badBIOS revisited - it is possible to bridge the airgap after all

[40hz]

This topic came up in an earlier DoCo post started by Renegade here.



It's a far cry from being a viable vector for in-the-wild malware. But researchers in Germany have apparently developed a 'proof of concept' piece of malware that can bridge the "air gap" between unconnected PCs at distances up to 65 feet using the internal speakers and microphone found in most modern laptops - with longer distances possible using an acoustic mesh network made up of previously infected machines.

Full ArsTechnica write-up here.

Scientist-developed malware covertly jumps air gaps using inaudible sound
Malware communicates at a distance of 65 feet using built-in mics and speakers.

by Dan Goodin - Dec 2 2013, 2:29pm EST

Computer scientists have developed a malware prototype that uses inaudible audio signals to communicate, a capability that allows the malware to covertly transmit keystrokes and other sensitive data even when infected machines have no network connection.

The proof-of-concept software—or malicious trojans that adopt the same high-frequency communication methods—could prove especially adept in penetrating highly sensitive environments that routinely place an "air gap" between computers and the outside world. Using nothing more than the built-in microphones and speakers of standard computers, the researchers were able to transmit passwords and other small amounts of data from distances of almost 65 feet. The software can transfer data at much greater distances by employing an acoustical mesh network made up of attacker-controlled devices that repeat the audio signals.

Interesting reading. Especially some of the more knowledgeable comments attached to the main article.

Check it out!

[ewemoa]

Nice find.

With a higher bandwidth, it might be interesting to use as an alternative network

[40hz]

^Yeah. My thoughts exactly. An acoustic mesh network sounded intruguing - and useful

 

[ewemoa]

Could we practice injecting into the network by voicce?

[x16wda]

Could we practice injecting into the network by voicce?

-ewemoa (December 03, 2013, 08:57 PM)

How about with a whistle?  Maybe a nice cheap one from a box of crunchy sugar-laden cereal...

[ewemoa]

Is that a historical reference?  Perhaps it's actually doable as may be it's doubtful humans can produce the necessary sounds with their in-born equipment

[40hz]

@x16wda- LOL! Worked for Mr. Draper (aka Cap'n Crunch). It could work for us!  

--------------------

Is that a historical reference?

-ewemoa (December 03, 2013, 09:26 PM)

You betcha! Look here.



John Draper - THE Man!

[Stoic Joker]

Zoiks! 20bps is a lot more respectable a speed than previously thought. Even with a high overhead you can still pack a lot of sneaky in a pipe that size.

[40hz]

Zoiks! 20bps is a lot more respectable a speed than previously thought. Even with a high overhead you can still pack a lot of sneaky in a pipe that size.

-Stoic Joker (December 04, 2013, 07:17 AM)

Yup. Something small. Maybe a fork bomb such as [# {‘s -m (){ :| :& };:] y'know?

(Note: I pooched the above string. It's purely for illustration purposes. It doesn't run as is. )

[Stoic Joker]

Zoiks! 20bps is a lot more respectable a speed than previously thought. Even with a high overhead you can still pack a lot of sneaky in a pipe that size.

-Stoic Joker (December 04, 2013, 07:17 AM)

Yup. Something small. Maybe a fork bomb such as [# {‘s -m (){ :| :& };:] y'know?

(Note: I pooched the above string. It's purely for illustration purposes. It doesn't run as is. )

-40hz (December 04, 2013, 09:29 AM)

So...I wonder how many watch lists I'm on now for googling that?? ...Not really a "Linux Guy" so the term didn't ring a bell right away.

There are actually some much shorter variants on that theme ... that I may play with this evening using a VM as a target.

[40hz]

There are actually some much shorter variants on that theme ... that I may play with this evening using a VM as a target.

-Stoic Joker (December 04, 2013, 11:44 AM)

Knock yourself out...or just blow some poor VM off the face of the earth. I sure did when I first learned about that sort of exploit!

[SeraphimLabs]

First time I played with a fork bomb, I turned it loose on a benchtop machine. Poor old Sparc-powered Sun4U, the linux load was up to 2600 and it was still stable. A sign? Maybe.

What interests me is how it is able to infect other machines on the other side of the airgap. Somehow I don't think most computers routinely check their microphones for incoming data, let alone execute data recorded from the air.

You would have to first breach the airgrap, but once you did you could control stuff across it.

[40hz]

What interests me is how it is able to infect other machines on the other side of the airgap. Somehow I don't think most computers routinely check their microphones for incoming data, let alone execute data recorded from the air.

-SeraphimLabs (December 06, 2013, 03:45 PM)

Correct. The problem is primarily on machines that do have (and leave) the microphone enabled. The paper mentioned Skype and related users. But any infection that availed itself of this concept would not need to be limited to acoustic communications. It merely adds yet another vector for infection (as you noted) to the palette of methods we're already familiar with.

For example, suppose you could infect a machine in the usual way (i.e. wire, wireless, media, download), and covertly enable the sound system to transmit keystroke data. And also have the microphone listening for an "I'm listening" signal from a zombie routing machine to start playing it. Then that same zombie device could start recording and transmitting your keystrokes elsewhere via whatever network it's connected to for analysis and possible later use.

It's not so much what this can do now. But give it some time. Just sitting with some of my "in the biz" cronies, we came up with a few dozen viable ideas. That was without even trying. And none of us are real hacker types. Just imagine what the real professional 'naughty folks' will come up with.
 

[Innuendo]

(see attachment in previous post)
John Draper - THE Man!

-40hz (December 03, 2013, 10:03 PM)

This guy looks like he protected his PCs from this acoustic malware by blaring the Grateful Dead at loud volumes while he was computing.

[Vurbal]

I'll stick with Motorhead for my malware protection.