Stealing Files From Your Power Supply?!
ฝัง
- เผยแพร่เมื่อ 30 ก.ค. 2024
- Try out OctoPart 👉 octopart.com/
Altium 👉 www.altium.com/yt/seytonic
0:00 Intro
0:14 Stealing Files From Your Power Supply?!
3:08 North Korean Hackers Target Internet Explorer
6:12 Apple Kills Image Scanning Plans
8:30 Octopart
9:06 Outro
Sources:
thehackernews.com/2022/12/cov...
arxiv.org/pdf/2212.03520.pdf
• COVID-bit: Keep a Dist...
therecord.media/google-north-...
www.bleepingcomputer.com/news...
blog.google/threat-analysis-g...
thehackernews.com/2022/12/goo...
go.theregister.com/feed/www.t...
arstechnica.com/?p=1902915
www.wired.com/story/apple-pho...
go.theregister.com/feed/www.t...
===============================================
My Website: www.seytonic.com/
Follow me on TWTR: / seytonic
Follow me on INSTA: / jhonti
=============================================== - บันเทิง
![แล้วแต่เวรแต่กรรม - ครูศรีหนุ่ม [OFFICIAL MV]](http://i.ytimg.com/vi/Xide0fkAS8g/mqdefault.jpg)
The power supply exploit reminds me of a situation where I had a radio sitting near my laptop tuned into a distant station. The interference my laptop was producing audibly changed whenever the gpu was working hard.
GPU Fan exploit incoming
Spin the fans up or down and transfer data via variations in sound
I think this was related to one of the voltage regulators or clocks as this laptop has a shared fan for the gpu and cpu.
Yeah that's just a shit/overloaded PSU
@@kreuner11 Nope, no where near enough current to escape the shielding of the case, this PSU thing is a bit BS TBH, all PSU's are very different, huge amounts of current would be required to modulate, even then you would need a very nearby coil and receiver/malware would need to be calibrated AND it would be super obvious... AND with such a low bit-rate you might get a pswd, but what use would that be on an already pwned air-gapped PC. Air-gapped PC's are usually in big locked and shielded rooms that have access control... Yeah sorry but I gotta say this idea would never have any serious application... sorry but this one is clickbait IMO
imagine waiting 2 hours for a megabyte of data, but then it gets corrupted because your victim was mining
My throat explode laughing at this! HAHAHAHAHAHAHAHHAHAHAHABABABAHAHAHAHAHABAVAGA
Imagine mining still
Pro tip: for your cyber security, always be mining (and send the coin to me)
@@Jake48898 imagine pooopy poopy poopy
As someone who lived during dial up, it was extremely frustrating to download anything and it get corrupted which happened a lot as well (maybe 1 in 4 "large 1mb+" downloads would be corrupted.
How in the Hershey’s chocolate bars did someone find a way to hack someone using a power supply
Lol
I think it comes down to three main things:
1. Know how electromagnets work
2. Know how a power supply works
3. Know how a CPU works
If you know these three, the only thing left is a bit of creative thinking to make such an ingenious exploit.
They didn't
@@MacGuffin1 troll
No one is being "hacked using a power supply", the PSU is used to transmit data by malware already on the computer. So you'd need to already have been hacked.
More accurate to say "PSU has been used as a theoretical data transmitter for use by malware to steal data", much like you could use speakers, a monitor, the little hard drive activity LED, the caps lock light on a keyboard, and so on. None of these are alarmingly practical.
My high school technical drafting teacher was a retired air force colonel who use to tell us all kinds of stories. One was about a Soviet "fishing boat" that parked in the harbor outside of some northern European city near a United States embassy or consulate or military facility. It took them weeks to eventually figure out that they were detecting the electrical impulses of the keystrokes on the various devices at the facility, including the encrypted devices they used to send cables back to Washington D.C.., before the messages were encrypted.
And I remember reading in the late nineties that they were either working on or already had devices that could detect the signals from crt monitors to basically copy whatever was on a computer display without having direct access or even line of sight to it.
Wow these thing seem impossible but it actually exist! I wonder if we can use these concept for something useful other than hacking
The power supply exploit could be so frustrating. You kick it off and suddenly a cron job (or any other task) runs and scrambles all the voltages, with the sender malware having no idea there's an issue and the receiver getting junk and having no idea what it's missed.
yeah, but the attack is something that would be done over a long time frame to collect as much as possible and sort it out later. this would not be a person hanging around with a phone in their hand, but something done with a device hidden nearby and communicating over the 4G/5G cell links. If you are not time constrained, you could steal an entire project over time. Given the lax physical security in most corporation (and even government) facilities, this is likely useful for a state sponsored threat actor.
It would be trivial to shape the malware to block other processes and stuff while the data is being transmitted....
@@trixer230you wouldn't even need to block other processes. just design the malware so that it encodes the system's power supply usage in addition to the malware's power supply usage so that the two can be differentiated
Ha! The power supply communication thing is how scp-097 escapes in SCP: Containment breach
First clip reminds me of technology that's been out since the 80's/90's where you can transmit data across the power AC. Number one thing that comes to mind are wireless intercoms that aren't actually wireless but instead uses the power line to transmit data to other intercoms. No extra wires are needed and no wireless transmissions are used.
"Every wire is an antenna"
- Mordechai Guri, probably
he wouldn't be wrong
I think the covid name comes from the fact that most places had social distancing set at 2m
A note about the CSAM detection:
They almost certainly didn't store all the hashes on all devices, instead using a lightweight bloom filter that only contacts a server when a possible match is found.
What I find most sus about this is the same reason those who used to hunt those sites down for bounties stopped doing so. Back in the days when dinosaurs roamed the earth if you hunted these evil people down one was given a bounty for getting them put behind bars but then something else happened. In efforts by three letter agencies to catch more fish in their nets they began building honey pots so criminals who partook in those sites would without any warning they just stepped in dog shit when it was to late formed a dam of sorts for genuine cp hunters where upon search and destroy missions came upon one of those honeypots and after reporting them got notices of either it’s not a real site or it’s already been reported so bounties became rare and so time consuming it was better for those who championed the cause to take on new directions like developing apps or just stick to gaming since just about all those sites were fakes and images were faked so as welcoming a news of Apple contributing to getting these scumbags who abuse kids held accountable most of the places their wares would be sniffing for illegal content would likely be just another three letter agency honeypot meant to catch the bad guys. I’m pretty sure Apple wasn’t doing this for nothing even when it was welcomed news since it meant the average white hat hacker could breath easy knowing they no longer needed to be exposed to those types of things it seems the whole story will never be told as to why.
haven't seen the vid yet, but I'm ready to hear about the newest absurd theoretical attack vector and the new locations I need to place tinfoil to avoid it rofl.
edit: I didn't expect it to actually be the same guy behind the SATA cable antenna! props to him though for being just that right kind of insane though!
edit 2: I didn't expect to find out that Microsoft office was still using MSHTML, I knew that all UWP apps were forced to use the dead EdgeHTML engine, but to think that Microsoft first party apps were using even older dead engines is crazy.
Somehow this still seems more practical than some of the other airgap workarounds, also more interesting.
Hdd led exfiltration is way faster
@@taktuscat4250 iirc that requires a line of sight on the led though? I may be misremembering.
@@ThatSkiFreak yes - or well-placed mirrors 😁
@@ThatSkiFreak yeah but the range and transfer speed is better
@@taktuscat4250 Fair enough
It's a bit misleading when you say "this exfiltration method doesn't need admin privileges and it can run in a VM". It's true but the malware still needs read access on the file that is to be exfiltrated, which, depending on the file, requires just as much admin privilege as for any other malware.
Its not really misleading. It valuable information to know that the exfil method itself doesnt need admin privileges and can run in a VM and is worth pointing out. If you can get information from a protected source another way, knowing that to get it out you dont need them is important. Its a big part to the whole hack.
It's a curious thing but, if you've already breached a computer, there are obviously more efficient ways to extract it's data and do whatever you want to do with that computer.
Depends on how you breached the airgap. If you got someone to fall for an USB stick, you got the code inside, but you aren't getting back the stick.
Ha ha, apple has saved us from the headphone psu attack. The foresight of them is stunning!
@TypicalX yeah I was being silly
Good one.
That power supply exploit is essentially the exact same thing as the Air-Gapped SATA cable exploit that was demonstrated about 6 months back. Seems to work as essentially the same principle.
I'm always a bit surprised to hear people think that getting malware onto air-gapped computers is a challenge: it really isn't, but data exfil *is*.
Physical security is often strong in such scenarios, so imaginative ways to exfil data is where you want the most options.
That said, at this attack's bitrate the target data would need to be something with a very small storage footprint, or a long dwell-time for the receiver.
My favorite way to do this on an air-gapped machine is using flashing qr codes.
Coming next: researchers find a way to control your computer by transmitting radio signals through a guitar
First item:
It's not quite true that the malware can run without enhanced priveleges. While the transmit side of it can run as a normal user, enhanced priveleges would be needed to access the required files (unless the machine owners were very stupid). In addition there would likely be a need to use some kind of escalation to actually install the malware in the first place
Your point about the bit rate being a limit on the usefulness means that the ideal use case for this would be if you could sneakily install a keyboard sniffer and pick up interesting passwords.
You can circumvent the scheduling issue if you have somewhere you can conceal the receiver nearby, in a drawer in the adjacent room perhaps?
It's an airgapped machine. Being on the machine at all can be regarded as a high level of privilege, but this is not the same as 'enhanced privileges'. The point is that this works without any tampering with the OS, or exploiting the OS into doing something it probably shouldn't be. Even if this machine stores nuclear codes, the OS files should require higher privileges, because making the nuclear codes readable is the whole point of this machine. People with legitimate access to those codes should not be messing with the OS, so should not have access to that. If everybody requires enhanced privileges to access the data on this machine, then you have lost all protections enhanced privileges get you.
It is not unusual for somebody to require access to run arbitrary data analysis programs on an airgapped machine, and these programs should not have the privileges to access keyboard inputs directly. The vast majority of programs should not need enhanced privileges. All you need to make this work is permission to run your own programs without elevated permissions, and that may not need an escalation.
For the same reason, the passwords for it are not likely to be particularly interesting. Best case is that they are the same the passwords the user has for some non airgapped machine, so it is quite possible you already have one of them and used them to get the malware onto a USB into the airgapped machine anyway. I guess that could get you a host of other useful high privilege passwords that could be used on the non airgapped network, but that seems an overly difficult way of doing that, not least because that definitely does require privilege escalation on the airgapped machine (unless someone is stupid enough to log on as admin for normal access, or you have got access through an admin doing admin tasks). It is like breaking into a nuclear silo to steal the payroll information.
It depends on a malware, running on the target. If you have rogue software running on your machine you probably have bigger problems than this PoC.
2:49 you can tell he's good by how he's serving his web-site without TLS
It is of little consequence whether or not the "s" is there after "http". The server can force encrypted connection regardless of what you write in the address field. Cannot check what would the case be as the website seems to be down.
@@anteshell It responds with an insecure redirect on port 80, times out on port 443. The page it redirects to is an academic server without proper HSTS. I'm going to stick to my original assessment.
Lol
This is an amazing study! I love all the Weird, almost Magical things that happen when you mess with power
Great now my computer need to practice social computing distancing😅.
Hence the COVID reference in the contrived name of the method, of course :)
Sounds a bit like: "Hey, give me your housekey, so I can unlock your frontdoor normally, collect all your valuable stuff in boxes and move them into the hallway, leave the door unlocked to come back later at a specific time and act like I broke in without any traces"....
2:39 What about powerplants or server rooms where air gaooed systems are not alone and other equipment emmits electromagnetic noise that can affect the received string?
0:31 I assume the COVID-bit name is because of the distance required to be in for the power supply exploit to work. Just like covid.
except it wasn't true for covid. Just a dumb name to cash in on a dead trend.
Nice work! I really enjoy your content! Thank you!
Thanks Mike, glad you like the vids :)
Just look up tempest attack. The idea to use power supply as a method is not completely new. But this is a new way to exfiltrate data. I guess this would only work, if you can precisely control the workload of a specific computer, and no other em sources nearby. If the same computer is running various other software, or there are other computers doing random tasks, this would be very hard or nearly impossible.
Reminds me of side channel attacks where you also observe an cryptographic device at things like the power consumption to break the encryption algorithm
Tempest attacks are similar but different.
At least according to the Wikipedia entry they focus on unintentional electromagnetic leakage: generating em leakage deliberately is taking that idea another notch further.
are there any other channels that post cyber security news like this one? i want more!
This technique is nothing more than a practical way (as it uses audio jack from a smartphone) of using Van Eck Phreaking (also called "Tempest"). In case of monitors and TVs, the irradiated frequencies are way above the audible frequencies (HF for VGA and UHF for HDMI) thus a more specialized equipment is needed (SDR dongles for tuning and directional antennas for better reception).
I saw this coming next when you showed the SATA cable hack. 😄
i think this technique could be useful if combined with a keylogger which sends the keystrokes via this technique to the attacker. furthermore you could use a mobile as a tunnel so the attacker does not need to be onsite all the time. idk how much power this hack draws on the mobile but maybe a powerbank could help. Stealth could be archived by e.g. putting the mobile and a powerbank behind a framed picture e.g. the logo of the company. This attack would be very hard for an outsider but could be performed as a insider who does not want to get caught, however hanging the picture might be suspisious but not impossible
4:30 It's also the browser frame in VS 2022
Me: 'I will only turn my pc on in a room of 5m x 5m so the magnetic waves could not go to the hacker. '
Very similar techniques (power analysis and power glitching) have been used since a very long time. Great for tricking bootloaders or extracting a few bytes from embedded systems, but not generally something to worry about
Great video😍
I guess we're at least one small step closer to an uncontrollable AI capable of escaping an air-gapped computer.
@Seytonic Do you plan on doing a video about the Flipper Zero ?
Just received mine yesterday and pretty crazy all the stuff you can do with it :)
a power supply to steal data, what the hell
I could imagine this being a issue with Corsair PSUs that have the Corsair link thingy on their PSU's.
It has COVID in the name because it works up to 2 meters
Quite amazing this power supply exploit, good coverage of interesting news from around the world in hacking field, happy subsriber.
Glad to hear it :)
Bruh, hacking from power supply? 🤣 This is another level of hack
9:00 HOLY SHIT A TH-camr is actually being sponsored by a useful, non scamming company that doesn't sell worthless titles or a bad VPN, *THIS DESPERATELY NEEDS TO BE IN THE NEWS* .
Tempest scanning isn't a novel concept and has been around since as early as the second world war. It has been adapted countless times to suit various needs, such as capturing video signals emanating from computer monitors and capturing signals radiating from telecommunication networks. The one solution that is simple and effective every time is to enclose your electronic devices within a faraday cage, and use shielded telecommunication lines.
Is it called Covid-bit because of the 2m distance? As in social distancing hahaha
Oh cool now my anxious ass needs to encapsulate my PSU in a faraday cage.
Hacker in 2069:
I've downloaded a victims file by exploiting his keyboard Caps. And I would like to call this technic *Jomama-Bin-Baiden*
The slow speed from the power supply switching shoudnt be a problem if you use it to somehow get data for faster connections like wifi or bluetooth, although those machines probably woudnt have that, but maybe you get an ip or something useful.
those hacks are getting funnier and funnier
wow this is very interesting, it's just crazy they can be done.
Obvious from the comments that everybody loves an Air-gap exploit (so well done on the title choice) but the biggest baddest scariest news here is that Word still uses I.E. with a hole in it!
and likely not just one hole
1:28 "HEY U STOLE MY PSU THATS NOT STEALING FILES" I have that exact power supply in my pc :D
Here's a crazy new way to exfiltrate data from and air-gaped PC: The hack would need to gain access to the PC to insert an USB stick into a slot and the using the keyboard and mouse, copy files to the USB stick. Slick, huh?
Why hasn't anyone thought of that?
Impossible. The air gape would shoot the USB stick out of the port, turning it into a projectile and killing the would-be attacker.
@@thelight3112 you are taking the p
This is mindblowing. Just mindblowing.
Wow, Internet Explorer is even late when it comes to Zero-days.
Bro i dont even give a crap anymore, last thing i needed to hear that my power supply can be used to hack my pc
The power supply exploit was discovered by the same guy who discovered gyroscopes can be used as microphones? Wow, I remember hearing about that one back in the day. It's cool that it's the same guy!
"IE is dead and no longer delivered out."
I.E.: "Explooiiits."
Maybe a tiny drone to be used as a middleman ? For these 2 metre technics ?
O.mg cable + airgapped computer = probably more practical exploit since you still need access to the computer.
This could mainly be used to identify the location of an air gapped pc which is running a honeypotted file.
No, not every computer power supply uses wtitching to adjust power...
There are switching power supplies (as mentioned) using transistors. There is DC-DC conversion, and quite a few more...
Mmhnnn true
Is Apple implying they have a database with millions of TBs of CP!?
good proof of concept ngl
Apple being Apple, I would not doubt it was already installed and running and that just user access to know it is running has not yet been implemented. That is my view of a company that does not allow user repair of even the charge port and force manufacturers to sign contracts to not sell parts directly to consumers.
Power supply hack has same energy as Renault F1 engine playing God Save the Queen by modulating the revving
How to enable end-to-end iCloud backups?
Can you make a video about how you can clean your pc from possible virus/malware
this is similar to an old exploit being actively used by an isralei IT company. i don't remember the name of the company just that i read an articel about 5-6 years ago. this is still fking terrifying...
Today they scan for CP.
Tomorrow, happy merchant images.
Everyone is oblivious to the fact that Google already does this on android devices whether you use cloud storage or not!
I saw this on a TV show years ago but with a graphics card instead.
Awesome video :》
These airgapped methods are daft if your that close to a pc to want to do that you’d just walk up to it and use it 😂
I feel like it was name COVID-bit to make it a more interesting headline
TEMPEST-derived red/black separations already protect gov/mil isolated systems from such an attack. Maybe it'd be functional in a real-world office setting, in an empty room, where you're allowed to bring your own devices nearby, and already have access to the terminal. But by that point blue team has already lost their battle.
Still, this is a pretty slick and novel approach, even if it never sees usage in the real world.
Coof-bit : what CPUs are vulnerable to this ?
I use older computers as they are pre-Intel-ME era and well mapped out ...
Wake up
Seytonic video
Yes
I suppose wouldn't work with a cheaper linear PSU... but neat concept.
Wen shielded SATA and power cables?
You should look at TempestSDR, which is more impressive
leakage from HDMI cables without encryption can be reconstructed using an SDR
Microsoft: “It’s a feature, not a vulnerability!”
All I know is that Apple needs something to compare those hashes, so somewhere Apple has a server full of CP to train their algorithms
You can hear what a phone is "doing" by holding it next to an electric guitar plugged into a solid state amp
yeah had that happen while using my chromebook to read midis
led monitor from camera seem more reliable , control load to force power usage seem more external factor
The Apple CSAM item
"The road to hell is paved with good intentions"
Anyone ever notice what the serpent used to tempt Eve and then Adam?
Yeah, because 2000 years ago, people writing down this humbug totally knew that at some point there was going to be a IT company named for a fruit, so, that makes it such a totally clever revelation. "HURR I tpyed soemthing funy un teh int0rwebz!"
@@Anvilshock more to the point, why did Steve Jobs pick the name for the company knowing that the name is culturally associated with a massive downfall resulting from too much knowledge?
I agree with you that back in the bronze age the original story makers did not predict Steve Jobs or computers; but equally I cannot believe that Steve Jobs grew up in the country he did without knowing the story and without also knowing that many of his compatriots believe it absolutely. That's the point I was making.
It's not clever to misread something just so you can ridicule it.
And on a pedantic point, the story was probably written down somewhat more than 2000 years ago, and appears to be from an even older oral tradition.
The Dead Sea Scrolls are the oldest copies we have of this story, and are scientifically dated to around 2300 years ago, but are known to be copies of older works. I mean "known" by archeologists using scientific dating methods, not simply asserted by believers as an act of faith.
@@trueriver1950 Humans are all too eager to see connections where there aren't any. Who knows? Maybe Jobs just wanted something that appears ahead of Atari in the phone book. So, kind of the Dead Sea scrolls of the seventies. I could ask you why you eat bread. Don't you know that Hitler ate bread? Come back when you have something more substantial to the discussion. Or don't. No rush.
@@Anvilshock I say the same to you. That's now two totally vacuous objections you've made to what was a minor joke, though in fairness you do get the record for the most imbecilic example of Godwin's law I've ever seen. I suppose that's funny in itself.
Have you got any more where they came from? if so please keep them to yourself because they are not relevant here. More importantly they are boring.
this is why i always keep my computer unplugged...
...hol up
So I guess now we need encrypted power supplies.
Is there a Patreon for your channel, Seytonic? The Cybersecurity news is always top notch and I'd love to support your efforts
Small amounts of radiation? I am crying!
From pain. Pain caused by SMPS RFI with analogic radio comms...
BTW, a PC will shart EMI in the mains lines detectable for miles. Just plug your phone :))
Airgapped systems still linked to mains power!
would need memekatz processing and dumping ONLY credentials to a file, then transmitting that file to make any real use of this
The NSA still uses "spot lights". Why wouldn't they use a technique like PSU or CPU modulation to send your private encryption keys or key stokes every second (well within bandwidth)? All you need is a phone or home assistant audio wire tap. You're under playing this exploit vector.
The NSA isn't using anything like this against a target with a phone and/or home assistant in the room. This is best suited for use against foreign governments or corporations.
At this point people are gonna trace your ip through a noctua fan
well i guess its a good thing that phones for rid of the headphone jack lol
Some people (these people specifically) have waaaaaaaaaay too much time on their hands
JScript is microsoft's implementation of Javascript, it says so in the screenshot you have at 4:49. ECMAScript === Javascript
but a powersupply has no chips for data transfer
How Apple would have gotten database or what database would Apple have?
while is may not be practical to exfiltrate entire files it could be practical to get passwords for example malware could reset the password making the user have to re login then capture the password and repeatedly like a beacon broadcast the password until the hacker can get it.
so the solution maybe to have some very high uf capacitors that can smooth out the demands on the power supply either have the large caps in the power supply or something that can be connected between the connectors and pc parts.
in a similar way that you may see in rc applications to smooth out the noise from the motors back into the receiver or something.
me: *laughs in laptop*