Hackers’ New Tool? Computer Fan Sounds

Where there’s a will, there’s a way – and the statement can’t me more true when it comes to hackers.

As Wired reported on Tuesday (June 28), a group of researchers in Israel has discovered a way that cyberattacks can steal data from air-gapped computers. Despite the fact that these machines are never connected to the internet or any other internet-connected devices, the researchers have found a way to extract data from them.

The method? The sound emitted by the cooling fans inside computers.

“We found that if we use two fans concurrently [in the same machine], the CUPU and chassis fans, we can double the transmission rates,” Mordechai Guri, manager of research and development at the Cyber Security Research Center at Ben-Gurion University, told Wired.

“And we are working on more techniques to accelerate it and make it much faster.”

Guri and his colleagues have previously found ways to access the data on the machines via radio waves, electromagnetic waves, the GSM network, and by using the heat emitted by computers. The new cooling fan sound technique is able to collect encryption keys and passwords at a rate of 15 to 20 bits per minute.

Air-gapped systems are known for their impenetrability, making them a sought-after mechanism for protecting sensitive data and networks, such as military networks, financial institutions and industrial control system environments, Wired reported.

But now that air-gap hacks using near-physical access have been successfully conducted by the researchers, there is a challenge to the notion of how secure these systems really are.

Though the fan attacks can be identified using software that measures changes in fan speed and monitors sound waves, Guri said false alerts can still be created and that there are still other disadvantages to this type of mitigation.