Abstract-In this paper, we show that attackers can leak data from isolated, air-gapped computers to nearby smartphones via covert magnetic signals. The proposed covert channel works even if a smartphone is kept inside a Faraday shielding case, which aims to block any type of inbound and outbound wireless communication (Wi-Fi, cellular, Bluetooth, etc.). The channel also works if the smartphone is set in 'airplane mode' in order to block any communication with the device. We implement a malware that controls the magnetic fields emanating from the computer by regulating workloads on the CPU cores. Sensitive data such as encryption keys, passwords, or keylogging data is encoded and transmitted over the magnetic signals. A smartphone located near the computer receives the covert signals with its magnetic sensor. We present technical background, and discuss signal generation, data encoding, and signal reception. We show that the proposed covert channel works from a userlevel process, without requiring special privileges, and can successfully operate from within an isolated virtual machine (VM). Magnetic sensors (also known as magnetometers) in smartphones and tablets are mainly used for orientation and positioning. Unlike cellular, Wi-Fi, Bluetooth, and NFC hardware, magnetic sensors are not considered communication interfaces. Thus, they can be accessed with basic permissions and remain active even in airplane mode, where all wireless communication interfaces are disabled. In this paper, we show how attackers can maliciously utilize a smartphone's magnetic sensors in order to exfiltrate information from isolated, non-networked (air-gapped) computers. In this attack, a malware on the air-gapped computer gathers sensitive data and transmits it via magnetic fields generated from the CPU cores. The covert magnetic signals are then received by a smartphone located in close proximity to the computer. The data received is decoded and sent to the attacker via the Internet (e.g., Wi-Fi or cellular data). An air-gapped network is a secured computer network in which security measures are taken to maintain physical separation from public networks such as the Internet. Such security measures taken may include separation of network equipment, using physical access control to systems, banning unauthorized hardware and so on. But despite of these restrictions, several incidents in the last decade has shown that air-gapped networks are not immune to malware infections [1][2] [3] . For example, In 2017, WikiLeaks published a reference to a tool dubbed 'Brutal Kangaroo,' allegedly used to infiltrate air-gapped computers via external USB drives [4] . Using such techniques, attackers can breach the network and bypass security measures such intrusion detection and intrusion prevention systems (IDS/IPS). In order to exfiltrate data from the compromised airgapped, networkless, computer, attackers must leak the data through special types of covert channels known as air-gap covert channels. Over the years, several types of air-gap covert channels have been proposed based on electromagnetic [5] [6] [7] [8] [9] [15] emanations from the computer. In this paper, we propose a magnetic covert channel between air-gapped computers (e.g., workstation) and smartphone located nearby. Note that the covert channel requires that malicious code is run on both sides: on the air-gapped computer and the adjacent smartphone. We introduce a new type of covert communication between airgapped computers and nearby smartphones. Although the proposed covert channel is limited in terms of distance and speed, it has unique characteristics:
Guri et al also demonstrated MAGNETO REF , which is a malware that leak data from air-gapped computers to nearby smartphones via magnetic signals.
MAGNETO: Covert Channel between Air-Gapped Systems and Nearby Smartphones via CPU-Generated Magnetic Fields
ArXiv
ArXiv
Computer Science