Technical details .

Information leakage can be done via electromagnetic waves. 
In this method, malware causes electromagnetic emissions from various computer components such as buses, cables and processors. 
The data is modulated , these signals are transmitted to the environment, where a potential radio receiver receives the data, processes it and demodulates it.

Let's talk about SATA cables themselves, and what they are

SATA is a bus interface for connecting storage devices such as hard drives, HDDs, SSDs and CD/DVDs to a computer. 

SATA cables are two-ended 7-pin cables consisting of ground, transmit and receive. The ends are usually made at a 90 degree angle (for easier handling).
It connects the SATA port on the motherboard to the storage device.
The SATA power connector is +3.3 VDC, +5 VDC and +12 VDC.

Now I want to describe the electromagnetic signal generation and data transfer protocol of the SATA interface.
The SATA cable is used as an antenna to emit electromagnetic signals .

Emitted from the SATA interface electromagnetic radiation is about 6 GHz, it comes from a sequence of reading and writing signals. 

SATA 3.0 cables emit signals in different frequency bands: 1GHz, 2.5GHz, 3.9GHz and +6GHz. However, the most significant correlation with data transmission is observed in the range from 5.9995 GHz
Since the covert channel based on electromagnetic radiation is unidirectional, we transmit data in the form of data frames of fixed length.

Each frame begins with four alternating '1010' bits to transmit the frame preamble. The frame preamble allows attackers to synchronize with the transmission. The preamble is followed by a 16-bit payload

Most often, the data is received by some receiver, it can be implemented as a process in a neighboring computer or embedded in our computer.
It samples continuously from 5.9 GHz to 6 GHz and performs a raw fast Fourier transform (FFT), then the preamble is detected and the payload and our data are extracted.

If you criticize, suggest it! 🗝
I want to discuss different countermeasures to this kind of hacks🔮
To prevent the first phase(penetration) of airgap, you should use several layers of security in your network, including firewalls, intrusion detection and prevention systems, network traffic analysis and access control mechanisms.

For the second phase (data transmission) the most trivial is to prohibit the use of radios at the protected sites.


Another approach is to use an external RF monitoring system to detect anomalies in the 6 GHz band in the vicinity of the transmitting computer. 

However, this approach is likely to suffer from false alarms. In order to detect a signal, the system must know the specific waveform and modulation used.
There is still jamming that can be done from the operating system by performing random read and write operations when suspicious covert channel activity is detected.

As a summary I can say

This attack, although partly difficult to carry out, but this attack is very attractive to attackers, so it occurs because of the prevalence of SATA in daily life, so be vigilant and observe countermeasures. 🪄
For a demonstration of the attack itself you can watch this video link

I also advise you to read the two articles in the archive below . ⭐️
The first one will explain exactly this attack with more technical details and an assessment of this vulnerability. 
The second will give the whole story about the covert channel attacks on Air-Gap. 

That will be all. Thank you for reading❤️

And remember, if you are in the looking glass tiger lilies and other flowers can also speak🥀💐
#SATA #attacks #polymorphic #wireless_hacking #air_gap #covert_channels