Air-Fi: attacking computers that are disconnected and without network hardware is possible
Estimated reading time: 5 minutes
To keep secret information out of reach of attackers, organizations place it on devices that are not connected to any network. This is to avoid any possibility of communication with the Internet. These machines are called air-gapped . As safe as it may seem, infecting such a machine or network segment isn’t actually that difficult. Extracting the information obtained is much more difficult, but it was still possible with the Air-Fi technique .
To study an exploit of this scenario, all kinds of clever methods come into play, and Mordechai Guri, a researcher at Ben-Gurion University of the Negev (Israel), specializes in finding them. Dr. Guri is not the only one, of course, but in recent years, he has been involved in the discovery of a few dozen of these methods. Un new study describes how to extract data from an isolated computer, this time using Wi-Fi technology (hence the name Air-Fi ).
How the Air-Fi method works
The beauty of Air-Fi is that it works even if the target computer has no Wi-Fi hardware. It relies on malware already installed on the device that can use the bus of DDR SDRAM memory to generate electromagnetic radiation at a frequency of 2.4 GHz . Malware can encode necessary data in variations of this radiation, and any device with a Wi-Fi receiver, including another compromised device, can collect and intercept the generated signals. This other device could be a regular smartphone or even a smart light bulb.
The Air-Fi method is particularly unpleasant from a cybersecurity point of view. It does not require administrator rights on the isolated computer; a normal user account can do the job. Also, using a virtual machine doesn’t provide any protection; VMs have access to memory modules.
Transmission range and speed
The researchers transmitted data without noteworthy distortion at a distance of up to 2-3 meters (in one case, up to 8 meters) and a speed of up to 100 bits per second , depending on the hardware of the infected computer and the type of receiver. Like most similar methods, it’s not very fast. Transferring a 20MB file would take 466 hours, for example. That said, the 1,300-byte “Jingle Bells” text could be transferred in 90 seconds. In this light, stealing a username and password with this technique seems entirely realistic.
How an attack could work
Infecting a air-gapped system with malware is not difficult. An attacker can easily do this by contaminating a USB drive, using social engineering or by tricking staff. Once done, the attacker would then have to infect a nearby WiFi-capable device to receive the leaked data. For this, the attacker can infect nearby desktops, laptops or even smartphones of personnel operating the target system with air-gapped .
To prevent this type of physical attack on the company, you may want to consider our service of physical test your company’s security !
After a successful infection, the malware steals data from the air-gapped system, leaking it into the air as Wi-Fi for the receiving device. As the researchers explained:
As part of the exfiltration phase, the attacker could collect data from compromised computers. The data can be documents, key records, credentials, encryption keys, etc. Once the data is collected, the malware starts the secret Air-Fi channel . It encodes the data and transmits it in the air (in the 2.4 GHz Wi-Fi band) using the electromagnetic emissions generated by the DDR SDRAM buses.
The following video shows a possible attack scenario.
The extraordinary absence of wi-fi hardware
As we have seen, the Air-Fi attack does not require specific Wi-Fi hardware to be installed on the target machines. How is it possible?
It is shown that the attack uses DDR SDRAM memory buses to generate electromagnetic emissions in the frequency band typical of the Wi-Fi protocol , ie 2.4 GHz Furthermore, it is also possible to encode data in binary code without specific privileges . Using a virtual machine doesn’t help, as they typically have access to hardware RAM anyway.
Communication between CPU and RAM modules takes place via a bus synchronized with the system clock . This generates electromagnetic radiation which will have a frequency related to the clock frequency. In the case of the DDR4 memory blocks it is around 2.4 GHz.
If the frequency of the modules is not the correct value, it is still possible to overclock or downclock the memory speed by adjusting it to the Wi-Fi frequency of 2.4 GHz.
In short, a machine that uses RAM blocks could still find a way to use them for data transmission. Of course, it all starts with a first compromise that installed malware on the machine.
How to defend yourself from Air-Fi
The use of Air-Fi involves electromagnetic emissions. It is possible to counter the strategy by using the following measures:
- Do not allow Wi-Fi enabled devices to approach air-gapped systems for any reason
- Monitor isolated systems for suspicious processes
- Shielding the computer in a Faraday cage
- Using SOCaaS to monitor networked machines
- Control operations and visits to the company in order to eliminate the possibility of infection via USB stick
Like all similar methods, Air-Fi is too slow and difficult for common cybercriminals to use for everyday attacks. However, if your company is using air-gapped machines for data storage, it is certainly better to take cover, given the recent data hunger of cyber crime < / em>.
We recommend that you consider adopting a SOCaaS to prevent the use of malware, run regular procedures for verifying corporate security, both virtual ( Vulnerability Assessment & amp; Penetration Test ) and physical, as previously suggested, through our dedicated test service .
Contact us to find out how we can help you and how our services can secure your company data, we will be happy to answer any questions.
- The SOAR benefits: simplifying investigation and response
- Security Code Review: How the service works
- Integration of the automated response: the automations in SOCaaS
- Coordination between CTI and SOC: how to further raise the defenses
- New Cloud Server: redundant internet
- Quality certificate for the SOCaaS of SOD
- Managed Detection and Response: a new preventive approach
- CLUSIT: our collaboration for better services
- Backup as a Service (17)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (22)
- Conferenza Cloud (4)
- ICT Monitoring (5)
- Log Management (2)
- News (21)
- ownCloud (4)
- Privacy (7)
- Secure Online Desktop (15)
- Security (170)
- Web Hosting (15)
- CyberDanube Security Research 20221124-0 | Authenticated Command Injection Hirschmann BAT-C2 November 29, 2022Posted by Thomas Weber on Nov 29CyberDanube Security Research 20221124-0 ------------------------------------------------------------------------------- title| Authenticated Command Injection product| Hirschmann (Belden) BAT-C2 vulnerable version| 188.8.131.52R8 fixed version| 09.13.01.00R04 CVE number| CVE-2022-40282 impact| High ...
- Exploiting an N-day vBulletin PHP Object Injection Vulnerability November 29, 2022Posted by Egidio Romano on Nov 29Hello list, Just wanted to share with you my latest blog post: http://karmainsecurity.com/exploiting-an-nday-vbulletin-php-object-injection Best regards, /EgiX
- Win32.Ransom.Conti / Crypto Logic Flaw November 29, 2022Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/99e55ce93392068c970384ab24a0e13d.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Win32.Ransom.Conti Vulnerability: Crypto Logic Flaw Description: Conti ransomware FAILS to encrypt non PE files that have a ".exe" in the filename. Creating specially crafted file names...
- Ransomware Deception Tactics Part 1 November 29, 2022Posted by malvuln on Nov 29Did you know? some Ransomware like CONTI and others will FAIL to encrypt non PE files that have a ".exe" in the filename. Test.exe.docx Test.exe.pdf Conti MD5: 9eb9197cd58f4417a27621c4e1b25a71 ATOMSILO MD5: 5559e9f5e1645f8554ea020a29a5a3ee
- Trojan.Win32.DarkNeuron.gen / Named Pipe Null DACL November 29, 2022Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/d891c9374ccb2a4cae2274170e8644d8.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Trojan.Win32.DarkNeuron.gen Vulnerability: Named Pipe Null DACL Family: DarkNeuron (Turla Group) Type: PE32 MD5: d891c9374ccb2a4cae2274170e8644d8 Vuln ID: MVID-2022-0661 Disclosure: 11/24/2022...
- Backdoor.Win32.Autocrat.b / Weak Hardcoded Credentials November 29, 2022Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/4262a8b52b902aa2e6bf02a156d1b8d4.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Backdoor.Win32.Autocrat.b Vulnerability: Weak Hardcoded Credentials Description: The malware is packed with PeCompact, listens on TCP port 8536 and requires authentication. However, the password...
- Backdoor.Win32.Serman.a / Unauthenticated Open Proxy November 29, 2022Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/f312e3a436995b86b205a1a37b1bf10f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Backdoor.Win32.Serman.a Vulnerability: Unauthenticated Open Proxy Family: Serman Type: PE32 MD5: f312e3a436995b86b205a1a37b1bf10f Vuln ID: MVID-2022-0659 Disclosure: 11/22/2022 Description: The...
- Open-Xchange Security Advisory 2022-11-24 November 29, 2022Posted by Martin Heiland via Fulldisclosure on Nov 29Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne and soon at YesWeHack. Yours sincerely, Martin Heiland, Open-Xchange […]
- [CVE-2022-33942] Intel Data Center Manager Console <= 184.108.40.206749 ”UserMgmtHandler" Authentication Logic Error Leading to Authentication Bypass November 29, 2022Posted by Julien Ahrens (RCE Security) on Nov 29RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Intel Data Center Manager Vendor URL: https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html Type: Authentication Bypass by Spoofing [CWE-290] Date found: 2022-06-01 Date published: 2022-11-23 CVSSv3 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) CVE:...
- crashing potplayer again November 29, 2022Posted by houjingyi on Nov 29I disclosured a crash in potplayer last year : https://seclists.org/fulldisclosure/2021/Mar/76 And I found a new one this year, this time is a mid file. Again I contacted Korea Internet & Security Agency(first-team () krcert or kr), they shared report to the onwer of the potplayer, Kakao Corp as they said. […]
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF