feature article
Subscribe Now

Hacking a Secure Air-Gapped Computer

Research Team Finds Novel Ways to Bypass Security

Some security weaknesses would be hilarious if they weren’t so serious. And one man and his crack research team have found dozens of surprising ways to crack seemingly impenetrable computers. You’ve got to give them points for originality. 

There are a lot of ways to secure a computer, depending on what you’re trying to prevent. Do you want to keep secure information inside? Do you want to prevent outside malware from getting in? Do you want to limit access to only the right people? The list goes on. 

“Air gapping” is the gold standard for trapping sensitive information inside a computer and making sure it can’t be shared, transmitted, or go walkabout. An air-gapped computer has no CD-ROM burner, no floppy disk drive, no SD card interface, no USB slots, and no network interface of any kind. That means no Ethernet, no Wi-Fi, no Bluetooth – nothing that could potentially be used to send data outside the machine. 

Seems pretty secure, right? With no network and no place to stick removable media, there is physically no way to get data off of the computer. Or so you’d think. But Mordechai Guri and his merry band of helpers at Ben-Gurion University of the Negev in Israel has found a way. Many ways, in fact, and some are truly surprising. Or demoralizing, depending on your job description. 

The latest installment in their oeuvre is nicknamed Air-Fi, and it MacGyvers a Wi-Fi interface out of hardware that’s already in your PC. It relies on the underlying electromagnetic radiation that results from any signal transmitted over a wire. Specifically, it subverts your computer’s DRAM into wiggling the memory bus at 2.4 GHz – exactly the frequency range of the 802.11b/g/n Wi-Fi standards. And, since most computers today use standard DIMMs, the hardware is readily available, and you’re pretty much hosed. 

If you want to know how it works, or even to try it out for yourself, the detailed description is in his research paper. It even provides pseudocode. 

Since Air-Fi mimics Wi-Fi, anything in the area with a Wi-Fi interface can pick up the exfiltrated data, including cellphones, wireless routers, access points, harmless IoT gadgets, or other computers. 

If you’ve assembled a new PC lately, you know that DDR4-2400 memory sticks are common. As the name suggests, these operate at a constant 2400 MHz, with memory addresses and data synchronized to the edges of the clock. That frequency sits right on top of the Wi-Fi band, so Guri and his team used this convenient (inconvenient?) parallel as the basis for their hack. The DRAM clock provides the carrier frequency, and data transactions modulate it to encode data. 

To transmit a “1” bit, the software performs a flurry of memory transactions by moving a few megabytes of arbitrary data in order to generate sufficient activity on the SDRAM bus. (CPU-to-memory transactions are a lot faster than Wi-Fi bit times, hence the large block size.) To send a “0” the software does nothing and waits. Timing loops space out the transactions to match the timing specified by Wi-Fi standard. 

Clever, but what if your computer doesn’t use DDR4-2400 memory? Surely Air-Fi won’t work with faster or slower memories, will it? Turns out, it does. 

Guri and his team experimented with both DDR3-2133 and DDR3-1600 DIMMs and successfully compromised them as well. In both cases, they overclocked the memory interface, which is very doable on most systems. Once they got the slower DIMMs running at the correct 2400-MHz rate, the rest was cake. 

For extra credit, Guri and his team also tried single-core versus multicore versions of the attack. Although Air-Fi works just fine as a single thread on a single-core system, going multicore works even better. By synchronizing the individual program threads, they were able to boost the signal strength, increase range, and lower the error rate. 

And the error rate is already pretty good, considering this isn’t even a real Wi-Fi interface. Guri’s team measured bit error rates (BER) of zero out to a range of a meter or two (depending on the computer), increasing into single-digit percentages at longer range. Signal-to-noise ratio (SNR) varied from 3 dB up to 20 dB. Not bad for a fake transmitter that’s not supposed to be there. 

At about 100 bits/sec, Air-Fi isn’t fast, but it is effective. It requires nothing unusual in terms of hardware, although it does require malware on the transmitting side. But once inside, such malware would be hard to identify because all it’s doing is memory transactions, and what’s suspicious about that? How would you detect it? Guri suggests hardware fixes like radio jamming, shielding, or physical distance from any and all potential Wi-Fi receivers.  

As inventive as Air-Fi is, I’m more impressed by some of the team’s other discoveries/inventions. For example, they’ve found ways to toggle the LEDs on your computer’s keyboard, disk drives, or network gear to exfiltrate data. Or to use the speaker. Or the fans. Or even heat. We might as well give up now. 

featured blogs
Dec 1, 2023
Why is Design for Testability (DFT) crucial for VLSI (Very Large Scale Integration) design? Keeping testability in mind when developing a chip makes it simpler to find structural flaws in the chip and make necessary design corrections before the product is shipped to users. T...
Nov 27, 2023
See how we're harnessing generative AI throughout our suite of EDA tools with Synopsys.AI Copilot, the world's first GenAI capability for chip design.The post Meet Synopsys.ai Copilot, Industry's First GenAI Capability for Chip Design appeared first on Chip Design....
Nov 6, 2023
Suffice it to say that everyone and everything in these images was shot in-camera underwater, and that the results truly are haunting....

featured video

TDK CLT32 power inductors for ADAS and AD power management

Sponsored by TDK

Review the top 3 FAQs (Frequently Asked Questions) regarding TDK’s CLT32 power inductors. Learn why these tiny power inductors address the most demanding reliability challenges of ADAS and AD power management.

Click here for more information

featured paper

3D-IC Design Challenges and Requirements

Sponsored by Cadence Design Systems

While there is great interest in 3D-IC technology, it is still in its early phases. Standard definitions are lacking, the supply chain ecosystem is in flux, and design, analysis, verification, and test challenges need to be resolved. Read this paper to learn about design challenges, ecosystem requirements, and needed solutions. While various types of multi-die packages have been available for many years, this paper focuses on 3D integration and packaging of multiple stacked dies.

Click to read more

featured chalk talk

E-Mobility - Charging Stations & Wallboxes AC or DC Charging?
In this episode of Chalk Talk, Amelia Dalton and Andreas Nadler from Würth Elektronik investigate e-mobility charging stations and wallboxes. We take a closer look at the benefits, components, and functions of AC and DC wallboxes and charging stations. They also examine the role that DC link capacitors play in power conversion and how Würth Elektronik can help you create your next AC and DC wallbox or charging station design.
Jul 12, 2023
17,357 views