Researchers from Ben Gurion University Hack air-gapped computer using a basic phone with radio signals
Air-gapped computers are considered the safest option from hack attacks because they are not connected to the Internet or the outside world. Most companies including defence departments and NASA use air-gapped computer to store their most confidential data. Researchers from Israel’s Ben Gurion University have devised a new method for exfiltrating data from such air-gapped computers by bypassing all protections.
All they needed was a working GSM network in the room where the air-gapped computer is present, electromagnetic waves and a basic low-end mobile phone. The researchers from Cyber Security Research Center at Ben-Gurion University of the Negev have demonstrated their hacking skills through a video given below and said that it serves as a warning to defense companies and others that they need to immediately “change their security guidelines and prohibit employees and visitors from bringing devices capable of intercepting RF signals.”
The Attack
The attack requires both the targeted computer and the mobile phone to have malware installed on them. Once the malware has been installed on the targeted computer, the attack exploits the natural capabilities of each device to exfiltrate data using electromagnetic radiation.
All electronic gadgets including computers emit electromagnetic radiation of varying degrees during their normal operation. The researchers said that the basic cell phone has been designed in such a way to receive such signals. They combined these two factors and were able to exfiltrate data without triggering any protection alarms.
Earlier researchers were able to hack a air-gapped computer using radio signals generated by a computer’s video card that get picked up by the FM radio receiver in a smartphone. This attack PoC build on that but goes a step further because it can be used in environments where smartphones are prevented as it uses a basic feature phone as an attack vector.
“[U]nlike some other recent work in this field, [this attack] exploits components that are virtually guaranteed to be present on any desktop/server computer and cellular phone,” the researchers noted in their paper (registration required).
The researchers admit that this attack permits only a small amount of data using a feature phone, however they say it is enough to exfiltrate passwords or even encryption keys. The exploit is also a serious issue because it can be performed without the attacker being in the same room as the air-gapped computer. The researchers found they could also extract much more data from greater distances using a dedicated receiver positioned up to 30 meters away. This means someone using the above technique could wirelessly exfiltrate data through walls from a parking lot or another building.
Mitigation
The researchers noted that the only way to mitigate such attack is to impose a complete ban on all kinds of cell phones in the area of the air-gapped computer. Further the companies could strengthen the working environment with insulated walls or partitions.
Credits
The research was conducted by lead researcher Mordechai Guri, along with Assaf Kachlon, Ofer Hasson, Gabi Kedma, Yisroel Mirsky, and Elovici. Guri said that they will present their findings next month at the Usenix Security Symposium in Washington, DC.
