Specialists from the Israeli Ben-Gurion University have repeatedly demonstrated original and interesting concepts of attacks. In their research, researchers mainly concentrate on particularly complex cases, that is, they develop vectors of attacks for situations in which it is simply impossible to steal information or track a user. In particular, if the computer is physically isolated about any networks and potentially dangerous peripherals.
This time, experts presented the technique of PowerHammer attacks and suggested using conventional power cables to extract data.
The principle of PowerHammer is as follows. The target computer needs to be infected with the malware of the same name, which specifically regulates the "busy" level of the processor, choosing those cores that are currently not occupied by user operations. As a result, the victim's PC consumes more, then less electricity. Such "jumps" experts suggest to regard as the simplest zeros and ones, with the help of which any information from the target computer can be transmitted outside (like Morse code). To read the data transferred in this way, specialists suggest using conductive radiation (so-called "induced noise") and measuring the power fluctuations.
To notice such fluctuations in the power of the target PC, the attacker will have to use a hardware "monitor." And the attacker will not have to create the equipment himself, for example, it is enough to purchase a detachable current transformer, available in free sale. During the tests, experts from the Ben-Gurion University used the device SparkFun ECS1030-L72 . Data collected by such a sensor can, for example, be transmitted to a nearby computer via Wi-Fi.
Experts say that the PowerHammer attack can be implemented in two ways, which will differ in the speed of data transfer. So, the criminal can monitor the power network between the isolated PC and its socket. Then the data transfer rate is about 1000 bps.
It is also possible to connect at the phase level, that is, to install the sensors in the
electrical switchboard on the desired floor or in the proper building. Of course, such a method is more invisible, but the transmission speed of information is unlikely to exceed 10 bps due to the numerous "jamming". The second method, according to researchers, nevertheless, is suitable for stealing passwords, tokens, encryption keys and other data of small volume.
As usual, the most controversial moment in the attack of PowerHammer is the infection of the target computer with malware (as we recall, it is isolated from external networks and dangerous peripherals). Experts believe that this can be done with the help of social engineering, intervention in the supply chain of equipment or with the support of an insider. Similar methods have already been demonstrated in practice by hacker groups Turla and RedOctober.
