final report

Air Gap Covert Channel

Prapul Kumar Mutyala Information, networks and computer security NewYork institute of technology Vancouver, Canada [email protected]

JayaRam Atluri Information, networks and computer security NewYork institute of technology Vancouver, Canada [email protected]

Sravan Kumar Koganti Information, networks and computer security NewYork institute of technology Vancouver, Canada [email protected]

Abstract— It has been assumed that the physical separation (‘air-gap’) of computers provides a reliable level of security, such that two adjacent computers become compromised, the covert exchange of data between them would be impossible. we demonstrate Bit Whisper, a method of bridging the air-gap between adjacent compromised computers by using their heat emissions and built-in thermal sensors to create a covert communication channel. Our method is unique in two respects: it supports bidirectional communication, and it requires no additional dedicated peripheral hardware. We provide experimental results based on implementation of Bit Whisper prototype and examine the channel’s properties and limitations. Our experiments included different layouts, with computers positioned at varying distances from one another, and several sensor types and CPU configurations (e.g., Virtual Machines). We also discuss signal modulation and communication protocols, showing how Bit Whisper can be used for the exchange of data between two computers in a proximity (at distance of 0- 40cm) at an effective rate of 1-8 bits per hour, a rate which makes it possible to infiltrate brief commands and exfiltrate small amount of data (e.g., passwords) over the covert channel.

I. PROBLEM STATEMENT

Many organizations store and process sensitive information within their computer networks. Naturally, such networks are the preferred targets of adversaries due to the valuable information they hold. Securing computer networks is a complex task involving the installation of endpoint protection, maintaining firewalls, configuring intrusion detection and intrusion prevention systems (IDSs and IPSs), and so on. However, regardless of the level of protection, a persistent attacker will eventually find a way to breach a computer network connected to the Internet. Consequently, if a network stores sensitive or classified information, an 'air-gap' approach is often used to prevent such a breach. I am going to implement minor hacking technique in which I install the specially designed malware(code was written to interpret ultrasonic waves as a data stream) in the system and then what he or she writes on the word file that text will be transferred using ultrasonic waves to receiving system and from there by running the python code in the receiving system we can see it. The specific problem that is addressed throughout the remainder of this dissertation is the risk that air-gap covert channels pose to the confidentiality of information stored on disconnected systems.

II. INTRODUCTION

First, an air-gapped network is a computer network in which safety efforts are taken to keep up physical and logical separation from other less secured network. Air-gapped network are regularly utilized in cases in which the data put away or produced by the system is exceptionally delicate or in danger of information spillage. For case, military systems, for example, the Joint Worldwide Intelligence. Correspondences System (JWICS) are air-gapped network. Despite the additional security advantages of an air-gapped organize, such systems have been ruptured in later a long time. Regardless of these assaults, air-gapped systems are yet utilized since they limit the danger of information spillage and avert pernicious code and directions from being transmitted to the network.

Air-gapped networks have no physical or logical connection to public networks (such as, the Internet). Such networks are often used in cases where the information stored in, or generated by, the system is too sensitive to risk data leaks, for example, military networks such as the Joint Worldwide Intelligence Communications System (JWICS). Air-gapped networks are also commonly used in critical infrastructure and control systems where breaching incidents can have catastrophic results, however such networks are not limited to military or critical infrastructures. Stock exchanges, insurance companies, biomedical manufacturers, and a wide range of industries use isolated networks in their IT environments. These networks maintain intellectual property, financial data, trade secrets, confidential documents, and personal information, and air-gap isolation is aimed at protecting this data.

III. PROJECT OBJECTIVES/SOLUTION TO THE PROBLEM

The objective of this project is to create a software that will perform air-gap convert channel functionality and those are as follows:

i. Turn off every communication device on the laptop.

ii. Create a malicious Software and then plant it on the system which wanted to hack by using USB drive and install it on that.

iii. And it gets installed return the system back to the user.

iv. Run the Python program which we made for receiving data and stay in range of that system, so our system can receive the text which the user enters in the word file.

v. We can see it on the screen while he or she is doing it, or we can save it in the system, so we can saw it later.

vi. And the data we receive use the medium sound waves so it is compulsory for both the systems to have that technology that is the only way one system can emit the data using that medium and other system receive the data using the same medium and that’s how we do hacking in our project and that’s just for educational purposes.

IV. DESCRIPTION AND METHODOLOGY OF THE PROPOSED SOLUTION

The experiments involved two types of setups: a single PC setup or a setup involving a pair of PCs. With the single PC, we evaluated the sound properties (e.g., sound waves rates) of an active PC under different workloads like a calm environment and environment in which people are talking near the systems with high pitch voices and low pitch voices. In the setup involving two PCs, we evaluated the mutual sound effects between adjacent computers First, using the single PC setup, we performed a series of CPU workload trials. The objective was to understand the amount of sound that was effectively generated and how quickly this sound dissipates, as well as how these changes registered in the different sensors. For each trial, we generated different workloads and monitored the local sound from the same computer's sensors. Afterward, using the two PC configurations, we examined the effect of the transmitter's sound on the receiver and its environmental sensors. Several series of trials were performed to analyze the many possible combinations that may affect the channel. For instance, some of the parameters analyzed were the transmitter/receiver's relative distance, chassis type, and relative layout. Lastly, we tested the feasibility of emitting sound from within a virtual machine guest OS. We found that although the physical CPU is controlled by the host OS, the guest OS can use it indirectly as a sound transmitter.

I will create a malicious software and then plant it on the system by using USB drive and install it on the system which i want to hack when the system admin is not with his system. Once my work was done then I will move away from there. After that once the admin comes and started to type on his system word document, I will receive the data on my system by running the python code which is easy to write and understand. That is all my proposed solution defining the ways of running and getting my software works graphically solution. The coding solution is not explained here.

I used python as it was open source and it supports many operating systems. As it is an interpreted programming language, we can run the same code on multiple platforms without recompilation. I used audio library(pyaudio) which is used for sending data, options library which tells you about the sending frequency rate, data size, frame length, self-created math work library which gives the frequency transmission calculations and psk library which tells about sending binary bits for each letter.

V. FLOWCHART

SENDING SIDE:

RECEIVING SIDE:

NO

YES

VI. OUTPUT SCREENSHOTS

SENDING SIDE:

RECEIVING SIDE:

VII. SIGNAL TRANSMISSION ANALYSIS

02468101214Series 1Series 2Series 3

Series 1 = Signal

Series 2 = Noise

Series 3= Signal strength

Category 4 = 10 meters

VIII. RESOURCES

Contribution to Knowledge, my system will improve knowledge of the user of how he or she can be hacked even they ae not connected to internet. That educate the person never to give the system to the person whom they don’t trust. Or be careful in giving and be careful of the Universal Serial Bus devices which they put in their system. They just do simple and ordinary works on the system and if they don’t be careful their sensitive or important data can be leaked and then they must face the problems which they don’t deserve. So, my system put awareness in the people’s mind and allows them to know about the technology that how it benefits us and in which ways I can affects our life and work.

In the tools that I mentioned above they just connect the Universal Serial Bus device and then it started getting important data from the system without letting know the user. And when we get back the device we also get the data of the system. And after connecting that device to our system we had his or her system data. Now we are going to change that we install software on the system and then it starts transmitting the data to other system over different mediums. And the other system receives the data using the same medium and show it on the screen we also are going to change the showing and storing way. That system can also save that data, so we can see that later.

There will be limitations in the software that it needs the software to install on the system only after then it starts transmitting and there is also one more limitation that the receiving system will be in certain range of the sending system because of the distance sound waves get effected. So that we can’t receive the data. Simply, the resources of air gate covert system are:

i. Two Systems that can transmit data over ultrasonic waves.

ii. Able to Access the system which we want to hack.

iii. And have the admin privileges of the receiving system so can install the receiving software and get the required work done.

iv. The speaker of the system we want to hack shouldn’t be turned off or muted.

IX. CONCLUSION

A fresh perspective on covert channels has been presented in this work. Air-gap covert channels were defined as an unintentional communication channel that circumvents the security of systems protected by the total isolation principle. Secure systems were also categorized as either fixed-source systems or continuous-source systems, and the analysis of these classes led to the conclusion that the relevant security criterion for evaluating covert channels in continuous-source systems continues to be an acceptable predefined communication rate, but that the security criterion of paramount importance to fixed source systems is Moskowitz and Myong’s small message criterion.

References

[1] Carrara, B. (2016). Air-Gap Covert Channels. Air-Gap Covert Channels, 1-5..

[2] M. Guri and Y. Elovici, “Bridgeware: The Air-Gap Malware,” ACM, 01-Apr-2018.[Online].Available: https://cacm.acm.org/magazines/2018/4/226377-bridgeware/abstract. [Accessed: 02-Nov-2018].

[3] Guri, Mordechai, Monitz, Matan, Mirski, Yisroel, Elovici, and Yuval, “BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations,” [1503.07919] BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations, 26-Mar-2015. [Online]. Available: https://arxiv.org/abs/1503.07919. [Accessed: 02-Nov-2018].

Waits for the user input

If user press Enter, then start transferring data in sound waves

START

User to Input Data

If user press Enter then start transferring data in sound waves

Keep checking

START

Receiving the data using ultrasonic waves

Show the received data on the screen

Show the received data on the screen

NEW YORK INSTITUTE OF TECHNOLOGY

NEW YORK INSTITUTE OF TECHNOLOGY

_1605798112.xls

Chart1

ONE METER	ONE METER	ONE METER
THREE METERS	THREE METERS	THREE METERS
SEVEN METERS	SEVEN METERS	SEVEN METERS
Category 4	Category 4	Category 4

Series 1

Series 2

Series 3

4.3

2.4

2

2.5

4.4

2

3.5

1.8

3

4.5

2.8

5

Sheet2

Sheet1

	Series 1	Series 2	Series 3
ONE METER	4.3	2.4	2
THREE METERS	2.5	4.4	2
SEVEN METERS	3.5	1.8	3
Category 4	4.5	2.8	5