ODINI: Escaping Sensitive Data FromFaraday-Caged, Air-Gapped Computersvia Magnetic Fields

 https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8820015

 

Abstract— Air-gapped computers are devices that are keptisolated from the Internet, because they store and process sensi-tive information. When highly sensitive data is involved, an air-gapped computer might also be kept secluded in a Faraday cage.The Faraday cage prevents the leakage of electromagnetic signalsemanating from various computer parts, which may be picked upremotely by an eavesdropping adversary. The air-gap separation,coupled with the Faraday shield, provides a high level of isolation,preventing the potential leakage of sensitive data from the system.In this paper, we show how attackers can bypass Faraday cagesand air-gaps in order to leak data from highly secure computers.Our method is based on exploitation of the magnetic field gen-erated by the computer’s CPU. Unlike electromagnetic radiation(EMR), low frequency magnetic fields propagate through theair, penetrating metal shielding such as Faraday cages (e.g.,a compass still works inside a Faraday cage). Since the CPU isan essential part of any computer, the magnetic covert channel isrelevant to virtually any device with a CPU: desktop PCs, servers,laptops, embedded systems, and Internet of Things (IoT) devices.We introduce a malware codenamed ‘ODINI’ that can controlthe low frequency magnetic fields emitted from the infectedcomputer by regulating the load of the CPU cores. Arbitrarydata can be modulated and transmitted on top of the magneticemission and received by a magnetic ‘bug’ located nearby.We implement a malware prototype and discuss the designconsiderations along with the implementation details. We alsoshow that the malicious code does not require special privileges(e.g., root) and can successfully operate from within isolatedvirtual machines (VMs) as well. Finally, we propose differenttypes of defensive countermeasures such as signal detection andsignal jamming to cope with this type of threat (demonstrationvideo: https://www.youtube.com/watch?v=h07iXD-aSCA).Index Terms— Network security, air gaps, computer viruses.