A newly developed method for covert channel attacks has the potential to compromise highly secure air gaps in sensitive organizations, raising concerns about the effectiveness of traditional security measures. The concept of an air gap in industrial control systems security is based on the idea of completely separating networks, physically blocking any transmission of signals such as Wi-Fi, wires, etc. This separation is crucial for safeguarding critical military, government, and industrial facilities from cyber threats emanating from the internet.
Mordechai Guri from Israel’s Ben-Gurion University has been exploring ways to breach air gaps using sound waves for some time, with methods involving computer fans, hard disk drives, and CD/DVD drives. His latest innovation, known as “Pixhell,” allows for the theft of data by utilizing sound waves generated by rapidly changing bitmap patterns displayed on an LCD screen.
In a hypothetical scenario at a top-secret intelligence facility, where all personnel have left for the night, a computer screen suddenly displays what appears to be random noise. However, this noise is actually the means of communication in the Pixhell attack. The success of Pixhell relies on the attacker having control over devices on both sides of the air gap, which can be achieved through various methods such as internet-based attacks or supply chain compromises.
Pixhell exploits the capabilities of LCD screens, which emit high-pitched frequencies through capacitors and inductors while in operation. By manipulating the pixels on the screen, the malware can cause these components to vibrate at specific frequencies, generating sounds that carry encoded data across the air gap to a receiving machine. This method has been tested and shown to work at distances of up to two and a half meters, demonstrating the potential for covert information transmission.
Apart from acoustics, there are numerous other creative ways to execute covert channel attacks, such as using Ethernet wiring as software-defined radio transmitters and receivers or monitoring voltage fluctuations in connected devices. The effectiveness of these methods depends on the signal-to-noise ratio and the level of effort required to exploit the vulnerabilities.
While physical air gaps are generally considered sufficient protection for most organizations, highly sensitive facilities like spy agencies and military installations employ advanced measures to counter covert channel attacks. Strategies like unidirectional fiber-optic gateways and physical distance between critical systems help to make such attacks impractical. However, the need for these sophisticated defenses varies based on the level of risk and the value of the information being protected.
In the evolving landscape of cybersecurity threats, organizations must stay vigilant and adapt their defenses to address emerging risks like covert channel attacks. By understanding the potential vulnerabilities in air-gapped systems and implementing appropriate countermeasures, these organizations can mitigate the risk of sensitive data being compromised through covert communication channels.