Hacker can Steal the Data Using Computer Fan and Smartphone Vibrations

- May 04, 2020

it's not enough to disconnect the network. It won't work now. Unexpectedly, the computer fan used for heat dissipation has also become the object of hackers stealing data. Let us first feel the process of "criminal". The following office environment can be said to be "standard" too: the main box, display, keyboard ... all three pieces live together.

The cell phone next to it is a "criminal weapon." It will steal the contents of the document quietly according to the vibration generated when the host fan rotates. It is worth mentioning that the above environment is an air-gapped system (commonly speaking, it refers to placing the computer in a physically disconnected environment. The AiR-Viber is the latest new technology from the Mordechai Guri team in Israel- to steal the data using PC fan vibrations.

The "isolated" security system also cannot hold back, the Guri team has been studying how to steal computer data from the "isolated" environment. This time, they analyzed a way that had never been studied before. More specifically, it is done through the vibration generated by the computer fan, including the CPU fan, GPU fan, or other fans installed in the chassis, to achieve the purpose of stealing the data. According to Guri, the malicious code implanted in the air gap system can control the speed of the fan. By adjusting the speed of the fan, an attacker can control the frequency of fan vibration.

Air-Viber technology uses sensitive information stored in the air gap system to change the fan speed and generate a vibration pattern. Then, spread through the surrounding environment (such as a table). Next, nearby attackers can use the acceleration sensor in the smartphone to record these vibrations, and then decode the information hidden in the vibration mode to reconstruct the information stolen from the air gap system.

Air-Viber technology uses sensitive information stored in the air gap system to change the fan speed to generate a vibration pattern. Then, spread through the surrounding environment (such as a table). Next, nearby attackers can use the acceleration sensor in the smartphone to record these vibrations, and then decode the information hidden in the vibration mode to reconstruct the information stolen from the air gap system.

There are also two ways to collect these vibrations.

If an attacker can actually enter the air gap network, they can place their smartphone on a table near the air gap system and collect directional vibrations without touching the computer. If the attacker cannot access the air-gap network, then the attacker can infect the smartphones of the employees of the target company. These devices can replace the attacker and feel the vibration from the fan. Guri emphasized that the second way of collecting vibrations is entirely possible because modern smartphone acceleration sensors can be accessed by any application and do not require user permission.

In fact, this is not the first time the Guri team has tried to steal data in an air gap system. In the past five years, the team has been trying various methods to send data from the "isolated" computer to the outside world without being discovered. Guri and his team at the Ben-Gurion university's Cyber-Security Research Center have revealed that invaders could steal data from secure systems using a plethora of techniques such as:

LED-it-Go exfiltrate data from air-gapped systems via an HDD's activity LED
USBee force a USB connector's data bus give out electromagnetic emissions that can be used to exfiltrate data
AirHopper use the local GPU card to emit electromagnetic signals to a nearby mobile phone, also used to steal data
Fansmitter - steal data from air-gapped PCs using sounds emanated by a computer's GPU fan
DiskFiltration - use controlled read/write HDD operations to steal data via sound waves
BitWhisper - exfiltrate data from non-networked computers using heat emanations
Unnamed attack - uses flatbed scanners to relay commands to malware-infested PCs or to exfiltrate data from compromised systems
xLED - use router or switch LEDs to exfiltrate data
aIR-Jumper - use a security camera's infrared capabilities to steal data from air-gapped networks
HVACKer - use HVAC systems to control malware on air-gapped systems
MAGNETO & ODINI - steal data from Faraday cage-protected systems
MOSQUITO - steal data from PCs using attached speakers and headphones
PowerHammer - steal data from air-gapped systems using power lines
CTRL-ALT-LED - steal data from air-gapped systems using keyboard LEDs
BRIGHTNESS - steal data from air-gapped systems using screen brightness variations.

You may worry: even in a highly secure environment, there are so many ways to steal data, and it is also possible to "get things from the air", is it too unsafe? Don't worry too much. Although technologies like AiR-Viber have an extensive hidden nature, the speed is relatively slow. Through the vibration, data can only leak at a low speed of 0.5 bits per second ... It is quite unrealistic to steal data at this speed. In addition, ordinary users do not need to worry about technologies like AiR-Viber, after all, we are connected to the Internet ... it is more dangerous. However, administrators working in a highly secure environment should pay attention to it ...