A newly discovered side-channel attack, PIXHELL, has been found to breach air-gapped computers by exploiting the "audio gap" and exfiltrating sensitive information using the noise generated by pixels on an LCD screen.
"Malware in the air-gapped and audio-gapped computers creates crafted pixel patterns that generate noise in the frequency range of 0 - 22 kHz," said Dr. Mordechai Guri, head of the Offensive Cyber Research Lab at the Ben Gurion University of the Negev in Israel, in a recently published paper.
This malicious code uses sound from coils and capacitors to manipulate the frequencies emitted from the screen. These acoustic signals can be modulated to encode and transmit sensitive information.
Attack Methodology
What makes PIXHELL particularly dangerous is that it doesn’t require any specialized audio equipment, like loudspeakers or internal speakers. Instead, it relies solely on the LCD screen to produce the acoustic signals.
Typically, air-gapping isolates critical environments from external networks by disconnecting cables, disabling wireless connections, and blocking USB access. However, these defenses can be circumvented through methods such as rogue insiders, supply chain compromises, or even by plugging in an infected USB drive.
"Phishing, malicious insiders, or social engineering techniques may trick users into actions that compromise air-gapped systems," Dr. Guri noted.
He also warned that software supply chain attacks could introduce malware into these systems by targeting third-party dependencies. This allows malware to go undetected during development and testing phases.
Similar to the RAMBO attack, PIXHELL uses malware to create an acoustic channel for covert data exfiltration from audio-gapped systems. This is made possible by components like inductors and capacitors within LCD screens, which vibrate and produce high-pitched noises (known as coil whine) when electrical currents pass through them.
The technique takes advantage of power consumption differences between lit and dark pixels. White pixels require more energy than dark ones, creating specific vibration patterns that attackers can manipulate.
"When alternating current (AC) passes through screen capacitors, they vibrate at certain frequencies," Dr. Guri explained. "By controlling the pixel patterns, our method generates acoustic waves at specific frequencies from LCD screens."
Data Exfiltration Process
Attackers can use this method to send sensitive data through acoustic signals that are then demodulated by a nearby Windows or Android device. However, the strength and quality of the signal depend on several factors, such as the screen's internal structure, power supply, and component locations.
One of the main downsides of PIXHELL is its visibility to users. The attack involves displaying black-and-white bitmap patterns on the screen, making it noticeable to anyone observing.
Dr. Guri suggested that attackers could reduce detection risk by launching an "overnight attack" when users are not present or by subtly reducing the RGB levels of the pixels during working hours. While this can make the screen appear black, it also reduces the sound intensity, and vigilant users might still detect irregular patterns on the screen.
Previous Attacks and Countermeasures
PIXHELL is not the first instance of circumventing audio-gap restrictions. Previous experiments by Dr. Guri and others have used various components to generate sound, including computer fans (Fansmitter), hard drives (Diskfiltration), CD/DVD drives (CD-LEAK), and power supply units (POWER-SUPPLaY).
To defend against such attacks, it is recommended to:
- Use an acoustic jammer to block transmission.
- Monitor the audio spectrum for unusual signals.
- Limit physical access to critical areas.
- Prohibit smartphones in secure environments.
- Deploy an external camera to detect suspicious screen patterns.
