Source-linked AI summary
BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations
Mordechai Guri, Matan Monitz, Yisroel Mirski, Yuval Elovici
TL;DR
Air gaps are intended to prevent covert exchange between physically separated computers, but their security depends on that separation resisting communication. BitWhisper uses controlled heat emissions and built-in thermal sensors to create a bidirectional covert channel between adjacent computers without dedicated hardware. Experiments examine its layouts, sensors, workloads, and limitations, including distance and thermal response behavior.
Problem
Air-gapped computers are assumed unable to exchange covert data when physically separated, despite the continued use of air-gapped networks to reduce leakage and block malicious transmissions.
Method
BitWhisper modulates binary data through controlled heating of one adjacent PC and recovers it from environmental temperature changes measured by the other PC’s built-in sensors.
Results
BitWhisper supports bidirectional half-duplex communication using adjacent off-the-shelf PCs without dedicated hardware; experiments found reception was unavailable beyond 40 cm.
Takeaways & Limitations
The channel can support covert exchange between adjacent computers, including transmitting commands into and exfiltrating information from an isolated network.
Abstract
from arXiv · showhide
It has been assumed that the physical separation (air-gap) of computers provides a reliable level of security, such that should two adjacent computers become compromised, the covert exchange of data between them would be impossible. In this paper, we demonstrate BitWhisper, a method of bridging the air-gap between adjacent compromised computers by using their heat emissions and built-in thermal sensors to create a covert communication channel. Our method is unique in two respects: it supports bidirectional communication, and it requires no additional dedicated peripheral hardware. We provide experimental results based on implementation of BitWhisper prototype, and examine the channel properties and limitations. Our experiments included different layouts, with computers positioned at varying distances from one another, and several sensor types and CPU configurations (e.g., Virtual Machines). We also discuss signal modulation and communication protocols, showing how BitWhisper can be used for the exchange of data between two computers in a close proximity (at distance of 0-40cm) at an effective rate of 1-8 bits per hour, a rate which makes it possible to infiltrate brief commands and exfiltrate small amount of data (e.g., passwords) over the covert channel.
I. INTRODUCTION
BitWhisper bridges adjacent air-gapped computers through controlled heat emissions and built-in thermal sensors. The channel supports bidirectional communication without dedicated hardware, despite a low signaling rate.
- Air-gapped networks physically and logically separate sensitive systems from less-secured networks, reducing data-leakage risks and blocking malicious commands.
- The paper positions BitWhisper among air-gap covert channels, whose earlier examples include acoustic, optical, electromagnetic, and FM-emission methods.
- BitWhisper modulates binary data into controlled thermal signals that a neighboring computer samples and demodulates using built-in sensors.
- 8 signals per hour is the reported BitWhisper rate, while the channel supports bidirectional half-duplex communication.
- Off-the-shelf adjacent desktop PCs can establish the channel without special hardware or supporting components.
II. ATTACK SCENARIO
The attack scenario uses BitWhisper to bridge isolated and public networks through compromised adjacent PCs, enabling covert data exchange. The channel relies on controllable PC heat emissions and nearby thermal sensing.
- BitWhisper is considered as a method for bridging air-gapped networks in an office or facility containing isolated and public-network PCs.The described environment includes PCs belonging to either an isolated network or a public network such as the Internet.
- The attacker’s objectives include covertly exfiltrating passwords or secret keys, triggering a worm inside the isolated network, or sending commands to an isolated industrial control system.
- A thermal ping transfers a signal between two adjacent PCs, illustrated through thermal-camera snapshots.
- PC heat is produced primarily through Joule heating, in which current passing through conductors releases heat.
- CPU power consumption varies with capacitance, operating frequency, voltage, and the percentage of the system that is active.
- Heat emissions also come from GPUs, voltage-regulator modules, I/O controllers, hard drives, and optical drives.
B. Thermal Sensors in PCs
PCs use multiple thermal sensors to monitor component and ambient temperatures, while passive and active cooling manage heat. BitWhisper later uses some of these sensors to receive thermal signals transmitted through the air.
- Thermal sensors: Thermal sensors monitor computer components and ambient temperature to support workload reduction, cooling activation, or emergency shutdowns.
- Thermal sensors: CPU and GPU thermal diodes can measure internal temperatures, including the temperature of individual CPU cores.
- Thermal sensors: Motherboard sensors are commonly monitored through the I/O controller and may support alarms or emergency shutdowns at extreme temperatures.
- Thermal sensors: Voltage regulators, airflow paths, computer chassis, and storage devices may also contain or be monitored by thermal sensors.
- Cooling: Passive cooling dissipates heat naturally or through a heat sink, but it may be insufficient for chips that generate substantial heat during regular use.
- Cooling: Active cooling accelerates convection using fans or other coolants, most commonly combining a fan with a heat sink.
- Cooling: Typical PC fan layouts cool the CPU and power supply while drawing in cool air from the front and exhausting hot air from the back.
IV. PHYSICAL CHANNEL EXPERIMENT SETUP
The setup evaluates heat emissions as a half-duplex signaling channel between two PCs, varying workloads, environments, hardware, software, layouts, and distances.
- Experimental design: The experiments evaluate one communication direction at a time because the proposed channel is half-duplex.The heat-emitting PC is the sender, while the temperature-monitoring PC is the receiver.
- Experimental design: Single-PC trials measure heating and cooling rates, generated heat, dissipation, and how thermal changes register across sensors.CPU workloads are used to characterize the thermal response before testing communication between PCs.
- Test environment: Tests use regular and larger office environments, with computers placed above or below tables or inside desk trays.Environmental temperature was controlled using office air conditioning.
- Software: The software generates heat through CPU-intensive calculations, busy loops, FurMark, and prime95 while HWInfo records thermal sensors.These tools provide controlled processor or graphics workloads and sensor measurements.
- Layouts and distances: The layouts model adjacent office PCs, including parallel, stacked, and back-to-back arrangements at distances ranging from 1 to 40 cm.The parallel layout places desktops side by side and is used unless otherwise noted.
V. PHYSICAL CHANNEL EXPERIMENTAL RESULTS
The experiments characterize the physical thermal channel and provide the basis for developing a basic communication channel.
- Experimental results: The experimental results characterize the physical properties of the thermal channel and support development of a basic communication channel.The paper presents the channel analysis before discussing its communication design.
A. Internal Heat Emissions of a PC
PC workload changes internal temperatures and emits heat that nearby computers can detect through thermal sensors. Channel behavior depends on sensor choice, distance, layout, orientation, and environmental conditions.
- Warming and Cooling: CPU utilization directly affects core thermal sensors, while ambient sensors respond more gradually to sustained heating and cooling.The experiments measured temperature during 40 minutes of full utilization followed by 40 minutes near zero utilization.
- Environmental Effects: Routine workloads leave ambient temperature essentially unchanged, but walls, furniture, and face-away placement can substantially alter propagation and cooling.The authors therefore identify idle periods and physical arrangement as important channel conditions.
- Sensor Selection: The ambient sensor from sensor group B best captures environmental changes because it responds accurately while resisting sharp CPU spikes from background processes.The HD thermal sensor can also serve as a receiver when the preferred sensors are unavailable.
- Channel Asymmetry: Transmission is asymmetric because case orientation and component placement create different obstacles, while stacked configurations benefit the lower device because heat rises.In stacked layouts, measured propagation delays were five minutes with the transmitter above and 12 minutes with it below.
C. Virtual Machines (VM)
Virtual machine guests can control heat emissions, although processor overloading inside a guest may generate less heat than overloading the physical host. Figure 10 compares propagation delay for a guest and host over 40 minutes.
- C. Virtual Machines (VM): Virtual machine guests can control heat emissions despite sharing the physical processor with their host.The paper notes that guest-induced processor overload may have a limited heat-generating effect compared with overloading the physical machine.
- C. Virtual Machines (VM): Processor overloading inside a guest may generate less heat than overloading the physical machine.
- C. Virtual Machines (VM): Figure 10 presents propagation delay for a virtual-machine guest versus a physical-machine host over 40 minutes.
VII. CONCLUSION AND FUTURE WORK
BitWhisper introduces a software-only thermal covert channel for communication between air-gapped computers. The paper implements a prototype, evaluates varied configurations and distances, and discusses modulation and handshaking.
- VII. CONCLUSION AND FUTURE WORK: BitWhisper enables communication between two air-gapped computers using thermal radiation and standard heat sensors.
- VII. CONCLUSION AND FUTURE WORK: The method requires no dedicated or modified hardware and operates solely through software.
- VII. CONCLUSION AND FUTURE WORK: The prototype evaluates varied distances, target-computer configurations, and channel parameters.
- VII. CONCLUSION AND FUTURE WORK: The paper discusses modulation methods and an initial handshaking protocol for narrow-band communication.
APPENDIX A
The appendix illustrates four physical layouts for positioning the communicating computers: parallel, quadrature, stacked, and face-away.
- APPENDIX A: The parallel layout is identified as layout A.
- APPENDIX A: The quadrature layout is identified as layout B.
- APPENDIX A: The stacked and face-away back-to-back layouts are identified as layouts C and D.