This project was inspired by some lunchtime jokes and I ended up examining whether an air-gapped computer could create a detectable radio-frequency signal without using any kind of network connection, Wi-Fi, or Bluetooth. The concept relies on controlled changes in CPU workload. I actually found some previous work on this topic here. The basic premise is that when the computer’s processor shifts between idle and active, its power demand changes quickly. The motherboard’s voltage regulator module responds to those changes, and that higher electrical activity produces weak electromagnetic emissions. Using a software defined radio, I captured these emissions by monitoring the RF spectrum and I used waterfall analysis to look for the repeated signal changes.

Before transmission, the message is encrypted and converted into a binary stream. The system then represented each bit through timed on/off CPU activity: a high workload interval represented a binary one, while a low workload interval represented a binary 0. This is a form of on-off keying. The important distinction is that the on/off pattern carries the data. The receiver captured the RF activity, identified the timing pattern, reconstructed the sequence of ones and zeroes, and then decrypted the recovered payload.

The project was done as a proof of concept and focused mainly on how consistent I could get the signal to be so that capture quality and accuracy was highly usable. The results showed me that hardware activity normally assumed to remain inside a computer can definitely leave a measurable signature in the RF spectrum. From a defensive standpoint, the work highlights why air-gapped systems still use layered protections such as physical access controls, and at times electromagnetic shielding if necessary but more importantly it solidifies for me at least why security controls designed around the equipment’s suppliers exist.

It did open a few other questions for me though. Namely, can this particular problem be defeated without needing to know about it’s occurrence? The final reasoning behind why anyone would want to use this intrusion pathway is to achieve permanent undetectable persistence. Since this is technically a supply chain issue or a physical access issue because the malware cannot be deployed onto the computer once it is already in the offline lab. So you have to install the malware either through someone physically accessing the building the computer is at or you would have to install the malware onto the computer before it goes into the offline lab. Which brings me back to my question, can the lab defeat this malware without having to know that the attack happened? The answer is a very easy yes. Use Radio Jamming systems to fill all radio frequencies within the room, or use RF shielded boxes for whatever your testing.