BitWhisper: It's possible to steal data from air-gapped computers using heat

Computer security researchers from Israel's Ben-Gurion University have discovered it is possible to steal data from highly secure air-gapped computers by manipulating the thermal sensors inside them.

Air-gapped systems are computers deliberately isolated from connecting to the internet or any other computers in order to make sure they stay secure and data cannot be stolen from them.

These systems are routinely used by financial payment networks to process credit card transactions for retailers, classified military networks or industrial control systems that operate important infrastructure like a city's electrical grid. The only way to remove data from an air-gapped computer is to physically access the machine.

But now, security researchers have realised that if two air-gapped computers are located adjacent and within 40cm (15in) of each other in a room, it is possible to manipulate the machines' built-in thermal sensors that control heat emissions to prevent the computer from overheating.

BitWhisper

The proof-of-concept attack, named BitWhisper, requires both computers to have been compromised by malware, which then uses the thermal sensors to send commands or data from one air-gapped system to the other.

According to Wired, which has seen the as-yet-unreleased research paper, the technique discovered by the researchers is similar to Morse code and involves using thermal pings, ie controlled increases of heat to communicate with the other computer, which the receiving computer interprets as binary code (1 or 0).

This technique is quite primitive and as such the researchers said it takes an hour to transmit just eight bits of data but this would still be sufficient to transmit a secret key or password.

Would this happen in reality?

The researchers say that while air-gapped systems are isolated from the internet, they are situated next to computers that are connected to the internet. Both computers would need to already be compromised with malware, which means it is still hard to replicate this attack in real life.

"We expect this pioneering work to serve as the foundation of subsequent research, which will focus on various aspects of the thermal channel and improve its capabilities," the researchers wrote in their paper.

They are keen to see if they can increase the speed of data transfer between the two computers, as well as the distance.

Eventually, they see this technique being used in a situation where an Internet of Things connected device like an air conditioning system that sends data over Wi-Fi to an app could be compromised and accessed remotely by a hacker to emit controlled fluctuations in temperature.