The increasing importance of information security has forced researchers to start literally thinking outside the box. The importance of the isolating systems as a form of high security control has lead to tests of the permeability of an air gap. there has been research into techniques by which data from an isolated system can by exfiltrated through radio waves, sound waves and light emitted from a system. A group of researchers approached testing the security of the air gap in a different way. They used sound to physically disrupt the operation of a system by inducing harmonic resonance in the disk platters of conventional hard disc drives. If you aren’t sure of what harmonic resonance is I recommend checking out this clip from of Professor Julius Sumner Miller explaining resonance to what I assumed was a wide-eyed and startled Australian audience back in 1969.
https://www.youtube.com/watch?v=C-Bn70PpbrM
Although I think that the Professors explanation is fascinating, if you are pressed for time just think about the tv trope of an opera singer breaking wine glasses. https://www.youtube.com/watch?v=z6oqPB07X3o
Hard disks are a little like a record player inside. At tiny head moves across the surface of a spinning circular disk reading information from magnetic tracks. these tracks are so fine however that a very small amount of unexpected movement in the disc would bump the head onto another track.
Finding the resonant frequency of the disc and causing it to vibrate could affect the operation of the drive, affecting the operation of the computer. This could allow an attacker to play a particular sound at a computer and cause it to malfunction.
A group of researchers from Princeton and Purdue Universities tested this novel form of attack and found that it was possible, writing up the results in the paper “Acoustic Denial of Service Attacks on HDDs”. Even short bursts of sound of less than 5 second could affect the operation of a system and longer bursts could cause system failures. This research shows the importance of including the physical environment in the development of information security planning. I don’t think this is going to become a huge threat. The frequency of the sound required are inside the normal range of human hearing, which limits the usefulness of the technique for a surreptitious attacker. I tried producing some of frequencies mentioned and I couldn’t get anywhere near the volume they mentioned without the sound being painfully obvious. Furthermore, the required placement and power of the sound source for an effective attack appear to be quite limiting. That said though, in some cases there could be applications in environments that are generally autonomous or are high noise environments such as factories; and I would hope that security planners for these environments be aware of this research.
In case you were curious like I was the frequencies that they identified were different from the standard frequencies for fire alarms. I don’t know if this was a conscious effort from manufacturers or if there are other drives that were not tested which are.
This research is important in expanding the range of threats that are considered when planning security in terms of engineering a physical environment that considers resonant frequencies and the threat sound can present to the reliable operation of systems.
Cite:
Shahrad, M., Mosenia, A., Song, L., Chiang, M., Wentzlaff, D., & Mittal, P. (2017). Acoustic Denial of Service Attacks on HDDs. arXiv preprint arXiv:1712.07816.
Source:
