When we mention Ben-Gurion University, some of our readers might remember that it is located in Israel, but what matters most is that it has been working on special methods to defeat the famous 'air gap' used in high-security environments to protect data. Its latest variant is Fansmitter, a proof-of-concept that transmits data from a computer to a smartphone by altering the speed of its fans.
The last maintenance session on my computer was reduced to cleaning the CPU heatsink and fan, plus changing the thermal grease. Long story short, there was a whole extraterrestrial civilization living in the aluminum block, and the temperature sensor said "enough" Actually, I already suspected something was wrong with the cooling, because of the way the fan noise varied. That noise is a detail many users recognize, and they directly consider it "annoying". The latest generation computers, more efficient and optimized, allow fans to run at a lower speed, reducing ambient noise. Now, what I would never have imagined is that fan noise could be used as an escape route to extract data.
That is exactly what a group of researchers at Ben-Gurion University demonstrated with their system Fansmitter. Due to advances in malware development, the new recommendation for systems protected by an 'air gap' is to remove speakers, but Fansmitter works at an even lower level. What this malware (as the researchers call it) does is modify the speed of the fans in the computer, thereby manipulating its acoustic wave. Fansmitter can modulate and transmit data in binary form through these changes in fan audio signals, which are collected and interpreted by the microphone of a nearby smartphone (within eight meters).
There are two other elements that make Fansmitter a notable opponent: The variations can be very subtle (on the order of 100 Hz), which completely escapes human hearing, and it can interact with other fans besides the one that cools the processor, such as those found in graphics cards and power supplies. Now, close monitoring of fan speeds could be sufficient to detect erratic behavior, not to mention modifications to fans that prevent control by software, generating interference with another device (music with a smartphone speaker, perhaps?) and the option of a 'fanless' system. Finally, we get to the transfer rate: 20 bits per minute. It seems insignificant, but with an hour of exposure, it could leak something critical.
