AIR-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers Mordechai Guri Ben-Gurion University of the Negev, Israel Cyber-Security Research Center [email protected] demo video: https://www.youtube.com/watch?v=vhNnc0ln63c air-gap research page: http://www.covertchannels.com Abstract—In this paper, we show that attackers can exfiltrate deceived insiders [20][5]. These techniques allow the attackers data from air-gapped computers via Wi-Fi signals. Malware in to insert targeted malware into systems within the isolated a compromised air-gapped computer can generate signals in the environment. Wi-Fi frequency bands. The signals are generated through the memory buses - no special hardware is required. Sensitive data One of the most famous incidents in which the air-gap can be modulated and secretly exfiltrated on top of the signals. was breached involved the Stuxnet worm which targeted su- We show that nearby Wi-Fi capable devices (e.g., smartphones, pervisory control and data acquisition (SCADA) systems and laptops, IoT devices) can intercept these signals, decode them, destroyed an estimated 1,000 centrifuges at an Iranian uranium and send them to the attacker over the Internet. To extract enrichment facility [53]. In 2018, the US Department of the signals, we utilize the physical layer information exposed by the Wi-Fi chips. We implement the transmitter and receiver Homeland Security accused Russian hackers of penetrating the and discuss design considerations and implementation details. We internal network of America’s electric utilities [4]. In 2019, the evaluate this covert channel in terms of bandwidth and distance media reported that the Kudankulam Nuclear Power Plant was and present a set of countermeasures. Our evaluation shows that the target of a successful cyber attack earlier that year [21]. data can be exfiltrated from air-gapped computers to nearby In addition, sophisticated malware, such as SymonLoader [8] Wi-Fi receivers located a distance of several meters away. and other advanced persistent threats capable of compromising I. INTRODUCTION air-gapped networks, were found in the wild [14], [1], [15]. One of the initial phases in the kill chain of advanced C. Air-Gap Exfiltration persistent threats (APTs) is infiltrating the network of the target organization. To achieve this goal, adversaries may use Once the attacker has taken his/her its initial step into the attack vectors, such phishing emails, compromised websites, air-gapped network, he/she moves on to the next phases of malicious documents, exploit kits, and other types of online the kill chain. In these subsequent phases sensitive data is attacks [15]. collected, including: documents, files, keylogging, credentials, and biometric information. In the case of Internet connected A. Isolated, Air-Gapped Networks networks the data is exfiltrated through covert channels within When highly sensitive or confidential information is in- Internet protocols (e.g., HTTPS, FTP, SSH, and SMTP [61]). volved, an organization may resort to air-gapped networks. However, in isolated air-gapped networks, the attacker must Such networks are disconnected from the Internet logically use unconventional communication techniques to leak the data and physically, with any type of wired or wireless connection out - methods which are referred to as air-gap covert channels to the Internet strictly prohibited [3]. Certain sectors may [29]. Over the years, various types of air-gap covert channels arXiv:2012.06884v1 [cs.CR] 12 Dec 2020 maintain their data within air-gapped networks, including have been introduced. For example, malware may exploit financial, defense, and critical infrastructure sectors. In many electromagnetic radiation from various computer components cases, operational technology (OT) networks are also kept to transmit data [32], [51], [52], [60], [31]. Acoustic [19], isolated from the Internet to protect the physical processes and [40], optical [55], [44], [45], thermal [35], magnetic [27], machinery used to carry them out [5]. Classified networks such and electric [42] air-gap covert channels have also been as the Joint Worldwide Intelligence Communications System demonstrated over the past 20 years [18]. are also known to be air-gapped [7]. D. Our Contribution B. Infecting Air-Gapped Networks In this paper we introduce a new type of covert channel Despite the high degree of isolation, air-gapped networks that exploits Wi-Fi to leak data from air-gapped networks. are not immune to cyber attacks. To penetrate highly secure The AIR-FI attack introduced in this paper does not require networks, motivated adversaries may employ complex attack Wi-Fi related hardware in the air-gapped computers. Instead, vectors, such as sabotaging the supply chain, compromising a we show that an attacker can exploit the DDR SDRAM buses third-party software, using malicious insiders, and exploiting to generate electromagnetic emissions in the 2.4 GHz Wi-Fi bands and encode binary data on top of it. We also show TABLE I that nearby Wi-Fi receivers, such smartphones, laptops, and SUMMARY OF EXISTING AIR-GAP COVERT CHANNELS Internet of Things (IoT) devices, can receive and decode the Type Method modulated data, and then send it to the attacker via the Internet. AirHopper (FM radio) [32], [34] GSMem (cellular frequencies) [31] The AIR-FI covert channel has the following characteristics: Electromagnetic USBee (USB bus emission) [33] • Requires no Wi-Fi transmitter. The method doesn’t AIR-FI (Wi-Fi frequencies) MAGNETO (CPU-generated magnetic fields) [27] require any type of Wi-Fi hardware in the air-gapped Magnetic ODINI (Faraday shield bypass) [46] computer. Instead, it uses the computer memory hardware Electric PowerHammer (power lines) [42] (DDR SDRAM) to generate the signals. Fansmitter (computer fan noise) [40] • Requires no special privileges. The transmitting code DiskFiltration (hard disk noise) [37] Ultrasound [47] Acoustic does not require special privileges (e.g., root), kernel MOSQUITO (speaker-to-speaker) [38] [39] drivers, or access to hardware resources. Furthermore, it POWER-SUPPLAY (Play sound from Power-Supply) [26] can be initiated from an ordinary user space process. CD-LEAK (sound from CD/DVD drives) [25] BitWhisper (CPU generated heat) [36] Thermal • Works in virtual machines (VMs). The covert channel HOTSPOT ( CPU generated heat received by a smartphone) [23] works effectively, even from within an isolated virtual LED-it-GO (hard drive LED) [44] machine. VisiSploit (invisible pixels) [30] Optical Keyboard LEDs [55] [41] • Has many potential receivers. Modern IT environments Router LEDs [43] are equipped with many types of Wi-Fi capable devices: aIR-Jumper (security cameras and infrared) [28] smartphones, laptops, IoT devices, sensors, embedded Vibrations AiR-ViBeR (computer fan vibrations) [24] systems and smart watches and other wearables devices. The attacker can potentially hack such equipment to receive the AIR-FI transmissions from air-gapped com- lines [42]. The data is modulated and conducted to the power puters. lines and received by an adversary tapping the wires. Several studies have proposed the use of optical emanations The rest of this paper is organized as follows: Related work from computers for covert communication. Loughry intro- is presented in Section II. The attack model is discussed in duced the use of keyboard LEDs [55]. Guri used the hard Section III. Technical background on DDR SDRAM and Wi- drive indicator LED [44], USB keyboard LEDs [41], router Fi is provided in Section IV. Sections V and VI, respectively, and switch LEDs [43], and security cameras and their IR LEDs contain details on signal generation and modulation, and data [28], in order to exfiltrate data from air-gapped computers. transmission and reception. In Section VII we present the Data can also be leaked optically through fast blinking images evaluation and measurement results. A set of countermeasures or low contrast bitmaps projected on the LCD screen [30]. is discussed in Section VIII, and we conclude in Section IX. Hanspach [47] used inaudible sound to establish a covert channel between air-gapped laptops equipped with speakers II. RELATED WORK and microphones. Guri et al introduced Fansmitter [40], Disk- Air-gap covert channels are classified into seven main cate- filtration [37], and CD-LEAK [25] malware which facilitates gories: electromagnetic, magnetic, electric, acoustic, thermal, the exfiltration of data from an air-gapped computer via optical and vibrational. noise intentionally generated from the PC fans, hard disk Kuhn showed that it is possible to exploit the electromag- drives [37], and CD/DVD drives [25]. In these methods, the netic emissions from the computer display unit to conceal transmitting computer does not need to be equipped with audio data [51]. AirHopper, presented in 2014, is a new exfiltration hardware or an internal or external speaker. Researchers also malware, capable of leaking data from air-gapped computers showed that the computer fans generate vibrations which can to a nearby smartphone via FM radio waves emitted from be sensed by a nearby smartphone using the accelerometer the screen cable [32], [34]. In 2015, Guri et al presented sensor [24]. Other papers presented malware that covertly turns GSMem [31], malware that transmit data from air-gapped the speakers and earphones connected to a PC into a pair computers to nearby mobile-phones using cellular frequencies. of eavesdropping microphones when a standard microphone USBee is malware that uses the USB data buses to generate is muted, turned off, or not present [38] [39]. Recently, electromagnetic signals [33]. researchers demonstrated how malware can turn the computer In order to prevent electromagnetic leakage, Faraday cages power supply into out-of-band speaker in order to exfiltrate can be used to shield sensitive systems. Guri et al presented information [26]. ODINI [46] and MAGNETO [27], two types of malware that Guri et al introduced BitWhisper [36] and HOTSPOT [23], can exfiltrate data from Faraday-caged air-gapped computers thermal-based covert channels enabling bidirectional commu- via magnetic fields generated by the computer’s CPU.