inside a Faraday cage is only zero when it's exposed to static electric fields. Changing electric fields, like radio waves, can pass through, although they'll be attenuated.

Also, if you place an electric charge inside a Faraday cage, it will cause an electric field outside the cage, and the electric field inside the cage will still be zero.

madengr• 8 years ago

MRI rooms are well shielded for both RF and static B field. Multiple layers of air and mu metal gives good B shielding.

stcredzero• 8 years ago

If we extrapolate this into the future, we'll eventually have, "Escaping data from Computers through an Event Horizon."

oxymoran• 8 years ago

Wow. This is pretty mind blowing to someone that is not an engineer.

My take away from this is that if the information is valuable enough and if someone wants the data enough, there is no way to truly make anything 100% secure. There will always be something to exploit. Is this accurate? Can we ever make something that is “invincible “?

empath75• 8 years ago

I guess we need to upgrade our tinfoil hats.

mchahn• 8 years ago

We introduce a malware

How do you get malware onto one of these things? I guess social-hacking could be used but if you have that then no technical solution is needed.

Escaping Data from Faraday-Caged, Air-Gapped Computers via Magnetic Fields

Related Stories