[Paper Review] AIR-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers

Mordechai Guri|arXiv (Cornell University)|Dec 12, 2020

Internet Traffic Analysis and Secure E-voting41 references4 citations

TL;DR

This paper introduces AIR-FI, a covert channel that enables data exfiltration from air-gapped computers by modulating electromagnetic signals on DDR SDRAM memory buses to transmit data in the 2.4 GHz Wi-Fi band. The attack requires no Wi-Fi hardware on the victim system, exploits standard memory operations, and allows nearby Wi-Fi-enabled devices to receive and relay the data, achieving bitrates of 1–100 bit/sec over distances up to several meters.

ABSTRACT

In this paper, we show that attackers can exfiltrate data from air-gapped computers via Wi-Fi signals. Malware in a compromised air-gapped computer can generate signals in the Wi-Fi frequency bands. The signals are generated through the memory buses - no special hardware is required. Sensitive data can be modulated and secretly exfiltrated on top of the signals. We show that nearby Wi-Fi capable devices (e.g., smartphones, laptops, IoT devices) can intercept these signals, decode them, and send them to the attacker over the Internet. To extract the signals, we utilize the physical layer information exposed by the Wi-Fi chips. We implement the transmitter and receiver and discuss design considerations and implementation details. We evaluate this covert channel in terms of bandwidth and distance and present a set of countermeasures. Our evaluation shows that data can be exfiltrated from air-gapped computers to nearby Wi-Fi receivers located a distance of several meters away.

Motivation & Objective

• To demonstrate that air-gapped computers can exfiltrate data using electromagnetic emissions from DDR SDRAM memory buses.
• To show that these emissions can be modulated to carry data in the 2.4 GHz Wi-Fi frequency band.
• To prove that nearby Wi-Fi-capable devices (e.g., smartphones, IoT devices) can receive and decode the modulated signals.
• To evaluate the feasibility of the covert channel in terms of bandwidth, transmission distance, and practical deployment.
• To propose countermeasures against such side-channel exfiltration techniques in air-gapped environments.

Proposed method

• Malware on an air-gapped system performs controlled memory access patterns on DDR SDRAM to generate electromagnetic emissions at 2.4 GHz, exploiting inherent signal harmonics.
• Binary data is encoded using baseband modulation techniques applied to memory access timing and patterns to generate detectable Wi-Fi-like signals.
• The physical layer (PHY) information exposed by Wi-Fi chips is leveraged to decode the modulated signals on receiving devices.
• A receiver application on a nearby Wi-Fi device (e.g., smartphone) captures and decodes the signal using standard Wi-Fi reception mechanisms.
• Signal jamming via CPU/memory-intensive workloads is used to disrupt transmission, and runtime detection is explored via memory access monitoring.
• Countermeasures include physical shielding (Faraday cages), Wi-Fi channel monitoring, and runtime anomaly detection using low-level memory monitoring.

Experimental results

Research questions

• RQ1 Can DDR SDRAM memory buses in air-gapped computers generate electromagnetic emissions in the 2.4 GHz Wi-Fi band without specialized hardware?
• RQ2 Can binary data be reliably modulated and transmitted via these emissions using standard memory operations?
• RQ3 Can nearby Wi-Fi-capable devices (e.g., smartphones, IoT devices) receive and decode the modulated signals without prior compromise?
• RQ4 What is the effective transmission range and data rate of such a covert channel in real-world conditions?
• RQ5 What practical countermeasures can effectively detect or block this type of side-channel exfiltration?

Key findings

• The AIR-FI attack successfully generates detectable 2.4 GHz electromagnetic signals from standard DDR SDRAM memory buses without any Wi-Fi hardware.
• Data exfiltration is achieved at bitrates ranging from 1 to 100 bit/sec, depending on the receiver type and mode.
• The covert channel operates effectively over distances of several meters from the air-gapped system.
• The attack works even when the malware is running inside a virtual machine, indicating resilience to virtualization isolation.
• Signal jamming via intensive CPU or memory operations reduced the signal-to-noise ratio (SNR) to 3.1–4.8 dB, significantly degrading transmission reliability.
• Faraday shielding effectively blocks the signal, but is considered impractical for large-scale deployment due to cost and operational constraints.