The Researchers from Ben-Gurion University which is in Israel, have discovered an all new and novel method of using USB connectors to the steal data from air-gapped computers without any need of special radio-transmitting hardware attached to the USB.
This attack makes use of the scenario in which the computer is infected with a malware they’ve created called USBee.
According to the researchers, the NSA cyber-weapons have inspired them to make this happen, namely, the COTTONMOUTH hardware implant which is included in a catalog of NSA hacking tools which are leaked by Edward Snowden via the DerSpiegel German newspaper.
USBee is kind of superior to the COTTONMOUTH, as it does not require an NSA agent to smuggle a modified USB dongle/connector/thumb drive into the location from where they wish to steal data, nor does it require implants in USB firmware and drivers to work.
The malware created by the researchers can be spread like any other regular computer malware. Once it reaches a high-value target, it will work with any USB connector that is plugged into the computer, regardless if it is an USB thumb drive, dongle, or cable interconnecting the PC to a nearby device.
To put it up in simple words, the USBee malware attacks and sends hidden commands to USB connector’s data bus, which will in turn give out electromagnetic emissions as it is processing the commands.
The researchers have found a series of operations that made the USB’s data bus give off electromagnetic emissions at two very different frequencies, which they will use to represent binary “1” and “0.”
So, the malware takes information it has to steal, breaks it down to its 1-s and 0-es, and then transmits the data via USB connector, to a nearby radio antenna which is the receiver.
