A proof-of-concept
idea, which allows a person to send and receive data from a machine
that has been kept completely isolated from the internet has been
developed by researchers at the Ben Gurion University in Israel. This
technique sends information from the machine to a mobile device,
specially set up for this activity and later transfers that data to
the outside world using normal modes of communications like
internet/sms etc.

“With
appropriate software, compatible radio signals can be produced by a
compromised computer, utilizing the electromagnetic radiation
associated with the video display adapter. This combination, of a
transmitter with a widely used mobile receiver, creates a potential
covert channel that is not being monitored by ordinary security
instrumentation,” the experts wrote in a paper published on
Wednesday.

The attack has
four main steps: getting the piece of malware onto the isolated
computer, installing malicious code on one or more mobile phones,
setting up a command and control (C&C) channel with the infected
mobile device, and transmitting signals emanated by the isolated
computer back to the attacker.

The malware that’s
installed on the mobile phone uses the device’s FM radio receiver to
pick up signals, which have been modulated with sensitive
information, sent by the malware on the isolated computer through the
monitor’s cable. Once the data is sent to the phone, it can be
forwarded to the attackers via the Internet or SMS messages.

AirHopper
demonstrates how textual and binary data can be exfiltrated from
physically a isolated computer to mobile phones at a distance of 1-7
meters, with effective bandwidth of 13-60 Bps (Bytes per second).
Enough to steal your secret password.