2018/02/07 by Mordechai Guri, Boris Zadov, Guri, Mordechai +5 · 1 voice · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Security and Verification in Computing #User Authentication and Security Systems #cs.CR
paper · pdf · doi:10.48550/arxiv.1802.02700
openalex publication_date 2018/02/07 · openalex created_date 2022/10/03 · openalex updated_date 2026/07/28
Air-gapped computers are computers which are kept isolated from the Internet,\nbecause they store and process sensitive information. When highly sensitive\ndata is involved, an air-gapped computer might also be kept secluded in a\nFaraday cage. The Faraday cage prevents the leakage of electromagnetic signals\nemanating from various computer parts, which may be picked up by an\neavesdropping adversary remotely. The air-gap separation, coupled with the\nFaraday shield, provides a high level of isolation, preventing the potential\nleakage of sensitive data from the system. In this paper, we show how attackers\ncan bypass Faraday cages and air-gaps in order to leak data from highly secure\ncomputers. Our method is based on an exploitation of the magnetic field\ngenerated by the computer CPU. Unlike electromagnetic radiation (EMR), low\nfrequency magnetic radiation propagates though the air, penetrating metal\nshielding such as Faraday cages (e.g., compass still works inside Faraday\ncages). We introduce a malware code-named ODINI that can control the low\nfrequency magnetic fields emitted from the infected computer by regulating the\nload of the CPU cores. Arbitrary data can be modulated and transmitted on top\nof the magnetic emission and received by a magnetic receiver (bug) placed\nnearby. We provide technical background and examine the characteristics of the\nmagnetic fields. We implement a malware prototype and discuss the design\nconsiderations along with the implementation details. We also show that the\nmalicious code does not require special privileges (e.g., root) and can\nsuccessfully operate from within isolated virtual machines (VMs) as well.\n