Air-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers
Title is misleading. This isn't generating Wi-Fi signals. It's generating non-Wi-Fi signals (i.e. effectively noise) in the Wi-Fi frequency bands, in a way that encodes information and can be detected using existing Wi-Fi chipsets (e.g. measuring channel noise), as a very low bandwidth communications channel.The bit rate with off the shelf Wi-Fi chipsets as receivers is ~10 bits per second.This is definitely interesting and clever, but as a security researcher I will say I consider this particular research lab a bit of a paper mill. Their entire schtick is they pick any random emission from a computer that can be picked up remotely, and hype it up as an airgap-defeating measure. The thing is, once you accept that either 1) if your air-gapped computer has malware that can do this, you've already lost, or 2) if you need to be resilient to that, your "air gap" needs to be a sealed vault insulated from sound, EMI, and any other physical transmission medium, then this whole body of research becomes purely academic.IIRC they've done LEDs, temperature, inductor noise, ultrasound, etc. When I first started looking into this I could come up with a good dozen of their ideas without looking. Of course all this stuff works. It's cute, it's clever, but it's not particularly obscure nor difficult to make work, and it all relies on having malware on the target machine to begin with. Yes, computers are noisy beasts, and you can encode information in the noise; we've known this for decades, picking a new technique and implementing it isn't particularly interesting after the fifth or sixth time.Personally, I find their techniques primitive and boring. Like here, they set the RAM bus frequency to 2.4GHz (DDR-2400). Yes, of course, if you do that, then RAM traffic generates noise in the Wi-Fi band. Then they just used the most boring and trivial encoding possible on top of that. I don't remember ever reading one of their papers and thinking they'd used a clever technique. It always seems to be "pick a leak vector, then do the least amount of work possible to make it work at a few bits per second and get a paper out".The interesting side channel papers are those where you can get information from emissions (e.g. crypto keys) without malware on the target computer, during normal operation. Those are real threats. And this is not what this group is researching.