Air-fi Rete locale Giacomo Lanzi

Air-Fi: attacking computers that are disconnected and without network hardware is possible

Estimated reading time: 5 minutes

To keep secret information out of reach of attackers, organizations place it on devices that are not connected to any network. This is to avoid any possibility of communication with the Internet. These machines are called air-gapped . As safe as it may seem, infecting such a machine or network segment isn’t actually that difficult. Extracting the information obtained is much more difficult, but it was still possible with the Air-Fi technique .

To study an exploit of this scenario, all kinds of clever methods come into play, and Mordechai Guri, a researcher at Ben-Gurion University of the Negev (Israel), specializes in finding them. Dr. Guri is not the only one, of course, but in recent years, he has been involved in the discovery of a few dozen of these methods. Un new study describes how to extract data from an isolated computer, this time using Wi-Fi technology (hence the name Air-Fi ).

Air-fi Local network

How the Air-Fi method works

The beauty of Air-Fi is that it works even if the target computer has no Wi-Fi hardware. It relies on malware already installed on the device that can use the bus of DDR SDRAM memory to generate electromagnetic radiation at a frequency of 2.4 GHz . Malware can encode necessary data in variations of this radiation, and any device with a Wi-Fi receiver, including another compromised device, can collect and intercept the generated signals. This other device could be a regular smartphone or even a smart light bulb.

The Air-Fi method is particularly unpleasant from a cybersecurity point of view. It does not require administrator rights on the isolated computer; a normal user account can do the job. Also, using a virtual machine doesn’t provide any protection; VMs have access to memory modules.

Transmission range and speed

The researchers transmitted data without noteworthy distortion at a distance of up to 2-3 meters (in one case, up to 8 meters) and a speed of up to 100 bits per second , depending on the hardware of the infected computer and the type of receiver. Like most similar methods, it’s not very fast. Transferring a 20MB file would take 466 hours, for example. That said, the 1,300-byte “Jingle Bells” text could be transferred in 90 seconds. In this light, stealing a username and password with this technique seems entirely realistic.

Air-Fi RAM

How an attack could work

Infecting a air-gapped system with malware is not difficult. An attacker can easily do this by contaminating a USB drive, using social engineering or by tricking staff. Once done, the attacker would then have to infect a nearby WiFi-capable device to receive the leaked data. For this, the attacker can infect nearby desktops, laptops or even smartphones of personnel operating the target system with air-gapped .

To prevent this type of physical attack on the company, you may want to consider our service of physical test your company’s security !

After a successful infection, the malware steals data from the air-gapped system, leaking it into the air as Wi-Fi for the receiving device. As the researchers explained:

As part of the exfiltration phase, the attacker could collect data from compromised computers. The data can be documents, key records, credentials, encryption keys, etc. Once the data is collected, the malware starts the secret Air-Fi channel . It encodes the data and transmits it in the air (in the 2.4 GHz Wi-Fi band) using the electromagnetic emissions generated by the DDR SDRAM buses.

The following video shows a possible attack scenario.

The extraordinary absence of wi-fi hardware

As we have seen, the Air-Fi attack does not require specific Wi-Fi hardware to be installed on the target machines. How is it possible?

It is shown that the attack uses DDR SDRAM memory buses to generate electromagnetic emissions in the frequency band typical of the Wi-Fi protocol , ie 2.4 GHz Furthermore, it is also possible to encode data in binary code without specific privileges . Using a virtual machine doesn’t help, as they typically have access to hardware RAM anyway.

Communication between CPU and RAM modules takes place via a bus synchronized with the system clock . This generates electromagnetic radiation which will have a frequency related to the clock frequency. In the case of the DDR4 memory blocks it is around 2.4 GHz.

If the frequency of the modules is not the correct value, it is still possible to overclock or downclock the memory speed by adjusting it to the Wi-Fi frequency of 2.4 GHz.

In short, a machine that uses RAM blocks could still find a way to use them for data transmission. Of course, it all starts with a first compromise that installed malware on the machine.

How to defend yourself from Air-Fi

The use of Air-Fi involves electromagnetic emissions. It is possible to counter the strategy by using the following measures:

  • Do not allow Wi-Fi enabled devices to approach air-gapped systems for any reason
  • Monitor isolated systems for suspicious processes
  • Shielding the computer in a Faraday cage
  • Using SOCaaS to monitor networked machines
  • Control operations and visits to the company in order to eliminate the possibility of infection via USB stick

Like all similar methods, Air-Fi is too slow and difficult for common cybercriminals to use for everyday attacks. However, if your company is using air-gapped machines for data storage, it is certainly better to take cover, given the recent data hunger of cyber crime < / em>.

We recommend that you consider adopting a SOCaaS to prevent the use of malware, run regular procedures for verifying corporate security, both virtual ( Vulnerability Assessment & amp; Penetration Test ) and physical, as previously suggested, through our dedicated test service .

Contact us to find out how we can help you and how our services can secure your company data, we will be happy to answer any questions.

Useful links:

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • 4 vulnerabilities in ibmsecurity November 3, 2024
    Posted by Pierre Kim on Nov 03## Advisory Information Title: 4 vulnerabilities in ibmsecurity Advisory URL: https://pierrekim.github.io/advisories/2024-ibmsecurity.txt Blog URL: https://pierrekim.github.io/blog/2024-11-01-ibmsecurity-4-vulnerabilities.html Date published: 2024-11-01 Vendors contacted: IBM Release mode: Released CVE: CVE-2024-31871, CVE-2024-31872, CVE-2024-31873, CVE-2024-31874 ## Product description ## Vulnerability Summary Vulnerable versions:...
  • 32 vulnerabilities in IBM Security Verify Access November 3, 2024
    Posted by Pierre Kim on Nov 03## Advisory Information Title: 32 vulnerabilities in IBM Security Verify Access Advisory URL: https://pierrekim.github.io/advisories/2024-ibm-security-verify-access.txt Blog URL: https://pierrekim.github.io/blog/2024-11-01-ibm-security-verify-access-32-vulnerabilities.html Date published: 2024-11-01 Vendors contacted: IBM Release mode: Released CVE: CVE-2022-2068, CVE-2023-30997, CVE-2023-30998, CVE-2023-31001, CVE-2023-31004, CVE-2023-31005,...
  • xlibre Xnest security advisory & bugfix releases October 31, 2024
    Posted by Enrico Weigelt, metux IT consult on Oct 31XLibre project security advisory --------------------------------- As Xlibre Xnest is based on Xorg, it is affected by some security issues which recently became known in Xorg: CVE-2024-9632: can be triggered by providing a modified bitmap to the X.Org server. CVE-2024-9632: Heap-based buffer overflow privilege escalation in _XkbSetCompatMap […]
  • APPLE-SA-10-29-2024-1 Safari 18.1 October 31, 2024
    Posted by Apple Product Security via Fulldisclosure on Oct 31APPLE-SA-10-29-2024-1 Safari 18.1 Safari 18.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121571. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Downloads Available for: macOS Ventura and macOS Sonoma Impact: An […]
  • SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600) October 31, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 31SEC Consult Vulnerability Lab Security Advisory < 20241030-0 > ======================================================================= title: Query Filter Injection product: Ping Identity PingIDM (formerly known as ForgeRock Identity Management) vulnerable version: v7.0.0 - v7.5.0 (and older unsupported versions) fixed version: various patches; v8.0 CVE number:...
  • SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333) October 29, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 28SEC Consult Vulnerability Lab Security Advisory < 20241023-0 > ======================================================================= title: Authenticated Remote Code Execution product: Multiple Xerox printers (EC80xx, AltaLink, VersaLink, WorkCentre)  vulnerable version: see vulnerable versions below fixed version: see solution section below CVE number: CVE-2024-6333...
  • APPLE-SA-10-28-2024-8 visionOS 2.1 October 29, 2024
    Posted by Apple Product Security via Fulldisclosure on Oct 28APPLE-SA-10-28-2024-8 visionOS 2.1 visionOS 2.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121566. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. App Support Available for: Apple Vision Pro Impact: A malicious app […]
  • APPLE-SA-10-28-2024-7 tvOS 18.1 October 29, 2024
    Posted by Apple Product Security via Fulldisclosure on Oct 28APPLE-SA-10-28-2024-7 tvOS 18.1 tvOS 18.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121569. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. App Support Available for: Apple TV HD and Apple TV 4K […]
  • APPLE-SA-10-28-2024-6 watchOS 11.1 October 29, 2024
    Posted by Apple Product Security via Fulldisclosure on Oct 28APPLE-SA-10-28-2024-6 watchOS 11.1 watchOS 11.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121565. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: Apple Watch Series 6 and later Impact: An […]
  • APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1 October 29, 2024
    Posted by Apple Product Security via Fulldisclosure on Oct 28APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1 macOS Ventura 13.7.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121568. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. App Support Available for: macOS Ventura Impact: A malicious […]

Customers

Newsletter

{subscription_form_1}