AiR-ViBeR：通过隐蔽表面ViBrAtIoNs从气隙计算机中获取数据
AiR-ViBeR: Exfiltrating Data from Air-Gapped Computers via Covert Surface ViBrAtIoNs
摘要：
气隙隐蔽通道是一种特殊类型的隐蔽通信通道，使攻击者能够从孤立的、无网络的计算机中窃取数据。多年来，人们已经证明了各种类型的气隙隐蔽通道，包括电磁通道、磁通道、声学通道、光学通道和热通道。在本文中，我们介绍了一种新型的振动（地震）隐蔽通道。我们观察到，计算机振动的频率与其内部风扇的转速相关。这些听不见的振动会影响计算机所在的整个结构。我们的方法是基于恶意软件的能力，控制由计算机产生的振动，通过调节其内部风扇的速度。我们表明，恶意软件产生的隐蔽振动可以通过附近的智能手机通过集成的，敏感的\textit{accelerometers}。值得注意的是，智能手机中的加速计传感器可以被任何应用程序访问，而无需用户权限，这使得这种攻击具有高度的规避性。我们实现了AiR-ViBeR，这是一种对二进制信息进行编码的恶意软件，并通过低频振动载波对其进行调制。然后，数据被放置在同一表面上的智能手机上的恶意应用程序解码（例如，在桌子上）。我们讨论了攻击模型，提供技术背景，并提出了实施细节和评估结果。我们的研究结果表明，使用AIR-ViBeR，数据可以通过振动从空气间隙的计算机泄露到同一张桌子上附近的智能手机，甚至是相邻的桌子。最后，我们提出了一套针对这种新型攻击的对策。
英文摘要：
Air-gap covert channels are special types of covert communication channels that enable attackers to exfiltrate data from isolated, network-less computers. Various types of air-gap covert channels have been demonstrated over the years, including electromagnetic, magnetic, acoustic, optical, and thermal. In this paper, we introduce a new type of vibrational (seismic) covert channel. We observe that computers vibrate at a frequency correlated to the rotation speed of their internal fans. These inaudible vibrations affect the entire structure on which the computer is placed. Our method is based on malware's capability of controlling the vibrations generated by a computer, by regulating its internal fan speeds. We show that the malware-generated covert vibrations can be sensed by nearby smartphones via the integrated, sensitive \textit{accelerometers}. Notably, the accelerometer sensors in smartphones can be accessed by any app without requiring the user permissions, which make this attack highly evasive. We implemented AiR-ViBeR, malware that encodes binary information, and modulate it over a low frequency vibrational carrier. The data is then decoded by malicious application on a smartphone placed on the same surface (e.g., on a desk). We discuss the attack model, provide technical background, and present the implementation details and evaluation results. Our results show that using AiR-ViBeR, data can be exfiltrated from air-gapped computer to a nearby smartphone on the same table, or even an adjacent table, via vibrations. Finally, we propose a set of countermeasures for this new type of attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
