The new way to steal data through your computer's vibrations

As “work from home” sets in, more hacking attacks take place on both corporations and individuals. Your laptop or CPU fans that serve the purpose of cooling and protecting the life of its components produce subtle vibrations that go unnoticed by our human ears. A team of researchers at Ben-Gurion University in the Negev, Israel, has discovered a creative way through which computer scientists can steal sensitive data from a highly secure computer. How is it possible? By taking advantage of the vibrations of the cooling system.

Senior cybersecurity researcher Mordechai Guri, from Israeli University, explains that the data encoded by the hackers in the vibrations of the fans could be transmitted to a compromised smartphone or smartphone located near the target computer.

"We observed that computers vibrate at a frequency correlated with the rotational speed of their internal fans," said Guri. "the malware can control computer vibrations by manipulating internal fan speeds. These inaudible vibrations affect the entire structure in which the computer is placed."

Thanks to this new method of cyberattack, it is possible to connect the phone to a PC without any wired or wireless connection and transfer this information to a compromised nearby mobile phone. Accelerometer sensors on smartphones are not secured and "any application can access them without requiring user permissions, making this attack very elusive."

The vulnerability that uses changes in the vibrations of PC fans to filter data through a complex method involving more than one compromised device, has been dubbed Air-ViBeR.

Shall I be concerned?

There is an infinitesimal and purely mathematical possibility that this type of cyberattack will affect you as an end-user, however, it must be recognized that, above all, it is a very ingenious method, worthy of a Hollywood hacker movie.

The Air-ViBeR technique regulates the speed of the fans to alter the acoustics of the computer, without us being able to notice it, and transmit data to a listening device connected to the Internet that then converts those vibrations into ones and zeros that can be transmitted to a designated network.

We need to be aware that there is no way by which this method can transmit our 100 gigabytes (or similar) lifetime hard drive, much less during the few hours that the smartphone is located on the same desktop as the computer, but the attacker would look for something specific; data that will fit about 4KB (one block or 32,768 bits) to get hold of it and transmit it easily.

"The malware in question does not filter data by breaking encryption standards or by breaking a network firewall, but encodes the data in vibrations and transmits it to the accelerometer of a smartphone," says Guri.

How to protect my devices

Although it is practically unfeasible, three measures would help protect a computer against this cyber attack:

1. Run the CPU continuously in maximum power consumption mode, which would prevent it from adjusting consumption.

2. Set CPU and GPU fan speeds to a single, fixed speed.

3. Restrict the CPU to a single clock frequency.

Mordechai Guri demonstrated his method and wrote a research paper titled “AiR-ViBeR: Exfiltrating Data from Air-Gapped Computers via Covert Surface” Vibration” accessible through the following link https://arxiv.org/abs/2004.06195

Dr. Raul V. Rodriguez