[论文解读] DiskFiltration: Data Exfiltration from Speakerless Air-Gapped Computers via Covert Hard Drive Noise

Mordechai Guri, Yosef A. Solewicz+2 more|arXiv (Cornell University)|Aug 11, 2016

Digital Media Forensic Detection参考文献 28被引用 10

一句话总结

DiskFiltration 引入了一种隐蔽的声学信道，通过硬盘驱动器（HDD）执行器运动引起的机械振动调制信号，从空气隔离的计算机中渗出数据，无需使用扬声器。该方法利用智能手机作为接收器，在长达两米的距离内实现了每分钟180比特的可靠比特率，即使在无扬声器的系统上也能运行。

ABSTRACT

Air-gapped computers are disconnected from the Internet physically and logically. This measure is taken in order to prevent the leakage of sensitive data from secured networks. In the past, it has been shown that malware can exfiltrate data from air-gapped computers by transmitting ultrasonic signals via the computer's speakers. However, such acoustic communication relies on the availability of speakers on a computer. In this paper, we present 'DiskFiltration,' a covert channel which facilitates the leakage of data from an air-gapped compute via acoustic signals emitted from its hard disk drive (HDD). Our method is unique in that, unlike other acoustic covert channels, it doesn't require the presence of speakers or audio hardware in the air-gapped computer. A malware installed on a compromised machine can generate acoustic emissions at specific audio frequencies by controlling the movements of the HDD's actuator arm. Digital Information can be modulated over the acoustic signals and then be picked up by a nearby receiver (e.g., smartphone, smartwatch, laptop, etc.). We examine the HDD anatomy and analyze its acoustical characteristics. We also present signal generation and detection, and data modulation and demodulation algorithms. Based on our proposed method, we developed a transmitter on a personal computer and a receiver on a smartphone, and we provide the design and implementation details. We also evaluate our covert channel on various types of internal and external HDDs in different computer chassis and at various distances. With DiskFiltration we were able to covertly transmit data (e.g., passwords, encryption keys, and keylogging data) between air-gapped computers to a smartphone at an effective bit rate of 180 bits/minute (10,800 bits/hour) and a distance of up to two meters (six feet).

研究动机与目标

• 解决现有声学隐蔽信道依赖空气隔离系统中功能性扬声器的局限性。
• 探究HDD机械运动是否能产生可检测的声学信号以实现数据渗出。
• 设计并实现一种隐蔽信道，利用HDD执行器振动作为数字数据的载波信号。
• 在各种HDD类型、计算机机箱和接收设备上验证该方法的可行性。

提出的方法

• 恶意软件控制HDD执行器臂，产生精确的机械运动，从而在特定频率产生独特的声学音调。
• 使用频移键控（FSK）技术将数字数据调制到这些声学信号上，以编码0和1。
• 在受感染的PC上运行的发射程序生成HDD中的受控寻道模式，以发射调制后的声波。
• 接收设备（如智能手机）使用其内置麦克风捕获声学辐射，并通过匹配滤波和相关技术解调信号。
• 信号处理算法过滤背景噪声，高精度提取调制数据。
• 在多种内部和外部HDD上，针对不同计算机机箱和距离进行了测试，以评估系统的鲁棒性和传输范围。

实验结果

研究问题

• RQ1 HDD执行器运动是否能产生适合在空气隔离系统中实现数据渗出的可检测声学信号？
• RQ2 是否可能在不依赖音频输出硬件的情况下，通过HDD生成的声音实现可靠的数据传输？
• RQ3 不同HDD类型和物理机箱对传输距离和比特率有何影响？
• RQ4 智能手机等常见消费类设备是否能可靠地接收并解码HDD声学辐射中的数据？
• RQ5 在真实世界条件下，该隐蔽信道的最大有效距离和数据速率是多少？

主要发现

• DiskFiltration 成功实现了从空气隔离计算机中每分钟180比特（每小时10,800比特）的数据渗出速率。
• 该方法在距离源HDD最远两米（约六英尺）的距离内实现了可靠的数据传输。
• 该技术在内部和外部硬盘驱动器上均有效，无论机箱封装或机械设计如何。
• 即使计算机无扬声器或音频输出功能，系统仍能正常运行。
• 可使用智能手机麦克风检测信号，证明低成本窃听设备的可行性。
• 声学辐射与正常HDD噪声可区分，从而实现低误码率的有效调制与解调。