The sounds your hard drive makes can be used to steal data

[Shawn Knight]

One of the most effective ways to keep a computer protected from viruses, malware or forms of spying is to create an air gap, a fancy term that simply means a system isn’t connected to the Internet or any type of local network.

Of course, anyone with more than basic knowledge of computer security will tell you that isn’t enough. In 2013, for example, it was revealed that hackers could use inaudible audio signals to communicate with (and infect) PCs that aren’t connected to the Internet or other networks.

Now researchers have developed a new method that uses a computer’s hard drive to create a unique acoustic signal that can be picked up by a nearby device specifically listening for such signals.

The technique, called DiskFiltration, works by controlling the movements of the hard drive’s actuator, the small mechanical arm that moves around a drive’s platters so the attached heads can access stored data or write new data. Precisely controlling the actuator creates unique acoustic signals that can be used to wirelessly transfer things like passwords, cryptographic keys and other sensitive information to a nearby device with a microphone.

As Ars Technica notes, the technique has an effective range of about six feet but can only operate at speeds of about 180 bits per minute. At that rate, it would take around 25 minutes to steal a 4,096-bit key.

While techniques like this and others are indeed possible, their effectiveness in the real world is limited by the fact that you first need to somehow install the necessary malware on the target machine. Systems with high levels of security would make this rather difficult to do.

Permalink to story.

https://www.techspot.com/news/65959-sounds-hard-drive-makes-can-used-steal-data.html

 

[Greg S]

their effectiveness in the real world is limited

And the fact that solid state drives are being used in data centers now too...

 

[VitalyT]

All the more reasons organizing your home network in a professional and practical way - use only SSD-s in your PC case, while keeping all hard drives in a NAS somewhere away from the PC.

 

[cliffordcooley]

Ohh my word! I can hear an SSD salesman using this as their new sales slogan.

 

[Satish Mallya]

Spymaster: "what do we know about this man?"
Spy, listening: *clickety click click*
Spy: "Sir, he's making an online purchase for...a new hard drive"

 

[mcborge]

This could be easily foiled by tapping on the desk... or using the keyboard or using sound proofed case.

 

[Evernessince]

I'm sure they can figure out a way to make this work on any computer part with a power delivery system. Stress it just the right amount so that the coil whine is in the audible range that a recording device can take.

 

[SirGCal]

Ya-know...

Sure, 'Try that on my SSD', etc. bla bla bla...

It is still pretty darn cool effort that was done with a high level of skill. It is also too slow to be practical by any means (now).

But I still have to say: Kudos to them.

 

[SNGX1275]

Interesting finding, I'm going to be exempt though, I have 5 physical spinning hard drives in my main PC.

 

[merikafyeah]

People must have short memories. Something far scarier happened about 3 years ago, when researchers broke through 4096-bit RSA by listening to the sound of a CPU's voltage regulator, and unlike this hard drive exploit no malware needs to be preinstalled on the target machine:
http://www.extremetech.com/extreme/...to-the-tiny-sounds-made-by-your-computers-cpu

 

[Tweetysvoice]

It is still pretty darn cool effort that was done with a high level of skill. It is also too slow to be practical by any means (now).

But I still have to say: Kudos to them.

I agree! Seriously thinking outside the box. For once. Kudos!

 

[NahNood]

This could be easily foiled by tapping on the desk... or using the keyboard or using sound proofed case.

Or whistling while you work... Or singing in the shower... lol

 

[p51d007]

My HDD makes no noise...SSD in the laptop

 

[mcborge]

Or whistling while you work... Or singing in the shower... lol

Or playing the maraca's whilst tap dancing on bubble wrap!

 

[Pinkie Pie]

I'll have to keep a sharp eye out for strange people standing no more than 6 feet away from my computer.

 

[TheBigT42]

Total BS....They said the same thing about the Ethernet Activity light years ago.

 

[cliffordcooley]

Total BS....They said the same thing about the Ethernet Activity light years ago.

Tell me about it! One blink or grunt would represent thousands of bytes. There is absolutely no way to piece data together from it.

 

[jack_alexander]

It seems from what I've been reading that no one in the entire planet has any type of privacy. The U.S. government alone has dozens of lists, many arbitrarily produced that are used to violate individual's privacy. The thing with dealing with computer privacy is an almost impossible to accomplish as some one some where will find a way to bust into your info. I would think it would be healthier to forget our paranoia and learn to live with crooks and thieves.

 

[cliffordcooley]

I would think it would be healthier to forget our paranoia and learn to live with crooks and thieves.

I'm not sure learning to live with bullets flying around would be healthier.

 

[mcborge]

It seems from what I've been reading that no one in the entire planet has any type of privacy. The U.S. government alone has dozens of lists, many arbitrarily produced that are used to violate individual's privacy. The thing with dealing with computer privacy is an almost impossible to accomplish as some one some where will find a way to bust into your info. I would think it would be healthier to forget our paranoia and learn to live with crooks and thieves.

I don't think anyone who has had their bank account cleaned out or there identity stolen would see it that way... the minute you let your guard down, you become an easy target... just the kind of mark crooks look for.

 

[jack_alexander]

I don't think anyone who has had their bank account cleaned out or there identity stolen would see it that way... the minute you let your guard down, you become an easy target... just the kind of mark crooks look for.

With my tiny Veteran's pension I am not worth ripping off. And I know ways to replace that tiny pension in time for rent money!

 

[jack_alexander]

I'm not sure learning to live with bullets flying around would be healthier.

Three tours in Vietnam. I guess I'm just numb to what you describe as bullets everywhere. Besides I like calling the cops and telling them where and what caliber since I was in gunnery. As I explained below that even if my tiny Veteran's pension got ripped off I know how to replace it by rent time. Experience from the streets off and on. And not by criminal acts, I might add....

 

[cliffordcooley]

The only reason we don't have that many bullets flying around, it the fact we are not trying to "learn to live with crooks and thieves".

 

[jack_alexander]

But they are everywhere, even in the government. Why worry about petty nuts and crooks? It will hurt your health both mentally and physically to be so paranoid. And I think we have digressed from the original subject at hand. My attitude comes from age and experience. I find that I'm a lot happier and healthier by not worrying about these things. I worry about what the criminal government we have is doing to us in subverting our rights (and keeping the world on the brink of nuclear destruction--I handled nukes in my earlier years and have been to one of our 'experiments' in Japan-history has shown every weapon invented will be used and that one has-what will the government backed nuts come up with next?), and I submit myself to the thought that nothing can be done, so why worry?

 

[cliffordcooley]

Not worrying and completely letting your guard down because you are learning to live with evil, is two completely different things. I agree don't worry, but by all means keep your guard up. Don't just learn to live with it, or you will be the next victim for sure.