Because computers may contain or interact with sensitive information, they are often airgapped and in this way kept isolated and disconnected from the Internet. In recent years the ability of malware to communicate over an air-gap by transmitting sonic and ultrasonic signals from a computer speaker to a nearby receiver has been shown. In order to eliminate such acoustic channels, current best practice recommends the elimination of speakers (internal or external) in secure computers, thereby creating a so-called 'audio-gap'. In this paper, we present Fansmitter, a malware that can acoustically exfiltrate data from airgapped computers, even when audio hardware and speakers are not present. Our method utilizes the noise emitted from the CPU and chassis fans which are present in virtually every computer today. We show that a software can regulate the internal fans' speed in order to control the acoustic waveform emitted from a computer. Binary data can be modulated and transmitted over these audio signals to a remote microphone (e.g., on a nearby mobile phone). We present Fansmitter's design considerations, including acoustic signature analysis, data modulation, and data transmission. We also evaluate the acoustic channel, present our results, and discuss countermeasures. Using our method we successfully transmitted data from air-gapped computer without audio hardware, to a smartphone receiver in the same room. We demonstrated the effective transmission of encryption keys and passwords from a distance of zero to eight meters, with bit rate of up to 900 bits/hour. We show that our method can also be used to leak data from different types of IT equipment, embedded systems, and IoT devices that have no audio hardware, but contain fans of various types and sizes. Air-Gapped computers are kept physically isolated from the Internet or other less secure networks. Such isolation is often enforced when sensitive or confidential data is involved, in order to reduce the risk of data leakage. In this paper we introduce an acoustic channel which doesn't require a speaker or other audio related hardware to be installed in the infected computer. We show that the noise emitted from a computer's internal CPU and chassis cooling fans can be intentionally controlled by software. For example, a malicious code on a contaminated computer can intentionally regulate the speed of a computer's cooling fans to indirectly control its acoustic waveform. In this way, sensitive data (e.g., encryption keys and passwords) can be modulated and transmitted over the acoustic channel. These signals can then be received by a remote microphone (e.g., via a nearby smartphone), and be decoded and sent to an attacker. Our new method is applicable for a variety of computers and devices equipped with internal fans, including devices such as servers, printers, industrial and legacy systems, and Internet of Things (IoT) devices. Covert channels have been widely discussed in professional literature [20] [21] [22] . Our work focuses on covert channels that can exfiltrate data from air-gapped computers without requiring network connectivity. Over the years different types of out-of-band covert channels have been proposed, aimed at bridging air-gap isolation. The proposed methods can be categorized into electromagnetic, optic, thermal, and acoustic covert channels. Electromagnetic emissions are probably the oldest type of covert channels that have been explored academically. Kuhn and Anderson [7], in a pioneer works in this field, discuss hidden data transmission using electromagnetic emissions from a video card. 2.1. Acoustical methods Madhavapeddy et al [15] discuss 'audio networking,' which allows data transmission between a pair of desktop computers, using 10 dollar speakers and a microphone. In 2013, Hanspach and Goetz [33] extend a method for near-ultrasonic covert networking between air-gapped computers using speakers and microphones. They create a mesh network and use it to implement an air-gapped key-logger to demonstrate the covert channel. The concept of communicating over inaudible sounds has been comprehensively examined by Lee et al [13] , and has also been extended for different scenarios using laptops and smartphones [34] . Table  1 summarizes the different types of covert channels for air-gapped computers, including our Fansmitter method. As can be seen, existing acoustic methods require the installation of an external or internal speaker in the transmitting computer. This is considered a restrictive demand, because in many cases, speakers are forbidden on air-gapped computers based on regulations and security practices [17] . On the other hand, with our method the transmitting computer does not need to be equipped with audio hardware or an internal or external speaker. Attack Model
In 2016, Guri et al introduced Fansmitter, a malware which facilitates the exfiltration of data from an air-gapped computer via noise intentionally emitted from the PC fans REF .
Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers
ArXiv
ArXiv
Computer Science