Cybersecurity researchers have demonstrated a covert channel that could allow malware to extract sensitive information from air-gapped computers by manipulating USB power-management settings and observing the resulting signals.
Called SPECTER, the technique was developed by Hyeongjun Choi, Ji Hyuk Jung, and Ji Won Yoon of Korea University in Seoul, South Korea. Their research explores how routine USB control operations can transmit information even when conventional network connections are unavailable.
Turning USB Control Operations Into Signals
Air-gapped systems are physically isolated from external networks to reduce the risk of unauthorized data transfers. However, if an attacker compromises a machine, alternative communication paths may still be available.
SPECTER requires malware to have root or administrator privileges on the compromised host. It encodes information through USB power-management or device-state operations without placing the payload in USB data transfers. The technique involves modifications to peripheral hardware or firmware.
Three Ways to Recover Data
The researchers tested SPECTER on Windows 10 and Ubuntu 22.04, demonstrating three alternative ways to recover the signals.
One method uses smartphone charging states. Researchers used an Android app to read battery-status updates from a Samsung Galaxy S22 running Android 14. On an iPhone 13 Pro running iOS 17.4.1, they watched the on-screen charging indicator instead. The reported signaling rates were 0.2 bits per second on Ubuntu and 0.25 bits per second on Windows for both phones.
They also tested whether changes in USB peripherals could carry the signal. On a Windows laptop, a mouse stopped responding and its LED turned off when disabled, supporting signaling at 1 bit per second. A webcam and USB hub also produced usable signals at 0.25 bits per second.
Researchers did not obtain usable channels with the tested keyboard or headset dongle configurations. None of the tested peripherals produced a usable channel on the Ubuntu desktop, showing that results depend on the host and hardware configuration.
The third method detects near-field electromagnetic activity associated with USB control operations. Using a HackRF One software-defined radio and an LF-R 400 loop antenna in direct contact with the USB cable, the researchers captured signals near 5 MHz. The experiments did not establish reliable reception at a distance.
Low Speeds Limit the Threat
At these rates, SPECTER is unsuitable for transferring large amounts of data. Its potential use lies in extracting short, valuable secrets, such as credentials, authentication tokens or cryptographic keys. However, the experiments do not establish a general error rate or reliable reception at a distance for the RF method.
The findings also highlight limitations to the technique’s stealth. USB control operations can trigger charging notifications, screen activity or interruptions to connected peripherals, depending on the configuration.
Researchers recommend treating USB power-management and device-state events as security-relevant telemetry. Monitoring repeated device enable, disable, suspend and resume operations could help identify suspicious activity, although the effectiveness of such detection remains to be evaluated.
The full research paper is available on arXiv.
