Covid-bit mechanism uses harmful software installed on a computer to generate electromagnetic radiation in the frequency range of 0-60 kHz, which is then captured by an inconspicuous receiver located at a distance of 2 m. Covid-bit technology is designed this year and is designed for overcoming air gaps (Air GAP) and collection of confidential data.
Air gap networks, despite their high level of isolation, can be compromised in various ways – using an infected USB drive or the attack on the supply chain. Due to the fact that the isolated systems are not connected to the Internet, the attacker must develop a special method for delivering stolen information.
COVID-bit is a hidden channel that is used by a malicious program to transmit data using EM pulse power supply (SMPS) and frequency manipulation (FSK) for coding binary data. “By adjusting the working load of the CPU, you can control its energy consumption and, therefore, monitor the instant frequency of switching the component SMPS”, – explains the developer of the technology dr. Guri.
AMI can be taken at a distance using antennas worth $ 1, which can be connected to a 3.5-mm audio radiation of a phone for capturing low-frequency signals with a bandwidth strip of 1000 bits/s. Then the radiation of demodulation is to extract data. At the same time, malicious code does not require increased privileges and can be made of a virtual machine.
Assessment of data speed shows that keystrokes can be captured almost in real time, and the exploitation of IP and MAC addresses takes from 0.1 to 16 seconds, depending on the data transfer rate.
To protect against such an attack, you need:
- conduct a dynamic analysis of the codes of operations to identify threats;
- initiate random workloads on processors when abnormal activity is detected;
- monitoring or mocking signals in the range of 0-60 kHz.