Source-linked AI summary
USBee: Air-Gap Covert-Channel via Electromagnetic Emission from USB
Mordechai Guri, Matan Monitz, Yuval Elovici
TL;DR
Earlier USB covert channels required hardware modification, leaving a need for a software-only approach to transmitting data from air-gapped computers. USBee generates and modulates electromagnetic emissions from a USB data bus, and its tests report transmission to a nearby receiver at 80 bytes per second.
Problem
Earlier USB covert channels described here required hardware modification, while air-gap isolation leaves no physical connection between a sensitive internal network and the Internet.
Source: §I · p. 1Method
USBee uses software to manipulate a USB device's data bus to generate and modulate electromagnetic emissions, with a receiver and demodulator built using GNU Radio.
Source: §I · p. 1, §IV · p. 3, §V · p. 4Results
80 bytes per second was the reported bandwidth for transmitting data to a nearby receiver.
Source: §VII · p. 4Takeaways & Limitations
USBee turns virtually any USB connector into a short-range RF transmitter without modifying the USB hardware or firmware.
Source: §VII · p. 4
Abstract
from arXiv · showhide
In recent years researchers have demonstrated how attackers could use USB connectors implanted with RF transmitters to exfiltrate data from secure, and even air-gapped, computers (e.g., COTTONMOUTH in the leaked NSA ANT catalog). Such methods require a hardware modification of the USB plug or device, in which a dedicated RF transmitter is embedded. In this paper we present USBee, a software that can utilize an unmodified USB device connected to a computer as a RF transmitter. We demonstrate how a software can intentionally generate controlled electromagnetic emissions from the data bus of a USB connector. We also show that the emitted RF signals can be controlled and modulated with arbitrary binary data. We implement a prototype of USBee, and discuss its design and implementation details including signal generation and modulation. We evaluate the transmitter by building a receiver and demodulator using GNU Radio. Our evaluation shows that USBee can be used for transmitting binary data to a nearby receiver at a bandwidth of 20 to 80 BPS (bytes per second).
I. INTRODUCTION
Air-gap isolation can protect highly sensitive networks, but covert channels have demonstrated ways to leak data without Internet connectivity. USBee uses an unmodified USB device as a software-controlled RF transmitter, avoiding the hardware modifications required by earlier USB approaches.
I. INTRODUCTION
- Air-gap isolation removes the physical connection between a sensitive internal network and the Internet, while firewalls, IDS, and IPS provide a basic level of protection.Source: §I · p. 1
- Earlier USB covert-communication tools described here required hardware modification, such as an RF transmitter or receiver embedded in a USB plug or cable.Examples include COTTONMOUTH and TURNIPSCHOOL.Source: §I · p. 1
- USBee uses a connected, unmodified USB device to generate electromagnetic emissions that can carry arbitrary binary data to a nearby receiver.The receiver decodes the transmission and sends it to an attacker.Source: §I · p. 1
- The paper discusses signal generation, transmission, reception, and demodulation for the software-only method.Source: §I · p. 1
II. RELATED WORK
Related work surveys covert channels that use acoustic, optical, thermal, and electromagnetic emissions. USBee is positioned among electromagnetic approaches while differing from earlier USB methods that require hardware or firmware modification.
II. RELATED WORK
- Covert channels have used acoustic, optical, thermal, and electromagnetic emissions to transmit data from computers.Source: §II · p. 2
- Electromagnetic approaches have used emissions from computer displays, video cards, RAM, GPIO, and CPU instructions; USB emanations had also been studied.Source: §II · p. 2
- USB attacks include firmware modification such as BadUSB, RF hardware implants such as COTTONMOUTH and TURNIPSCHOOL, and commercial keyloggers with Wi-Fi transmitters.Source: §II · p. 2
- Unlike the USB methods described, USBee does not require firmware or hardware modification.Source: §II · p. 2
III. TECHNICAL BACKGROUND
The technical background explains how USB signaling and data-wire emissions underpin the proposed channel. It also describes packet-transfer timing and the electromagnetic-radiation mechanism used by USBee.
III. TECHNICAL BACKGROUND
- USB cables contain four shielded wires, and D+ and D- carry differential data signals that form the data bus.Source: §III · p. 2, Figure 2 · p. 2
- USB NRZI encodes 0 as a signal transition and 1 as no transition; USB 1.0/1.1 runs at 1.5–12 Mbits/s, USB 2.0 at 480 Mbits/s, and USB 3.0 up to 5Gbits/s.The method uses the 480 Mbits/s transfer rate supported by USB 2.0 and USB 3.0.Source: §III · p. 2
- Packet transfer time includes headers and sync overhead, bit-stuffing time, and host delay; bit stuffing can add time for all-1 data, while host delay primarily reflects controller firmware processing.Source: §III · pp. 2–3
- Changes in current in a metal wire create electromagnetic emissions, and USBee generates them by manipulating data in the USB D+ and D- wires.Source: §III · p. 3
IV. TRANSMISSION
USBee generates emissions by shaping USB data-bus patterns, then encodes binary data through frequency changes. The resulting byte pattern is transmitted by writing it to a USB device.
IV. TRANSMISSION
- Sending a sequence of 0 bits to a USB device produces a detectable emission between 240 MHz and 480 MHz, which can be modulated with data.Source: §IV · p. 3
- The fill_buffer_freq function fills a buffer with a bit pattern that forms a square wave at the target frequency, using the 480 Mbits/s sample rate.A 6K buffer was used to generate a signal strong enough to be clearly detected by the receiver.Source: §IV · p. 3
- Binary frequency-shift keying represents 0 and 1 by switching the carrier signal between two frequencies.Source: §IV · p. 3
- Transmission writes the generated byte pattern to a USB device's data block or stream; it requires permission to create a file, but not special privileges.The prototype used a temporary file on a USB thumb drive.Source: §IV · p. 3
V. RECEPTION
Reception used an RTL-SDR receiver and GNU Radio for FFT-based demodulation of B-FSK signals, achieving an effective rate of 80 bytes per second.
V. RECEPTION
- The receiver used a $30 RTL-SDR connected to a laptop, with reception code implemented in GNU Radio.The paper describes GNU Radio as a free, open-source signal-processing toolkit.Source: §V · p. 4
- The received signal is divided into equal chunks before FFT because FFT operates on discrete samples while the signal is continuous.The resulting vector is analyzed as a 0 bit, a 1 bit, or no detected signal.Source: §V · p. 4
- 80 bytes per second was achieved with this modulation and demodulation scheme.The reported rate is for successfully transmitted bytes.Source: §V · p. 4
- FFT analysis maps lower and higher frequency-index peaks to B-FSK bits 0 and 1, respectively, in the reception of byte 0x73.Figure 3 plots time, FFT vector index, and frequency-component amplitude.Source: §V · p. 4, Figure 3 · p. 4
VI. COUNTERMEASURES
The paper discusses procedural, software, and physical countermeasures, while noting feasibility and false-positive concerns for some approaches.
VI. COUNTERMEASURES
- Behavioral detection can monitor I/O patterns, but false positives may be high because USBee writes 6K of data to temporary files.One example pattern is frequent creation and writing of temporary files.Source: §VI · p. 4
- Procedural controls can restrict electronic equipment in sensitive zones, although keeping RF receivers away from computers is not always feasible.The paper describes this approach as black-red separation.Source: §VI · p. 4
- Physical controls include shielding or grounding USB components and limiting emissions; USB testing scans frequencies up to 1 GHz.The paper says extrapolating EMI from only a few frequencies is not permitted under USB 2.0 specifications.Source: §VI · p. 4
VII. CONCLUSION
USBee is a software-only short-range RF transmission method that uses the USB data bus, and the reported tests transmitted data at 80 bytes per second.
VII. CONCLUSION
- USBee uses the USB data bus to generate electromagnetic radiation at a specific frequency and transmit modulated data to a nearby receiver.The paper describes the method as a covert communication channel from a contaminated computer.Source: §VII · p. 4
- The method requires neither firmware nor hardware modification of the USB connector.The conclusion characterizes USBee as software-only.Source: §VII · p. 4
- Tests showed effective transmission to a nearby receiver at 80 bytes per second.Source: §VII · p. 4