feature article
Subscribe Now

Hacking a Secure Air-Gapped Computer

Research Team Finds Novel Ways to Bypass Security

Some security weaknesses would be hilarious if they weren’t so serious. And one man and his crack research team have found dozens of surprising ways to crack seemingly impenetrable computers. You’ve got to give them points for originality. 

There are a lot of ways to secure a computer, depending on what you’re trying to prevent. Do you want to keep secure information inside? Do you want to prevent outside malware from getting in? Do you want to limit access to only the right people? The list goes on. 

“Air gapping” is the gold standard for trapping sensitive information inside a computer and making sure it can’t be shared, transmitted, or go walkabout. An air-gapped computer has no CD-ROM burner, no floppy disk drive, no SD card interface, no USB slots, and no network interface of any kind. That means no Ethernet, no Wi-Fi, no Bluetooth – nothing that could potentially be used to send data outside the machine. 

Seems pretty secure, right? With no network and no place to stick removable media, there is physically no way to get data off of the computer. Or so you’d think. But Mordechai Guri and his merry band of helpers at Ben-Gurion University of the Negev in Israel has found a way. Many ways, in fact, and some are truly surprising. Or demoralizing, depending on your job description. 

The latest installment in their oeuvre is nicknamed Air-Fi, and it MacGyvers a Wi-Fi interface out of hardware that’s already in your PC. It relies on the underlying electromagnetic radiation that results from any signal transmitted over a wire. Specifically, it subverts your computer’s DRAM into wiggling the memory bus at 2.4 GHz – exactly the frequency range of the 802.11b/g/n Wi-Fi standards. And, since most computers today use standard DIMMs, the hardware is readily available, and you’re pretty much hosed. 

If you want to know how it works, or even to try it out for yourself, the detailed description is in his research paper. It even provides pseudocode. 

Since Air-Fi mimics Wi-Fi, anything in the area with a Wi-Fi interface can pick up the exfiltrated data, including cellphones, wireless routers, access points, harmless IoT gadgets, or other computers. 

If you’ve assembled a new PC lately, you know that DDR4-2400 memory sticks are common. As the name suggests, these operate at a constant 2400 MHz, with memory addresses and data synchronized to the edges of the clock. That frequency sits right on top of the Wi-Fi band, so Guri and his team used this convenient (inconvenient?) parallel as the basis for their hack. The DRAM clock provides the carrier frequency, and data transactions modulate it to encode data. 

To transmit a “1” bit, the software performs a flurry of memory transactions by moving a few megabytes of arbitrary data in order to generate sufficient activity on the SDRAM bus. (CPU-to-memory transactions are a lot faster than Wi-Fi bit times, hence the large block size.) To send a “0” the software does nothing and waits. Timing loops space out the transactions to match the timing specified by Wi-Fi standard. 

Clever, but what if your computer doesn’t use DDR4-2400 memory? Surely Air-Fi won’t work with faster or slower memories, will it? Turns out, it does. 

Guri and his team experimented with both DDR3-2133 and DDR3-1600 DIMMs and successfully compromised them as well. In both cases, they overclocked the memory interface, which is very doable on most systems. Once they got the slower DIMMs running at the correct 2400-MHz rate, the rest was cake. 

For extra credit, Guri and his team also tried single-core versus multicore versions of the attack. Although Air-Fi works just fine as a single thread on a single-core system, going multicore works even better. By synchronizing the individual program threads, they were able to boost the signal strength, increase range, and lower the error rate. 

And the error rate is already pretty good, considering this isn’t even a real Wi-Fi interface. Guri’s team measured bit error rates (BER) of zero out to a range of a meter or two (depending on the computer), increasing into single-digit percentages at longer range. Signal-to-noise ratio (SNR) varied from 3 dB up to 20 dB. Not bad for a fake transmitter that’s not supposed to be there. 

At about 100 bits/sec, Air-Fi isn’t fast, but it is effective. It requires nothing unusual in terms of hardware, although it does require malware on the transmitting side. But once inside, such malware would be hard to identify because all it’s doing is memory transactions, and what’s suspicious about that? How would you detect it? Guri suggests hardware fixes like radio jamming, shielding, or physical distance from any and all potential Wi-Fi receivers.  

As inventive as Air-Fi is, I’m more impressed by some of the team’s other discoveries/inventions. For example, they’ve found ways to toggle the LEDs on your computer’s keyboard, disk drives, or network gear to exfiltrate data. Or to use the speaker. Or the fans. Or even heat. We might as well give up now. 

featured blogs
Sep 23, 2022
When I rejoined Cadence in 2015, we had not yet announced Palladium Z1. But it was basically done, and we announced it a couple of months later. I wrote about the announcement in my post Palladium Z1, an Enterprise Server Farm in a Rack . Next, we created Protium X1 which I c...
Sep 22, 2022
On Monday 26 September 2022, Earth and Jupiter will be only 365 million miles apart, which is around half of their worst-case separation....
Sep 22, 2022
Learn how to design safe and stylish interior and exterior automotive lighting systems with a look at important lighting categories and lighting design tools. The post How to Design Safe, Appealing, Functional Automotive Lighting Systems appeared first on From Silicon To Sof...

featured video

Embracing Photonics and Fiber Optics in Aerospace and Defense Applications

Sponsored by Synopsys

We sat down with Jigesh Patel, Technical Marketing Manager of Photonic Solutions at Synopsys, to learn the challenges and benefits of using photonics in Aerospace and Defense systems.

Read the Interview online

featured paper

Algorithm Verification with FPGAs and ASICs

Sponsored by MathWorks

Developing new FPGA and ASIC designs involves implementing new algorithms, which presents challenges for verification for algorithm developers, hardware designers, and verification engineers. This eBook explores different aspects of hardware design verification and how you can use MATLAB and Simulink to reduce development effort and improve the quality of end products.

Click here to read more

featured chalk talk

MOTIX™ Motor Control Solutions

Sponsored by Mouser Electronics and Infineon

Today’s complex automotive designs require a wide range of motor control and system ICs to deliver the features that customers demand. In this episode of Chalk Talk, Michael Williams from Infineon joins me to explore how Infineon’s MOTIX™ motor control solutions can help simplify your next automotive design. We take a closer look at the MOTIX™ Embedded power system on chip for motor control, the benefits that the MOTIX™ Embedded Power IC can bring to your next design, and how you can get started with your next motor control design with Infineon’s MOTIX™ motor control solutions.

Click here for more information about Infineon Technologies TLE986x 2-Phase Motor/Relay Driver ICs