Researchers at Cyber Security Labs, Ben Gurion University in Be'er Sheva, Israel, have devised a technique to get data from air-gapped computer systems using heat.
Air-gapped computers are isolated away from the Internet and other computers that are connected to external networks. They're believed to be one of the most secure and safest computer systems in the world.
How to breach air-gapped systems using HEAT — On Wired http://t.co/Qk9xOpLSD9 #airgap #airhopper #bitwhisper @cyberlabsbgu BGU Research!
— Dudu Mimran (@dudumimran) March 23, 2015
The system is used by military networks and huge control systems that operate a country's critical infrastructure. Air-gapped systems are also used by retailers to process payments made by credit and debit cards.
Remote hacking of data from air-gapped computers is extremely difficult to carry out because to obtain any encrypted information, a USB flash drive or firewire cable is needed. But now a new technique dubbed 'BitWhisper' could be used by potential hackers to hack into the secure systems using heat emissions and inbuilt thermal sensors.
Hacking for Heat
A recent demonstration video shows how BitWhisper can be used to trigger a USB toy missile launcher to rotate and fire.
According to a blog by Dudu Mimran from Cyber Security Labs:
"BitWhisper is a demonstration for a covert bi-directional communication channel between two air-gapped computers close by communicating via heat. The method allows bridging the air-gap between the two physically adjacent and compromised computers using their heat emissions and built in thermal sensors to communicate."
Laptops and PCs have thermal sensors inside to cool the machine down if components begin to overheat, potentially damaging the computer.
BitWhisper uses the thermal sensors to send commands to an air-gapped system, hack into it and siphon off the data.
The heat patterns are regulated and the data is then morphed into thermal signals. All the while, the other PC uses its built-in thermal sensors to measure the changes in the heat patterns.
BitWhisper: Breaching Air-Gapped Systems via Thermal Manipulation http://t.co/eKM798wHvm #infosec #hacking #security pic.twitter.com/p8mWGGXvCp
— Norse (@NorseCorp) March 23, 2015
These changes are sampled, processed and put back into its original data form. "Thermal pings" establish a connection between the two systems — thus extracting information.
Researchers from Cyber Security Labs explain: "Once a bridging attempt is successful, a logical link between the public network and the internal network is established, at this stage the attacker can communicate with the formerly isolated network, issuing commands and receiving responses."
What this means is that any passwords or sensitive content can be stolen from extremely secure computer systems.
The researchers at Ben Gurion University will present their findings at a security conference in Tel Aviv next week.
