Source-linked AI summary
AirHopper: Bridging the Air-Gap between Isolated Networks and Mobile Phones using Radio Frequencies
Mordechai Guri, Gabi Kedma, Assaf Kachlon, Yuval Elovici
TL;DR
AirHopper addresses the difficulty of exfiltrating data from air-gapped networks by linking compromised computers to nearby infected mobile phones through FM signals. It generates emissions through display hardware, uses mobile FM receivers to recover audio-modulated data, and evaluates the resulting attack under practical reception constraints. The paper concludes that the approach can support data exfiltration across an air gap, while noting implementation limitations in mobile-phone FM reception and device hardware.
Problem
Air-gapped networks block external connections, yet exfiltrating data from them remains a difficult stage of advanced cyber-attacks.
Method
AirHopper uses a compromised computer's monitor emissions to transmit FM signals carrying data to an infected nearby mobile phone with an FM receiver.
Results
AirHopper experimentally evaluates effective transmission distance, signal conditions, receiver hardware, and data modulation methods for this attack pattern.
Takeaways & Limitations
AirHopper extends electromagnetic-emission threats to mobile phones as receivers in an air-gap attack model.
Takeaways & Limitations
Mobile-phone FM reception depends on implementation constraints, including receiver processing and whether a phone has a suitable antenna.
Abstract
from arXiv · showhide
Information is the most critical asset of modern organizations, and accordingly coveted by adversaries. When highly sensitive data is involved, an organization may resort to air-gap isolation, in which there is no networking connection between the inner network and the external world. While infiltrating an air-gapped network has been proven feasible in recent years (e.g., Stuxnet), data exfiltration from an air-gapped network is still considered to be one of the most challenging phases of an advanced cyber-attack. In this paper we present "AirHopper", a bifurcated malware that bridges the air-gap between an isolated network and nearby infected mobile phones using FM signals. While it is known that software can intentionally create radio emissions from a video display unit, this is the first time that mobile phones are considered in an attack model as the intended receivers of maliciously crafted radio signals. We examine the attack model and its limitations, and discuss implementation considerations such as stealth and modulation methods. Finally, we evaluate AirHopper and demonstrate how textual and binary data can be exfiltrated from physically isolated computer to mobile phones at a distance of 1-7 meters, with effective bandwidth of 13-60 Bps (Bytes per second).
1. Introduction
AirHopper targets air-gapped networks by using compromised computers to emit radio signals that nearby infected mobile phones can receive and relay. The attack exploits the presence of FM-capable phones near sensitive systems despite network isolation.
- Air-gap setting: Air-gap isolation removes direct wired and wireless connections between sensitive computers and the external world.Employees may nevertheless carry mobile phones near classified computers.
- Covert channel: Compromised computers can use video-display electromagnetic radiation to generate FM signals carrying sensitive information.The resulting covert channel may evade ordinary security instrumentation.
- Attack concept: AirHopper uses nearby mobile phones with FM receivers to collect radio signals emitted by compromised computers.The paper presents this as a bifurcated malware attack bridging an isolated network and mobile devices.
- Receiver availability: FM receiver availability in smartphones and feature phones broadens the set of potential receivers for the covert channel.The passages report support across many Android models and major phone products.
- Attack model: The attack assumes hostile code on both the target network and mobile devices, followed by command-and-control, signal detection, decoding, and retransmission.Mobile-phone monitoring may be continuous, scheduled, location-based, or remotely triggered.
3. Background
AirHopper generates FM carrier signals by controlling display-pixel patterns according to video timing. Alternating black-and-white pixels provide the stronger carrier modulation needed for reception by mobile-phone FM receivers.
- Display timing: The pixel clock is determined from display resolution, synchronization intervals, and refresh rate.These timing parameters specify how quickly pixels are transmitted during a frame.
- FM signal generation: AirHopper constructs alternating black-and-white pixel sequences that generate an FM carrier modulated with a data signal.The approach uses fixed maximal amplitude for stronger signal generation.
4. Implementation
AirHopper is implemented as two malware components: a PC transmitter and a mobile-phone receiver. Because phone FM chips expose decoded audio rather than carrier waves, data is transmitted through audio-tone modulation.
- Components: The malware implementation consists of a transmitter running on the PC and a receiver running on the mobile phone.These components were developed to test the attack's realistic applicability.
- Receiver constraint: Mobile-phone operating systems access decoded FM audio rather than the carrier wave itself.AirHopper therefore modulates digital information using audio tones.
- Implementation challenge: The implementation's receiver-side processing is constrained by the challenges of obtaining and handling audio produced by mobile FM chips.The paper identifies FM reception as a central implementation challenge.
1 Layer
AirHopper converts display timing into FM audio tones, then encodes data with A-FSK or DTMF for reception and decoding on a mobile phone. The two schemes trade interference tolerance, range, and bandwidth.
- FM Audio Signal Generation: AirHopper generates a target FM audio tone by constructing a pixel pattern on the computer display.The carrier frequency is constrained by pixel-clock timing, although harmonics can extend transmission with some signal-quality loss.
- FM Audio Signal Generation: The modulation algorithm uses carrier-frequency pixel stripes whose periodic changes encode the data tone.Stripe width and count are determined by the data frequency.
- Data Modulation over Audio: A-FSK is less sensitive to interference and reaches farther, whereas DTMF provides greater bandwidth and more efficient binary transmission.The evaluation compares the two methods across interference tolerance, distance, bandwidth, and binary-data transmission.
- Data Modulation over Audio: Signal frequencies below 600 Hz suffered significant interference, while reception diminished above 11 kHz.Both modulation methods were limited to this effective frequency range.
- Data Modulation over Audio: A-FSK maps characters to distinct audio frequencies, while DTMF maps each byte to one of 256 two-tone combinations.A-FSK used fewer than 40 frequencies for simple text; DTMF used a 16×16 frequency table.
- Data Demodulation from Audio: The mobile receiver records FM audio, decodes the data, and can forward the recording to the attacker.The receiver uses audio capture and signal processing to recover transmitted information.
- Transmission protocols: Raw transmission suits text and signaling despite losses, while structured transmission adds packet sequencing, length, and checksums for binary data.The structured protocol helps identify errors and determine which data was received.
5. Hiding
AirHopper hides both the visual display of transmitted data and the radio signal itself. Its techniques exploit monitor control, alternate display paths, shared desktops, and extended FM frequencies to reduce detection risk.
- AirHopper uses techniques to hide both the computer-screen appearance and transmitted signal.
- Visual hiding: DDC protocols provide standardized communication between computers and attached HDMI, DVI, or VGA monitors and VDUs.DDC/CI is bidirectional, while MCCS specifies monitor-control commands over that protocol.
- Visual hiding: DDC/CI-based methods suppress visible transmission by detecting when a monitor is off or intentionally turning it off during idle periods.Transmission stops when the monitor becomes active again; intentional shutdown uses ioctl writes to 0xe1.
- Visual hiding: A KVM switch or inactive secondary display output can route transmission away from the display visible to the user.The KVM approach switches desktops, while the secondary-output method redirects transmission without a connected display cable.
6. Evaluation
The evaluation measures AirHopper’s signal strength, effective distance, transmission quality, and transmission time across cable types, modulation methods, distances, and delays. Results show useful reception ranges, an optimal 70 ms delay, and strong dependence of practical exfiltration on data size.
- 6.1 Setup: The evaluation used a Samsung SyncMaster SA450 monitor, Ubuntu 13.04, and a Samsung Galaxy S3 with headphones serving as the FM antenna.Four cable types were tested: standard VGA, extension VGA, HDMI, and DVI.
- 6.2 Signal Strength: RSSI and dBm were measured across distances using the mobile-phone FM receiver and an external spectrum analyzer, respectively.RSSI was obtained through the phone’s internal FM service, while dBm was measured externally.
- 6.3 Effective Distance: 8-20 meters was the effective-distance range with a receiver antenna, while unshielded extension VGA outperformed shielded HDMI and standard VGA cables.An RSSI value of 10 roughly indicated the effective-distance limit for each tested cable.
- 6.4 Data Modulation Method: A-FSK yielded a slightly larger effective distance than DTMF, with the comparison made using varying cable types and a receiver antenna.The signaling method therefore influenced the maximum distance at which transmission quality remained acceptable.
- 6.5 Transmission Quality: 70 ms was selected as the optimal signal delay because transmission quality approached 100% logarithmically and improved negligibly beyond that delay.Transmission quality was defined as correctly received bytes divided by originally transmitted bytes and was measured across distances and cable types.
- 6.6 Data Size: Data size constrained practical exfiltration: data below 100 bytes took under ten seconds, data below 10 KB took several minutes, and 0.5 MB documents took several hours.Structured packets added tolerable overhead compared with raw data while supporting more accurate reception.
7. Countermeasures
Countermeasures address Tempest threats through technical protections and procedural controls. For AirHopper-like attacks, organizations should control radio-reception zones and use shielded cables.
- Technical and procedural defenses: Tempest countermeasures comprise technical protections and procedural controls.Technical measures include physical insulation, emission reduction, and early signal encryption; procedural measures include standards, practices, and sanctions.
- Physical controls: AirHopper defenses should prohibit mobile phones and other radio receivers within defined physical zones.The zones approach defines organizational perimeters where radio reception must be prevented.
- Physical controls: Shielded cables provide another countermeasure because shielding affects the effective transmission range.The paper connects this recommendation directly to its experimental range measurements.
8. Related Work
Related work established that ordinary equipment can exploit electromagnetic emissions from video display units. This research developed through earlier Tempest and emanation-security studies.
- Tempest research: Van Eck demonstrated in 1985 that ordinary equipment could reconstruct video-display images from electromagnetic signals at considerable distance.The demonstration used a modified television set and became an early example of a Tempest exploit.
- Tempest research: Later research in the 1990s expanded publications on Tempest and electromagnetic emanation security.Anderson's review covers compromising emanations consisting of conducted or radiated electromagnetic signals.
9. Conclusion
AirHopper uses monitor-cable emissions and a nearby mobile-phone FM receiver to exfiltrate data across an air gap. The paper evaluates its range and transmission conditions and frames the work as contributing to electromagnetic-threat understanding.
- Method: AirHopper combines intentionally modulated electromagnetic emissions from a monitor cable with an FM receiver that collects and extracts the data.These two elements form the core of the bifurcated attack pattern.
- Attack feasibility: The attack chain is complicated but remains within the skill and effort associated with modern Advanced Persistent Threats.The paper presents this as an assessment of attack feasibility rather than a claim of simplicity.
- Evaluation: Evaluation measures effective transmission distance, cable type, and the presence of a receiver antenna.These experiments examine conditions affecting the proposed method's operation.
- Contribution: AirHopper contributes to understanding electromagnetic emission threats when coupled with Advanced Persistent Threat techniques.The authors position discussion of this under-covered area as relevant to the cyberdefense community.