Hackers can covertly turn a cable inside a computer into a makeshift antenna that can secretly transmit sensitive data, even from “air-gapped” devices that are deliberately not connected to the internet.

Air-gapped computers are commonly used by government security services and key infrastructure control systems to prevent remote hackers from gaining access, but that doesn’t mean it is impossible to get data out.

at Ben-Gurion University of the Negev, Israel, has worked for years to develop a series of proof of concept attacks that use different components within computers as unusual transmitters. In the past he has managed to extract information by encoding it in rapid adjustments of screen brightness, deliberate temperature changes within a machine or flickering power LEDs.

Guri’s latest attack focuses on the Serial Advanced Technology Attachment (SATA) cables that connect CD, DVD and hard disc drives to the motherboard of most computers. He found that by deliberately creating a very specific series of superfluous data reads or writes from or to the drives, the cables can be made to create a radio wave at around 6 gigahertz. This wave can be used to encode and transmit data to a waiting hacker several metres away.

Forcing a computer to create these radio wave signals would involve installing a piece of malware, which Guri calls SATAn, on the air-gapped machine. This might seem like a challenge, but it is possible. A report published in 2021 by security company ESET says that that target air-gapped machines, but that they rely heavily on USB drives to infect machines. They also use USB drives for subsequent removal of data, which is transmitted back to the attacker once the drive is plugged into an internet-connected machine.

The report says that only one piece of malware, known as BadBIOS, has ever been claimed to use covert channels similar to SATAn to transmit data – but that its existence is hotly debated by researchers. The Stuxnet worm that targeted Iranian nuclear centrifuges and gave them commands that deliberately caused damage was thought to have been introduced to air-gapped networks via a USB drive, but wasn’t designed to remove data.

Guri says he doesn’t know if similar attacks to SATAn are actually taking place, but says that they are entirely plausible. “This attack is highly available since hard drives exist in all systems such as workstations and servers,” he says. “In addition, the malware uses legitimate read and write hard drive operations which are very challenging to detect and identify as malicious.”

He says that a Faraday cage around the computer that stops all electromagnetic signals would prevent this kind of attack, but for most applications this simply isn’t practical. Another potential measure would be to constantly create noise by reading and writing superfluous data to the hard disc, but that this comes with the downside that it places undue wear and tear on the component.

Reference:

What is Hertzbleed?

What does it mean for you?

How was it discovered?

Can it be fixed?

HUNDREDS of ambulances in the UK are still using devices that run on defunct Windows operating systems, making them more vulnerable to cyberattacks. The WannaCry ransomware that knocked out computers at dozens of hospitals in 2017 took advantage of a similar vulnerability.

According to data obtained through Freedom of Information (FOI) requests, North East Ambulance Service and Yorkshire Ambulance Service use devices in their ambulances daily that run on Windows XP.

About 500 vehicles run by the Yorkshire Ambulance Service have a mobile device terminal that controls a vehicle’s GPS navigation and deals with status messages, such as where a patient lives and the type of emergency. Some 350 run on Windows XP, which hasn’t been supported by Microsoft since April 2014. Yorkshire Ambulance Service says it will update these by 15 October.

North East Ambulance Service runs XP on devices in 550 vehicles. London Ambulance Service also said it has five XP devices, but they aren’t connected to the internet.

91av put in FOI requests to all the ambulance trusts in England last year asking whether devices within each trust ran on Windows XP, Windows 98 or Windows 95. Only those mentioned in this article were using obsolete versions of Windows and all three declined to provide additional comment.

“In each dual crewed ambulance and rapid response vehicle there is a mobile data terminal, which is controlled by a third party company, Terrafix,” said Yorkshire Ambulance Service in its FOI response.

Terrafix responded to 91av with the following comment: “Terrafix agrees that using Windows XP in a standard system setup can be open to vulnerabilities, however all Terrafix systems provided to Ambulance Trusts across the UK are completely locked down and do not allow any unprotected physical or remote access. This, therefore, negates any vulnerability from using Windows XP, or any version of operating system, on a Terrafix device.”

Ray Walsh at advocacy group ProPrivacy says: “Terrafix provides systems to many ambulances, so is a high-level potential target for hackers, cybercriminals and cyberwarfare attacks.”

“The company is responsible for systems that provide the information that first responders and paramedics receive while on call,” he says. “If it were to be hacked, cybercriminals could potentially get a hold of any patient data that is provided by the mobile data terminal in the ambulance or, worse, interfere with the vital information that enables the ambulance to get to the patient quickly.”

Windows XP no longer gets security updates. Potential consequences were seen in 2017, when the WannaCry ransomware attacks took down hundreds of thousands of computers worldwide. More than 60 UK National Health Service trusts were affected, which prevented doctors from accessing patient records and forced the cancellation of many procedures.

WannaCry exploited computers that hadn’t been updated with the latest Windows security patches or that ran versions of the operating system that Microsoft no longer supported.