SPECTER uses USB power control to exfiltrate data from air-gapped hosts
Original title: SPECTER: Covert Data Exfiltration from Air-Gapped Systems via USB Power Modulation
Charging-state signaling reached 0.2-0.25 bit/sec; a USB mouse on Windows reached 1.0 bit/sec.
Researchers present SPECTER, a post-compromise covert channel that encodes bits through host-side USB power-management or device-state operations rather than USB data transfers. Receivers can use smartphone charging states, visible peripheral behavior, or near-field RF. Tests on Windows 10 and Ubuntu 22.04 worked on commodity hardware, including an SDR with a loop antenna against the USB cable. The authors say the channel can move short secrets at a low rate and argue USB power and device-state events should be treated as security telemetry.
- Administrative privileges are required on the transmitting host.
- Android and iOS devices recovered charging-state signals at 0.2-0.25 bit/sec.
- A USB mouse on Windows signaled at 1.0 bit/sec.
- RF reception used a software-defined radio and a loop antenna in contact with the cable.
- Availability depends on host configuration, the connected device, and the receiver path.
Impact: Low-rate exfiltration of short secrets from segregated hosts
- 1.Treat USB power-management and device-state events as security-relevant telemetry
- Products
- Windows 10Ubuntu 22.04
From the original article
1 min read at arxiv.orgWe present SPECTER, a post-compromise covert channel that uses host-side USB power control to exfiltrate information from air-gapped and network-segregated systems. A transmitter with administrative privileges encodes bits through USB power-management or device-state operations without placing the payload in USB data transfers.
By Hyeongjun Choi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.