PIXHELL Attack: Leaking Sensitive Information from Air-Gap Computers via `Singing Pixels'

TL;DR

The test shows that with a PIXHELL attack, textual and binary data can be exfiltrated from air-gapped, audio-gapped computers at a distance of 2m via sound modulated from LCD screens.

Abstract

Air-gapped systems are disconnected from the Internet and other networks because they contain or process sensitive data. However, it is known that attackers can use computer speakers to leak data via sound to circumvent the air-gap defense. To cope with this threat, when highly sensitive data is involved, the prohibition of loudspeakers or audio hardware might be enforced. This measure is known as an `audio gap'. In this paper, we present PIXHELL, a new type of covert channel attack allowing hackers to leak information via noise generated by the pixels on the screen. No audio hardware or loudspeakers is required. Malware in the air-gap and audio-gap computers generates crafted pixel patterns that produce noise in the frequency range of 0 - 22 kHz. The malicious code exploits the sound generated by coils and capacitors to control the frequencies emanating from the screen. Acoustic signals can encode and transmit sensitive information. We present the adversarial attack model, cover related work, and provide technical background. We discuss bitmap generation and correlated acoustic signals and provide implementation details on the modulation and demodulation process. We evaluated the covert channel on various screens and tested it with different types of information. We also discuss \textit{evasion and stealth} using low-brightness patterns that appear like black, turned-off screens. Finally, we propose a set of countermeasures. Our test shows that with a PIXHELL attack, textual and binary data can be exfiltrated from air-gapped, audio-gapped computers at a distance of 2m via sound modulated from LCD screens.

Figures (11)

• Figure 1: Attack scenario. A malware infection on the compromised computer (A) encodes information and uses crafted pixel patterns to exfiltrate it over the emanated acoustic signals. A nearby laptop computer receives the signals, decodes them, and sends them to the attacker.
• Figure 2: Four bitmap patterns generated on the screen with the signal generation algorithm, modulating an acoustic signal at 5000 Hz, 10000 Hz, 15000 Hz, and 20000 Hz.
• Figure 3: Spectrogram of a packet received by a nearby smartphone.
• Figure 4: Chirp acoustic signal from four LCD screens
• Figure 5: FSK (left) and OFDM (right).