Attackers Can Use HVAC Systems to Control Malware on Air-Gapped Networks

[biffzinker]

Heating, ventilation, and air conditioning (HVAC) systems can be used as a means to bridge air-gapped networks with the outside world, allowing remote attackers to send commands to malware placed inside a target’s isolated network.

This type of attack scenario — codenamed HVACKer by its creators — relies on custom-built malware that is capable of interacting with a computer’s thermal sensors to read temperature variations and convert these fluctuations into zeros and ones — binary code.

The malware, already installed on a computer on an isolated network with no Internet access, reads the temperature variations created by the HVAC system and converts the received thermal signals into malicious operations.

Source: Bleeping Computer

Edit:

According to tests carried out by the research team, they were able to send data inside an air-gapped network via HVAC systems at bit rates of 40 bits per second, a more than acceptable transmission speed.

How could they manage to obtain a transfer rate of 40 bits per second? Seems highly improbable.

 

[Papahyooie]

Pretty cool "proof of concept" and definitely qualifies as a hack! That being said... the transfer rate would be abysmally slow... you'd have to send a single bit at a time, and each bit would take several minutes, depending on the size of the room and the size of the A/C unit. Plus there's the fact that you'd have to already have said malware installed on said air-gapped system, which would require you to physically be there at some point in the past... I imagine it being Mission: Impossible - style myself... lol.

 

[R-T-B]

How could they manage to obtain a transfer rate of 40 bits per second? Seems highly improbable.

It's not improbable if you consider the insanely long latency involved. That would be the big deal.

 

[Papahyooie]

It's not improbable if you consider the insanely long latency involved. That would be the big deal.

I think he was saying it was improbable that it would be that fast. 40 bits per second? That's extremely fast for an HVAC system to change the temp in a room... I'd say physically impossible. It simply isn't possible to change the temperature in a room (enough for a PC to detect it,) that fast. Assuming you had a full custom firmware on the thermostat, you might be able to transfer a single bit in a couple of minutes. But realistically, "normal" HVAC systems these days have 5 to 10 minute delays between on/off to help keep the pressures at safe levels and to avoid the system getting out of whack and freezing up (as they will do if the A/C is on, but the fan is not. I used to be an HVAC technician.)

40 bits per second? They'd have to have the "PC" open-faced, laying inside the ductwork, with a custom heating/cooling system that could handle switching that fast, and blast the bare motherboard with severe alternating heat/cold. If they got 40 bits per second, it was in a custom lab setup. In the real world... I'd say a single bit per 10 minutes would be about realistic.