POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers

It is known that attackers can exfiltrate data from air-gapped computers\nthrough their speakers via sonic and ultrasonic waves. To eliminate the threat\nof such acoustic covert channels in sensitive systems, audio hardware can be\ndisabled and the use of loudspeakers can be strictly forbidden. Such audio-less\nsystems are considered to be \\textit{audio-gapped}, and hence immune to\nacoustic covert channels.\n In this paper, we introduce a technique that enable attackers leak data\nacoustically from air-gapped and audio-gapped systems. Our developed malware\ncan exploit the computer power supply unit (PSU) to play sounds and use it as\nan out-of-band, secondary speaker with limited capabilities. The malicious code\nmanipulates the internal \\textit{switching frequency} of the power supply and\nhence controls the sound waveforms generated from its capacitors and\ntransformers. Our technique enables producing audio tones in a frequency band\nof 0-24khz and playing audio streams (e.g., WAV) from a computer power supply\nwithout the need for audio hardware or speakers. Binary data (files,\nkeylogging, encryption keys, etc.) can be modulated over the acoustic signals\nand sent to a nearby receiver (e.g., smartphone). We show that our technique\nworks with various types of systems: PC workstations and servers, as well as\nembedded systems and IoT devices that have no audio hardware at all. We provide\ntechnical background and discuss implementation details such as signal\ngeneration and data modulation. We show that the POWER-SUPPLaY code can operate\nfrom an ordinary user-mode process and doesn't need any hardware access or\nspecial privileges. Our evaluation shows that using POWER-SUPPLaY, sensitive\ndata can be exfiltrated from air-gapped and audio-gapped systems from a\ndistance of five meters away at a maximal bit rates of 50 bit/sec.\n