A novel assault identified as 'SmartAttack' leverages smartwatches as a covert ultrasonic signal receiver to extract data from physically isolated (air-gapped) devices.
Air-gapped systems, which are often used in mission-critical environments such as government buildings, weapons platforms, and nuclear power plants, are physically separated from external networks to prevent malware infestations and data theft. Despite their isolation, they are still susceptible to compromise from insider threats like rogue employees utilising USB devices or state-sponsored supply chain attacks.
Once infiltrated, malware can function silently, modulating the physical features of hardware components to communicate sensitive data to a nearby receiver without interfering with the system's regular operations.
SmartAttack was developed by Israeli university researchers led by Mordechai Guri, a covert attack channel expert who has previously shown ways for leaking data using LCD screen noise, RAM modulation, network card LEDs, USB drive RF signals, SATA connectors, and power supply.
While assaults on air-gapped environments are often theoretical and exceedingly difficult to execute, they do present interesting and unique ways to exfiltrate data.
Modus operandi
SmartAttack requires malware to infect an air-gapped machine in order to acquire sensitive data such as keystrokes, encryption keys, and credentials. It can then use the computer's built-in speaker to send ultrasonic signals into the environment. The audio signal frequencies can be modified using binary frequency shift keying (B-FSK) to represent binary data, also known as ones and zeros. A frequency of 18.5 kHz symbolises "0," whereas 19.5 kHz represents "1.”
Humans cannot hear frequencies in this range, but they can be picked up by a smartwatch microphone worn by someone close. The smartwatch's sound monitoring app uses signal processing to detect frequency shifts and demodulate encoded signals, as well as integrity tests. The final data exfiltration can occur via Wi-Fi, Bluetooth, or cellular connectivity.
Performance and limitations
The researchers point out that smartwatches use smaller, lower-SNR microphones than smartphones, making signal demodulation challenging, particularly at higher frequencies and lower signal intensities. Even wrist position was discovered to be a significant factor in the attack's feasibility, with the watch operating best when it is in "line-of-sight" with the computer speaker.
The maximum transmission range varies per transmitter (speaker type) and is between 6 and 9 meters (20 - 30 feet).
Data transmission rates range from 5 to 50 bits per second (bps), with dependability decreasing as rate and distance rise. Prohibiting smartwatch use in safe settings is the best method to combat the SmartAttack, according to the researchers.
Eliminating the built-in speakers from air-gapped devices would be an additional step. This would remove the attack surface for not just SmartAttack but all acoustic covert routes. If none of this is practical, ultrasonic jamming using software-based firewalls, audio-gapping, and wideband noise emission may still work.
