feature article
Subscribe Now

Hacking a Secure Air-Gapped Computer

Research Team Finds Novel Ways to Bypass Security

Some security weaknesses would be hilarious if they weren’t so serious. And one man and his crack research team have found dozens of surprising ways to crack seemingly impenetrable computers. You’ve got to give them points for originality. 

There are a lot of ways to secure a computer, depending on what you’re trying to prevent. Do you want to keep secure information inside? Do you want to prevent outside malware from getting in? Do you want to limit access to only the right people? The list goes on. 

“Air gapping” is the gold standard for trapping sensitive information inside a computer and making sure it can’t be shared, transmitted, or go walkabout. An air-gapped computer has no CD-ROM burner, no floppy disk drive, no SD card interface, no USB slots, and no network interface of any kind. That means no Ethernet, no Wi-Fi, no Bluetooth – nothing that could potentially be used to send data outside the machine. 

Seems pretty secure, right? With no network and no place to stick removable media, there is physically no way to get data off of the computer. Or so you’d think. But Mordechai Guri and his merry band of helpers at Ben-Gurion University of the Negev in Israel has found a way. Many ways, in fact, and some are truly surprising. Or demoralizing, depending on your job description. 

The latest installment in their oeuvre is nicknamed Air-Fi, and it MacGyvers a Wi-Fi interface out of hardware that’s already in your PC. It relies on the underlying electromagnetic radiation that results from any signal transmitted over a wire. Specifically, it subverts your computer’s DRAM into wiggling the memory bus at 2.4 GHz – exactly the frequency range of the 802.11b/g/n Wi-Fi standards. And, since most computers today use standard DIMMs, the hardware is readily available, and you’re pretty much hosed. 

If you want to know how it works, or even to try it out for yourself, the detailed description is in his research paper. It even provides pseudocode. 

Since Air-Fi mimics Wi-Fi, anything in the area with a Wi-Fi interface can pick up the exfiltrated data, including cellphones, wireless routers, access points, harmless IoT gadgets, or other computers. 

If you’ve assembled a new PC lately, you know that DDR4-2400 memory sticks are common. As the name suggests, these operate at a constant 2400 MHz, with memory addresses and data synchronized to the edges of the clock. That frequency sits right on top of the Wi-Fi band, so Guri and his team used this convenient (inconvenient?) parallel as the basis for their hack. The DRAM clock provides the carrier frequency, and data transactions modulate it to encode data. 

To transmit a “1” bit, the software performs a flurry of memory transactions by moving a few megabytes of arbitrary data in order to generate sufficient activity on the SDRAM bus. (CPU-to-memory transactions are a lot faster than Wi-Fi bit times, hence the large block size.) To send a “0” the software does nothing and waits. Timing loops space out the transactions to match the timing specified by Wi-Fi standard. 

Clever, but what if your computer doesn’t use DDR4-2400 memory? Surely Air-Fi won’t work with faster or slower memories, will it? Turns out, it does. 

Guri and his team experimented with both DDR3-2133 and DDR3-1600 DIMMs and successfully compromised them as well. In both cases, they overclocked the memory interface, which is very doable on most systems. Once they got the slower DIMMs running at the correct 2400-MHz rate, the rest was cake. 

For extra credit, Guri and his team also tried single-core versus multicore versions of the attack. Although Air-Fi works just fine as a single thread on a single-core system, going multicore works even better. By synchronizing the individual program threads, they were able to boost the signal strength, increase range, and lower the error rate. 

And the error rate is already pretty good, considering this isn’t even a real Wi-Fi interface. Guri’s team measured bit error rates (BER) of zero out to a range of a meter or two (depending on the computer), increasing into single-digit percentages at longer range. Signal-to-noise ratio (SNR) varied from 3 dB up to 20 dB. Not bad for a fake transmitter that’s not supposed to be there. 

At about 100 bits/sec, Air-Fi isn’t fast, but it is effective. It requires nothing unusual in terms of hardware, although it does require malware on the transmitting side. But once inside, such malware would be hard to identify because all it’s doing is memory transactions, and what’s suspicious about that? How would you detect it? Guri suggests hardware fixes like radio jamming, shielding, or physical distance from any and all potential Wi-Fi receivers.  

As inventive as Air-Fi is, I’m more impressed by some of the team’s other discoveries/inventions. For example, they’ve found ways to toggle the LEDs on your computer’s keyboard, disk drives, or network gear to exfiltrate data. Or to use the speaker. Or the fans. Or even heat. We might as well give up now. 

featured blogs
Apr 19, 2024
In today's rapidly evolving digital landscape, staying at the cutting edge is crucial to success. For MaxLinear, bridging the gap between firmware and hardware development has been pivotal. All of the company's products solve critical communication and high-frequency analysis...
Apr 18, 2024
Are you ready for a revolution in robotic technology (as opposed to a robotic revolution, of course)?...
Apr 18, 2024
See how Cisco accelerates library characterization and chip design with our cloud EDA tools, scaling access to SoC validation solutions and compute services.The post Cisco Accelerates Project Schedule by 66% Using Synopsys Cloud appeared first on Chip Design....

featured video

How MediaTek Optimizes SI Design with Cadence Optimality Explorer and Clarity 3D Solver

Sponsored by Cadence Design Systems

In the era of 5G/6G communication, signal integrity (SI) design considerations are important in high-speed interface design. MediaTek’s design process usually relies on human intuition, but with Cadence’s Optimality Intelligent System Explorer and Clarity 3D Solver, they’ve increased design productivity by 75X. The Optimality Explorer’s AI technology not only improves productivity, but also provides helpful insights and answers.

Learn how MediaTek uses Cadence tools in SI design

featured chalk talk

IoT Data Analysis at the Edge
No longer is machine learning a niche application for electronic engineering. Machine learning is leading a transformative revolution in a variety of electronic designs but implementing machine learning can be a tricky task to complete. In this episode of Chalk Talk, Amelia Dalton and Louis Gobin from STMicroelectronics investigate how STMicroelectronics is helping embedded developers design edge AI solutions. They take a closer look at the benefits of STMicroelectronics NanoEdge-AI® Studio and  STM32Cube.AI and how you can take advantage of them in your next design. 
Jun 28, 2023
34,121 views