PowerBridge: Covert Air-Gap Exfiltration/Infiltration via Smart Plug
Source abstract
Abstract
Power lines are commonly utilized for energy transmission, and they serve as a conduit for data exfiltration or infiltration in some specific scenarios. This paper explores the feasibility of establishing bidirectional communication between a modified plug and the equipment power line within an air-gapped network organization and with external entities. Bidirectional air-gap communication includes two scenarios, the data leak from air-gapped networks and the transmission of external data to air-gapped networks, namely, exfiltration and infiltration. In the exfiltration scenario, software in the air-gapped networks modulates and encodes data by manipulating the power consumption of the equipment during transmission, which is then sent outside through the power line. The device utilizes a smart plug power meter to record current fluctuations and subsequently decode any leaked data. In the infiltration scenario, a smart plug is used to control the power supply status of a device’s power cord, enabling data encoding and decoding by turning the power supply on and off. The software in the air-gapped equipment captures and decodes the power supply status to infiltrate. We discuss relevant literature and provide scientific background on smart plugs and power line communication. We simulate the communication scenario, propose a communication scheme, and present data modulation techniques as well as a communication transmission protocol for air-gap channels. Our evaluation of the PowerBridge air-gap channels demonstrates that data can leak from the air-gapped computer into the power line at an approximate rate of 30 bps, which can be captured by the smart plug. Additionally, it is possible for data to penetrate from the smart plug into air-gapped networks at a speed exceeding 1 bps.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Smart Grid Security and Resilience · Power Line Communications and Noise · Physical Unclonable Functions (PUFs) and Hardware Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei 230037, China
References (50)
Show source-provided references
1. Nagendran, K., Balaji, S., Raj, B.A., Chanthrika, P., and Amirthaa, R.G. (2020, January 6–7). Web Application Firewall Evasion Techniques. Proceedings of the 2020 6th International Conference on Advanced Computing and Communication Systems (ICACCS), Coimbatore, India.10.1109/ICACCS48705.2020.9074217 ↗
2. Michener, D.R.J. (2024, June 25). Beating the Air-Gap: How Attackers Can Gain Access to Supposedly Isolated Systems. Available online: https://energycentral.com/c/iu/beating-air-gap-how-attackers-can-gain-access-supposedly-isolated-systems.
3. Elsadig, M.A., and Fadlalla, Y.A. (2017, January 8–11). Network Protocol Covert Channels: Countermeasures Techniques. Proceedings of the 2017 9th IEEE-GCC Conference and Exhibition (GCCCE), Manama, Bahrain.10.1109/IEEEGCC.2017.8447997 ↗
4. Shen, C., Liu, T., Huang, J., and Tan, R. (2021, January 24–27). When LoRa Meets EMR: Electromagnetic Covert Channels Can Be Super Resilient. Proceedings of the 2021 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP40001.2021.00031 ↗
5. ThermalBleed: A Practical Thermal Side-Channel Attack10.1109/ACCESS.2022.3156596 ↗
6. Sherry, R., Bayne, E., and McLuskie, D. (2023). Near-Ultrasonic Covert Channels Using Software-Defined Radio Techniques. Proceedings of the International Conference on Cybersecurity, Situational Awareness and Social Media, Springer. Springer Proceedings in Complexity.10.1007/978-981-19-6414-5_10 ↗
7. PowerHammer: Exfiltrating data from air-gapped computers through power lines10.1109/TIFS.2019.2952257 ↗
8. Cronin, P., Gouert, C., Mouris, D., Tsoutsos, N.G., and Yang, C. (2019, January 17–20). Covert data exfiltration using light and power channels. Proceedings of the 2019 IEEE 37th International Conference on Computer Design (ICCD), Abu Dhabi, United Arab Emirates.10.1109/ICCD46524.2019.00045 ↗
9. Vulnerability studies and security postures of IoT devices: A smart home case study10.1109/JIOT.2020.2983983 ↗
10. Potential Risk of IoT Device Supporting IR Remote Control10.1016/j.comnet.2018.11.014 ↗
11. Security vulnerabilities of internet of things: A case study of the smart plug system10.1109/JIOT.2017.2707465 ↗
12. Leaky noise: New side-channel attack vectors in mixed-signal IoT devices10.46586/tches.v2019.i3.305-339 ↗
13. (2024, May 03). New Security Signals Study Shows Firmware Attacks on the Rise. Available online: https://www.microsoft.com/en-us/security/blog/2021/03/30/new-security-signals-study-shows-firmware-attacks-on-the-rise-heres-how-microsoft-is-working-to-help-eliminate-this-entire-class-of-threats/.
14. (2024, May 03). McAfee: Discovers New IoT Vulnerability in Wemo Insight Smart Plugs. Available online: https://www.mcafee.com/blogs/internet-security/wemo-vulnerability.
15. Iqbal, A., Olegård, J., Ghimire, R., Jamshir, S., and Shalaginov, A. (2020, January 10–13). Smart Home Forensics: An Exploratory Study on Smart Plug Forensic Analysis. Proceedings of the 2020 IEEE International Conference on Big Data (Big Data), Atlanta, GA, USA.10.1109/BigData50022.2020.9378183 ↗
16. Alerts Correlation and Causal Analysis for APT Based Cyber Attack Detection10.1109/ACCESS.2020.3021499 ↗
17. Cyber-terrorism in a post-stuxnet world10.1016/j.orbis.2014.11.009 ↗
18. (2024, May 03). Rhysida Ransomware Leaks documents Stolen from Chilean Army. Available online: https://www.bleepingcomputer.com/news/security/rhysida-ransomware-leaks-documents-stolen-from-chilean-army/.
19. (2024, May 03). PCI Express. Available online: https://www.intel.com/content/dam/doc/white-paper/pci-express-architecture-power-management-rev-1-1-paper.pdf.
20. (2024, May 03). Powercfg Command-Line Options. Available online: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options.
21. A comprehensive study on APT attacks and countermeasures for future networks and communications: Challenges and solutions10.1007/s11227-016-1850-4 ↗
22. An internet of things-based smart energy meter for monitoring device-level consumption of energy10.1016/j.compeleceng.2020.106772 ↗
23. Zhan, Z., Zhang, Z., and Koutsoukos, X. (2020, January 7–11). BitJabber: The World’s Fastest Electromagnetic Covert Channel. Proceedings of the 2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), San Jose, CA, USA.10.1109/HOST45689.2020.9300268 ↗
24. AIR-FI: Leaking Data from Air-Gapped Computers Using Wi-Fi Frequencies
25. Fritsch, L., Hassan, I., and Paintsil, E. (2024). RAMBO: Leaking Secrets from Air-Gap Computers bySpelling Covert Radio Signals from Computer RAM. Secure IT Systems. NordSec 2023. Lecture Notes in Computer Science, Springer.
26. Exfiltrating Data from Air-Gapped Computers via ViBrAtIoNs10.1016/j.future.2021.03.025 ↗
27. Sako, K., Schneider, S., and Ryan, P. (2019). A Framework for Evaluating Security in the Presence of Signal Injection Attacks. Computer Security—ESORICS 2019. ESORICS 2019. Lecture Notes in Computer Science, Springer.10.1007/978-3-030-29962-0 ↗
28. InkFiltration: Using Inkjet Printers for Acoustic Data Exfiltration from Air-Gapped Networks10.1145/3510583 ↗
29. Kühnapfel, N., Preußler, S., Noppel, M., Schneider, T., Rieck, K., and Wressnegger, C. (2021, January 6–10). LaserShark: Establishing Fast, Bidirectional Communication into Air-Gapped Systems. Proceedings of the 37th Annual Computer Security Applications Conference, Virtual.10.1145/3485832.3485911 ↗
30. Guri, M. (2022, January 27–29). ETHERLED: Sending Covert Morse Signals from Air-Gapped Devices via Network Card (NIC) LEDs. Proceedings of the 2022 IEEE International Conference on Cyber Security and Resilience (CSR), Rhodes, Greece.10.1109/CSR54599.2022.9850284 ↗
31. Schlauder, B., Tremblay, C., and Johnson, D. (2023, January 1–3). CD-Blink: An External Disk Drive Based Covert Channel. Proceedings of the 10th International Conference on Control, Dynamic Systems, and Robotics (CDSR 2023), Ottawa, ON, Canada.10.11159/cdsr23.196 ↗
32. POWER-SUPPLaY: Leaking Sensitive Data From Air-Gapped, Audio-Gapped Systems by Turning the Power Supplies into Speakers10.1109/TDSC.2021.3133406 ↗
33. A survey on smart grid technologies and applications10.1016/j.renene.2019.08.092 ↗
34. (2024, May 03). Huge demands for Power Line Carrier Communication Chip Market 2022-Growing Rapidly with Latest Trends and Future scope. Available online: Https://www.openpr.com/news/2751815/huge-demands-for-power-line-carrier-communication-chip-market.
35. (2024, May 03). Smart Plug Market. Available online: https://www.globenewswire.com/news-release/2023/02/16/2610148/0/en/Smart-Plug-Market-Size-Worth-USD-9-24-Billion-by-2030-Growing-at-a-CAGR-of-26-1-during-the-forecast-period-2023-2030-Data-By-Contrive-Datum-Insights.html.
36. (2024, May 03). Smart Plug Market. Available online: https://www.grandviewresearch.com/industry-analysis/smart-plug-market.
37. IoT-enabled smart plug10.1007/s11277-020-07043-5 ↗
38. Chen, L., Mitchell, C.J., and Martin, A. (2009). ACPI: Design Principles and Concerns. Trusted Computing. Trust 2009. Lecture Notes in Computer Science, Springer.10.1007/978-3-642-00587-9 ↗
39. (2024, May 03). ACPI System Management Bus Interface Specification. Available online: https://uefi.org/htmlspecs/ACPI_Spec_6_4_html/13_ACPI_System_Mgmt_Bus_Interface_Spec/ACPI_Sys_Mgmt_Bus_Interface_Specification.html.
40. (2024, May 03). Patent Information. Available online: https://www.163.com/dy/article/FJGROJ230511RIVP.html.
41. Sun, Y., Agostini, N.B., Dong, S., and Kaeli, D. (2019). Summarizing CPU and GPU Design Trends with Product Data. arXiv.
42. Zhang, H., Yang, L.-L., and Hanzo, L. (2016, January 15–18). LDPC-Coded Index-Modulation Aided OFDM for In-Vehicle Power Line Communications. Proceedings of the 2016 IEEE 83rd Vehicular Technology Conference (VTC Spring), Nanjing, China.10.1109/VTCSpring.2016.7504318 ↗
43. (2024, May 03). Modulation Mode. Available online: https://baike.baidu.com/item/%E8%B0%83%E5%88%B6%E6%96%B9%E5%BC%8F/8971326.
44. Simultaneous realization of laser ranging and communication based on dual-pulse interval modulation
45. On sharing secrets and Reed-Solomon codes10.1145/358746.358762 ↗
46. Cyber-enabled burglary of smart homes10.1016/j.cose.2021.102418 ↗
47. Noise-shaping techniques applied to switched-capacitor voltage regulators10.1109/JSSC.2004.840986 ↗
48. Bhushan, S., and Yaduvanshi, R.S. (2022, January 18–20). Cylindrical Dielectric Resonator Antenna for WiFi Jammer for blocking WiFi calls at prison. Proceedings of the 2022 IEEE 6th Conference on Information and Communication Technology (CICT), Gwalior, India.10.1109/CICT56698.2022.9997924 ↗
49. Inaudible sound covert channel with anti-jamming capability: Attacks vs. countermeasure10.1016/j.jnlest.2022.100181 ↗
50. (2024, May 03). Schloeder-EMV: Magnetic Field Generator and Analyzer. Available online: https://www.schloeder-emc.com/emc-products/emc-test-and-measurement-system/emc-generators-measurement-systems/magnetic-field-generator-and-analyzer-1.html.