It could be assumed that the most effective way to safeguard your computer against the threat of cyber attacks would be to disconnect it from all networks: wireless, LAN, network cards or the internet. However, research from the Fraunhofer Institute for Communication, Information Processing and Ergonomics (FKIE) has demonstrated a malware prototype with the ability to jump the "air gap" – meaning even that once surefire security measure might not be enough to ensure the protection of your computer.
Computer scientists Michael Hanspach and Michael Goetz conducted an experiment involving five computers which connected to one another using their built-in microphones and speakers to form an inaudible acoustic network. The data was able to be transferred from one computer to another until it reached one with a regular internet connection that was able to take the signal "outside."
The scientists selected a near ultrasonic frequency range which saw data communicated between the computers within a range of 19.7 m (64.6 ft), all without a connection to a central access point or router. Hanspach says the same technique might also be used to transfer data between smartphones or tablets.
According to the research paper, networks relying on acoustical communication are seldom used because of the much higher bit rates and ranges offered by radio transmission. However, as the electromagnetic waves used in radio communication are highly absorbed by sea water, acoustical networks have proven useful for underwater data transmission.
With this knowledge, Hanspach and Goetz adapted a system previously developed by the Research Department for Underwater Acoustics and Marine Geophysics in Germany to form the acoustical network, enabling the data transmission between laptops using only inaudible sounds. Despite the breakthrough, the technology has considerable drawbacks – namely a transmission rate of 20 bits per second.
In the past, we have seen similar technology using inaudible sound frequencies to create an alternative to NFC and to transfer inaudible QR codes. However, the network proposed by the German scientists is the first to establish a data transmission between computers purely through acoustical communication.
The scientists also explored various countermeasures against the dangers of acoustical covert networks. The first (and most obvious) option is to switch off audio input and output devices. Failing this, the implementation of audio filtering offers an alternative approach whereby the specific frequencies used by the acoustic network could be filtered out with a bandpass filter (a device that passes frequencies within a certain range, and rejects those outside).
The scientists are skeptical that their research demonstrates an effective way of spreading malware at present. However, they are mindful of the potential dangers "audio botnets" may present in as little as five years, citing critical infrastructure as something that may one day be susceptible.
The team's research is published in the online edition of the Journal of Communications.
Source: Fraunhofer
