Computers can covertly communicate via audio signals

Michael Hanspach confirmed media coverage on the topic in a radio interview with Hessischer Rundfunk yesterday. Hanspach and his colleague had successfully transmitted data from one computer to another without providing a connection via wireless LAN, network cards or the internet. This was made possible through audio signals emitted from a loudspeaker and received by a microphone.

In an experiment that was published in the Journal of Communications in November Michael Hanspach and Michael Goetz studied how computers can connect to each other in an inaudible acoustic network and exchange data. In the mesh network the computers were not connected to a central access point or router which would be the case in a conventional wireless LAN network.

The scientists chose a near ultrasonic frequency range. The results of the experiment: The computers communicated with each other within a range of up to 20 m (19.7 meters, 64.6 feet) using their built-in loudspeakers and microphones.

That wasn't all: In the experiment which involved five computers the signals could be transmitted from one computer to another until one computer with a regular internet connection took the signal “outside”.

This result might also be achieved with smartphones or tablets, says Michael Hanspach. Would it be possible to infect computers with malware this way? Hanspach is sceptical that the malware “badBIOS” exists in the manner that was discussed in the technology news articles of the past weeks. However, what sounds like science fiction today might well be reality in five years, the scientist says. The danger from an audio botnet would be considerable. This applies to critical infrastructures, for example.

Update to original German press release:
Fraunhofer FKIE is actively involved in information security research.
Our mission is to strengthen security by the means of early detection and
prevention of potential threats. The research on acoustical mesh networks
in air was aimed at demonstrating the upcoming threat of covert
communication technologies.
Fraunhofer FKIE does not develop any malware or viruses and the presented
proof-of-concept does not spread to other computing systems, but
constitutes only a covert communication channel between hypothetical
instantiations of a malware.
The ultimate goal of the presented research project is to raise awareness
for these kinds of attacks, and to deliver appropriate countermeasures to
our customers.
Weitere Informationen:
http://arstechnica.com/security/2013/12/scientist-developed-malware-covertly-jumps-air-gaps-using-inaudible-sound/

– arstechnica on the article by Michael Hanspach and Michael Goetz

http://www.heise.de/security/meldung/Supertrojaner-BadBIOS-Unwahrscheinlich-aber
– Heise online on BadBIOS
http://www.zeit.de/digital/internet/2013-11/badbios-supervirus-debatte
– ZEIT online on BadBIOS