POWER-SUPPLaY：通过将电源转换为扬声器来泄漏气隙系统的数据
POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers
摘要：
众所周知，攻击者可以通过声波和超声波通过扬声器从空气间隙的计算机中窃取数据。为了消除敏感系统中这种声学隐蔽通道的威胁，可以禁用音频硬件，并且可以严格禁止使用扬声器。这种无音频系统被认为是\textit{audio-gapped}，因此不受声学隐蔽信道的影响。在本文中，我们介绍了一种技术，使攻击者泄漏数据的空气间隙和音频间隙的系统声学。我们开发的恶意软件可以利用计算机电源单元（PSU）播放声音，并将其用作功能有限的带外辅助扬声器。恶意代码操纵电源的内部\textit{switching frequency}，从而控制其电容器和Transformers产生的声音波形。我们的技术使得能够在0- 24 kHz的频带中产生音频音调并播放音频流（例如，WAV），而无需音频硬件或扬声器。二进制数据（文件、键盘记录、加密密钥等）可以在声学信号上进行调制并发送到附近的接收器（例如，智能手机）。我们展示了我们的技术适用于各种类型的系统：PC工作站和服务器，以及完全没有音频硬件的嵌入式系统和物联网设备。我们提供了技术背景，并讨论了实现细节，如信号生成和数据调制。我们表明，POWER-NETLAY代码可以从一个普通的用户模式的进程，不需要任何硬件访问或特殊权限。我们的评估表明，使用POWER-EQUIPLAY，敏感数据可以从空气间隙和音频间隙的系统从五米远的距离，在50位/秒的最大比特率渗出。
英文摘要：
It is known that attackers can exfiltrate data from air-gapped computers through their speakers via sonic and ultrasonic waves. To eliminate the threat of such acoustic covert channels in sensitive systems, audio hardware can be disabled and the use of loudspeakers can be strictly forbidden. Such audio-less systems are considered to be \textit{audio-gapped}, and hence immune to acoustic covert channels. In this paper, we introduce a technique that enable attackers leak data acoustically from air-gapped and audio-gapped systems. Our developed malware can exploit the computer power supply unit (PSU) to play sounds and use it as an out-of-band, secondary speaker with limited capabilities. The malicious code manipulates the internal \textit{switching frequency} of the power supply and hence controls the sound waveforms generated from its capacitors and transformers. Our technique enables producing audio tones in a frequency band of 0-24khz and playing audio streams (e.g., WAV) from a computer power supply without the need for audio hardware or speakers. Binary data (files, keylogging, encryption keys, etc.) can be modulated over the acoustic signals and sent to a nearby receiver (e.g., smartphone). We show that our technique works with various types of systems: PC workstations and servers, as well as embedded systems and IoT devices that have no audio hardware at all. We provide technical background and discuss implementation details such as signal generation and data modulation. We show that the POWER-SUPPLaY code can operate from an ordinary user-mode process and doesn't need any hardware access or special privileges. Our evaluation shows that using POWER-SUPPLaY, sensitive data can be exfiltrated from air-gapped and audio-gapped systems from a distance of five meters away at a maximal bit rates of 50 bit/sec.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
