Jumping Air Gaps with All-in-One Printers
Last week, Adi Shamir gave a presentation at Black Hat Europe on using all-in-one printers to control computers on the other side of air gaps. There’s no paper yet, but two publications reported on the talk:
Theoretically, if a malicious program is installed on an air-gapped computer by an unsuspecting user via, say, a USB thumb drive, attackers should have a hard time controlling the malicious program or stealing data through it because there is no Internet connection.
But the researchers found that if a multifunction printer is attached to such a computer, attackers could issue commands to a malicious program running on it by flashing visible or infrared light at the scanner lid when open.
[…]
The researchers observed that if a source of light is pointed repeatedly at the white coating on the inside of the scanner’s lid during a scanning operation, the resulting image will have a series of white lines on darker background. Those lines correspond to the pulses of light hitting the lid and their thickness depends on the duration of the pulses, Shamir explained.
Using this observation the researchers developed Morse code that can be used to send pulses of light at different intervals and interpret the resulting lines as binary data1s and 0s. Malware running on an air-gapped system could be programmed to initiate a scanning operation at a certain time—for example, during the night—and then interpret the commands sent by attackers using the technique from far away.
Shamir estimated that several hundred bits of data can be sent during a single scan. That’s enough to send small commands that can activate various functionality built into the malware.
This technique can be used to send commands into an air-gapped computer network, and to exfiltrate data from that network.
Carl "Bear" Bussjaeger • October 22, 2014 2:43 PM
Unless they want to upgrade to a High Energy Laser, it sounds like they need a window. I guess my old mil security experience is outdated, because back then, our secure systems were supposed to be in windowless areas.
There’s still the matter of infecting the printer and getting it into the facility. But if someone infiltrated a factory and implanted the software at the source in every combo printer leaving the factory, I suppose eventually one would make it somewhere interesting.