Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/25/2015
06:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Researchers Use Heat To Breach Air-Gapped Systems

BitWhisper project is part of ongoing air gap security research at Israel's Ben-Gurion University.

Air-gapping, one of the simplest yet strongest defenses against network-borne threats, can be defeated, researchers have found. One of the key weapons in the attack is something just as simple: heat.

Air gapping is a security technique that has long been used to physically separate systems containing particularly sensitive data from the rest of the network. Many consider such device and network isolation to be one of the most effective ways of protecting computers from network borne threats.

Researchers from the Cyber Security Research Center at Israel’s Ben-Gurion University (BGU) have shown how even two air-gapped systems can be breached using heat and their in-built thermal sensors to establish a covert communication channel between them.

The method, dubbed BitWhisper, is part of ongoing research on air gap security at Ben-Gurion University. Last August, security researchers at the university demonstrated another method called AirHopper, in which they showed how it is possible for someone to surreptitiously extract data from a system using FM waves.

What makes BitWhisper different from other air gap research is the fact that this is the first time that researchers have been able to establish a bi-directional communication channel between two air-gapped systems, says Dudu Mimran, chief technology officer at BGU. Also important is the fact the method that was demonstrated does not involve the use of specialized hardware or peripherals.

“We created a way for two computers to communicate using heat,” Mimran says. “What we wanted to prove was that even though there might be an air gap between systems, they can be breached.”

There are some caveats to keep in mind, Mimran notes. For the method to be effective, the air-gapped computers have to be in close proximity to each other. The computers used to demonstrate BitWhisper for instance, were separated by just 15 inches.

Both computers also had specialized malware installed on them that was capable of hooking into the thermal sensors on the systems and also of increasing the heat generated by the computers in a controlled manner, Mimran says.

Importantly, the heat-based communication protocol demonstrated by the researchers supports a data transfer rate of a mere 8-bits per hour. So the method is unlikely of much use for stealing data in volume from air-gapped systems, he says. But it is an effective way to hack into an air-gapped network, transmit commands to it, and to steal passwords, secret keys, and similar data.

BitWhisper can also enable attackers to remotely command and control an air-gapped system, Mimran says.

In a soon-to-be-released paper on using thermal manipulations to breach air-gapped systems, BGU researchers describe BitWhisper as a method for establishing a covert channel between two systems by emitting heat from one system to the other in a controlled manner.

“By regulating the heating patterns, binary data is modulated into thermal signals,” the paper noted. “In turn, the adjacent PC uses its built-in thermal sensors to measure the environmental changes. These changes are then sampled, processed, and demodulated into binary data,” the researchers noted.

Once a bridging attempt is successful, a logical link can be established between the air-gapped internal system and the public network. “At this stage, the attacker can communicate with the formerly isolated network, issuing commands and receiving responses."

One of the biggest challenges in pulling this off is manipulating the heat generated by one computer in a controlled manner so that the other computer detects and responds in an appropriate manner to the change, Mimran says. The trick lies in figuring out how to differentiate between heat based on normal activity and heat generated by malicious activity.

“It is the first time we have communicated between two computers using heat,” he says.

Attacks that leverage BitWhipser and similar methods require a very high-degree of sophistication, Mimran says. So it is unlikely that the research will trigger a new wave of attacks against air-gapped systems. “Even for us, creating something that is robust and not just a simple example requires quite a bit of work,” he says. 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
3/26/2015 | 8:47:41 AM
Interesting Premise but Application?
The idea of data transfer using heat as a medium is astounding. However, if the machines need to have malware already installed on them to tweak the thermal aspect of the machine, why not use that malware for data exfiltration?

I understand that this is very cool, but what is a practical use case where someone would want to use this? I can even see the FM data exfiltration being more effective.
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21360
PUBLISHED: 2021-03-09
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic ...
CVE-2021-21361
PUBLISHED: 2021-03-09
The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed...
CVE-2021-24033
PUBLISHED: 2021-03-09
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoke...
CVE-2021-21510
PUBLISHED: 2021-03-08
Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary ‘Host’ header values to poison a web-cache or trigger redirections.
CVE-2020-27575
PUBLISHED: 2021-03-08
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation.