How to leak data via Wi-Fi when there's no Wi-Fi chip: Boffin turns memory bus into covert data transmitter
- Reference: 1608103809
- News link: https://www.theregister.co.uk/2020/12/16/wifi_memory_hacking/
- Source link:
In a newly released working paper
[1]PDF
, "AIR-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers," Guri, head of research and development at Ben-Gurion University of the Negev, Israel's Cyber-Security Research Center, describes a technique for turning DDR SDRAM buses into transmitters that can spew sensitive data.The technique is envisioned as part of the elaborate attack chain required to compromise highly secure systems that are isolated from public networks.
The first step in this process involves getting malware onto the isolated hardware, either by intercepting the target system and compromising it during the manufacturing or shipping process or by adding malicious code after the hardware has been installed through an infected peripheral like a USB drive.
OK, so you've air-gapped that PC. Cut the speakers. Covered the LEDs. Disconnected the monitor. Now, about the data-leaking power supply unit... [2]READ MORE
Without that, the attack goes nowhere. But these sorts of espionage efforts, mainly a concern for organizations operating critical systems and for potential adversaries like spy agencies, have succeeded: As an example, the paper cites the infamous Stuxnet worm, which a decade ago compromised supervisory control and data acquisition (SCADA) systems and damaged something like 1,000 centrifuges at a uranium enrichment facility in Iran. The destructive code, it's claimed, was introduced to affected systems via a USB thumb drive.
Once a network-disconnected system has been compromised, the question becomes how to exfiltrate data from the machine without anyone noticing. It turns out there are more than a few ways to conduct what's known as a TEMPEST (Telecommunications Electronics Materials Protected from Emanating Spurious Transmissions) attack, which involves covert signaling sent via electromagnetic, acoustic, thermal, optical, or vibrational channels.
Guri's paper lists various publicly disclosed methods, many of which he helped develop. But AIR-FI is the latest technique he's devised. It's a method for sending data via Wi-Fi signals when the target device doesn't have Wi-Fi capability.
When Wi-Fi isn't proper Wi-Fi
"The AIR-FI attack introduced in this paper does not require Wi-Fi related hardware in the air-gapped computers," Guri explains in his paper. "Instead, we show that an attacker can exploit the DDR SDRAM buses to generate electromagnetic emissions in the 2.4 GHz Wi-Fi bands and encode binary data on top of it."
AIR-FI works by transferring data to the data bus, which generates an electromagnetic emission. "Since the clock speed of memory modules is typically around the frequency of 2.4 GHz or its harmonics, the memory operations generate electromagnetic emissions around the IEEE 802.11b/g/n Wi-Fi frequency bands," the paper explains.
For memory modules where that's not the case, the setup malware would need to overclock or underclock the memory speed to generate emissions in the frequency of Wi-Fi bands or their harmonics. This should be possible in software or via BIOS/UEFI configuration. Intel, the paper says, allows the timing parameters of installed memory to be altered using the Extreme Memory Profile (XMP) spec.
From there it's a matter of transmitting data in packets that include a preamble, payload and error-detecting code and ensuring the receiving device is listening.
Guri's experimental setup demonstrated that such signals can be picked up within several meters of the air-gapped machine, though the rate of transmission is rather low: 1-100 bit/sec. You can see it in action below.
[3]Youtube Video
The technique doesn't require any special privileges and works from within a virtual machine. It does require a nearby Wi-Fi capable receiving device, but those turn out to be fairly common in office or industrial environments – any suitably prepared mobile phone, computer, or IoT device would do.
Guri suggests various potential defenses, such as not allowing network-capable devices near air-gapped hardware, implementing Wi-Fi jamming, muddying any potential covert Wi-Fi signal with a background process running random memory/CPU operations, and Faraday shielding.
But the most likely defense against this technique is how much easier it is to conduct network-based attacks. When US government agencies [4]install subverted Orion network monitoring software from SolarWinds, giving hackers the keys to the kingdom, it's clear there's a lot of low-hanging fruit to be had without the bother of building a bridge to an air-gapped machine. ®
Get our [5]Tech Resources
[1] https://arxiv.org/pdf/2012.06884.pdf
[2] https://www.theregister.com/2020/05/04/power_supply_attack/
[3] https://youtu.be/vhNnc0ln63c
[4] https://www.theregister.com/2020/12/15/solar_winds_update/
[5] https://whitepapers.theregister.com/
We used cheap little AM transistor radios from Radio Shack ... I still have mine, and still use it when restoring PDP kit :-)
Damn it – now I have to retrofit my hollowed-out-volcano lair with Faraday cages all over the place. Have you any idea how much that'll frickin' cost? It'll also play havoc with the henchmen's earpieces, not to mention the transmitters controlling the shark-lasers.
Shirley ...
... your henchmen can instead stop the infiltrator from accessing the machine in the first place?
Better computer cases?
Why the signal is not stopped by the metallic case?
Re: Better computer cases?
They should be. Most manufacturing certifications / CE marking etc. cover electromagnetic emissions / interference.
Re: Better computer cases?
The case attenuates it down to a permissible level. A tuned receiver in close proximity could still pick up a deliberately modulated signal. You must also consider all the cables connecting to the PC can act as antennas through secondary emission. They pick up the modulated signal from inside the case and re-radiate it outside.
Sensitive networks are quite often optical fibre, airgapped and housed in a building shaped Faraday cage. And the power feeds are filtered. And the people are filtered for any sort of non-volatile storage media. :-) That gets you quite far along the way to mitigating this sort of thing.
Ever notice ...
... that most (all?) of the so-called "exploits" demonstrated by these folks require that first the attacker has unsupervised access to the machine(s) and/or network in question?
I don't know where they went to security school, but back in my day such a scenario was considered game-over.
Re: Ever notice ...
Have you ever encountered any form of computer that is completely unmolested by a potential adversary?
You must treat everything as already compromised by the time you receive it - manufacture, supply chain, or predecessor. So add defence-in-depth.
Ideally the hardware would be 100% pristine and bug-free, the OS would then be installed from scratch from a known-uncompromised source (yeah, good luck!), and the whole thing replaced anytime anybody else touches it (despite whatever clearances they possess). In reality you mitigate what you can and develop a strong sense of paranoia.
Re: Ever notice ...
"Have you ever encountered any form of computer that is completely unmolested by a potential adversary?"
Sure. My Heath H11 in the corner, the DEC kit downstairs, the IBM 1401 next to it ... But even those are trivially exploitable if the adversary has unsupervised access to them . Which was my point.
Re: Ever notice ...
True - but what they appear to be demonstrating is a method to ex-filtrate (if that's even a word) data from a machine that to the operator appears unable to do such a thing.
Is pretty cool, suspect such a thing could also be achieved by blinking a status light or something.
Re: Ever notice ...
"Is pretty cool, suspect such a thing could also be achieved by blinking a status light or something."
Yep. Hard drive light - https://www.theregister.com/2017/02/23/hard_drive_light_used_to_exfiltrate_data/
Router light - https://www.theregister.com/2017/06/06/data_exfiltration_with_routers_leds/
Also monitor pixels, LCD brightness, drive noise, power cables, case temperature, and basically any property of a computer that can be in any way controlled or monitored. Every time you see a headline about getting data out of a computer in some seemingly insane way, you can pretty much guarantee Bu-Gurion University is involved.
As for the inevitable whining about these attacks not being practical because it requires access to the machine, that remains just as stupid as ever. Just because an attack requires physical access doesn't mean it's irrelevant because then an attacker could just do anything they want. We even have a variety of names to describe some of the circumstances where physical access is very relevant. It usually involves either compromise of something you trust, as in supply chain attacks, or access for a short time, as in evil maid attacks. In both cases, physical access provides the initial compromise, but the attacker still needs some way to actually do anything afterwards.
That's the entire point of this sort of research. The traditional approach to guarding against attacks like that is to air-gap machines - don't connect to the internet, block off the USB ports, and so on. Even if your supply chain is compromised, it doesn't matter because you never connect to the outside world anyway. What Ben-Gurion keep showing is that there are all kinds of ways to get data out that aren't normally protected against. It doesn't matter that the proof-of-concepts aren't usually especially practical or that most of them are fairly trivial to block once you know about them. If you're paranoid enough to worry about evil maids and supply chains, you also need to be paranoid enough to do more than assume that just because you haven't plugged an internet cable in everything must be secure.
air gap? add faraday cage!
It really is that simple as someone living in a house made of foil backed plasterboard can assure you.
How cool
It never ceases to amaze me the ways people come up with to compromise stuff. And more so that, once they've been pointed out by someone else, most of them become pretty obvious and are simple in concept.
It must be a right fun job, thinking up these exploits and implementing them. I just don't have the imagination.
And certainly, as others have pointed out, the immediate practicality doesn't matter. It's the awareness of the possibilities that matters, because being aware of the possibility means you and others can mitigate against it. And to remember people who come up with these things don't all work for the good guys. If any of them can be called good guys.
Many years ago, I remember our DEC field service engineer carried a medium wave radio with him. Placed next to the PDP-11 UNIBUS wiring he could diagnose some failures just by listening to the noise (or lack of it).