Paranojiškas arba pasiruošęs? Šnipai ant jūsų stalo

Paprastai sulaukiu klausimų, kodėl nešiojamuosiuose kompiuteriuose ir telefone turiu lipduką ant aplinkos šviesos jutiklių. Kai kurie mano, kad nežinau skirtumo tarp šviesos jutiklio ir fotoaparato, ir bando man paaiškinti, kad tai nėra fotoaparatas. What they don’t know is that ambient light sensors can be used with machine learning methods to extract data like they are weak cameras.

I generally hear from people: “But we have nothing to hide!” Well, you have more to hide than you think, and your data can be combined with other data collected from you elsewhere to produce intelligence at a level you can’t even imagine possible. And those who collect the data are not necessarily those with right intentions. Your data can be collected by different threat actors to be analyzed using AI and be used for different purposes and intentions.

In cybersecurity, we assume that if a type of attack is possible and there is an opportunity to perform an attack, then there might be motive to perform those attacks. Mes nepriimame, kad tie, kurie gali rinkti duomenis, visada turi teisėtą priežastį juos rinkti. Mes taip pat nepriimame, kad tik viena šalis ar institucija išnaudoja pažeidžiamumą duomenims rinkti.

Žemiau pateikiamas kitų dalykų sąrašas, kurie gali būti naudojami jus šnipinėti ir apie kuriuos greičiausiai nežinote, kad jie turi tokias galimybes.

Jūsų televizoriaus garsiakalbis gali jus girdėti

Aš esu vienas iš tų, kurie paprastai renkatės televizoriaus modelį be mikrofono ar kameros, arba fiziškai pašalinu šiuos įrenginius. Taip pat turiu namų ugniasienę ir saugią vidinę tinklo infrastruktūrą, tačiau per daugelį metų išmokau nepasitikėti tik loginiais valdikliais. Vis dėlto, remiantis WikiLeaks leidimu 2017 ir dokumentais iš 2014, CIA (bendradarbiaujant su MI5) tam tikruose televizorių modeliuose paversti garsiakalbiai mikrofonais duomenims rinkti. They even developed a fake off mode to show that the TV is off when they collect those conversations. If you think your TV might listen to your conversation, it is better to unplug it when not in use. It also saves you some energy because plugged devices even while not in use may consume some electricity.

Your tablet or laptop light sensor can capture your hand or your image

I always adjust screen light manually, and I believe I have a good reason for that.

The ambient light sensor is used to measure the amount of light and to adjust the brightness of the screen. Ambient light sensors can be used to capture images or keystrokes to steal passwords and data. A group of MIT researchers recently created a proof of concept by using an Android tablet’s hand gestures captured by the ambient light sensor to capture touch interactions.

Your mouse may listen to your conversation

This one is outrageous! A mouse doesn’t have a microphone or even a speaker to be turned into a microphone to listen to anything. Vis dėlto, there is a side channel attack known as “Mic-E-Mouse” that enables an attacker to listen to your conversations through your mouse.

A high performance gaming mouse (high DPI) can be hijacked by its optical sensor, so when you talk, voice vibrations can be measured with these sensors. Using machine learning algorithms and data from mouse sensors, security researchers can identify intelligible speech from vibrations.

Side channel attacks are a type of physical attack that measures changes in device output while a device performs an action. This type of attack is usually more sophisticated and targets certain assets like encryption keys. Vis dėlto, if an attack method is developed for certain types of devices, it won’t be very difficult to expand it to other similar devices and even automate it.

Motion sensors (gyroscope) can be used to record your voice

Now that we learned your mouse can be used to record your talking, it’s good to know that motion sensors can also be used for the same purpose. This is important as almost all modern smart devices like phones and tablets have a gyroscope or motion sensor. The sensor acts as a vibrating device, making it perfect for side-channel attacks and to capture voice, as sound waves can produce tiny vibrations.

Your hard disk drive (HDD) noise can be captured to steal sensitive data

Now that we’ve learned about side channel attacks, there is a type of attack called DiskFiltration developed by a group of Israeli researchers that can capture sensitive data from the sound of a hard disk drive working. This type of attack is sophisticated and aims at devices with an air gap. With air gapped devices, a device is not connected to any network like the internet and is usually kept at sensitive facilities. Air gapped devices are not necessarily immune to cyber attacks. A classical example of these attacks is Stuxnet which targeted Iranian nuclear systems that were all air gapped.

Šio tipo atakos metu, užpuolikas užkrečia įrenginį kenkėjiška programa, kuri keičia įrenginio veikimą. Kenkėjiška programa gali būti įterpta į sistemą įsibrovėlio arba kitais būdais. Įrenginys yra atjungtas nuo tinklo (air gapped), todėl kenkėjiška programa negali nieko išsiųsti išorėn. Vis dėlto, jis verčia įrenginį veikti tam tikru būdu, kad diskų skaitymo ir rašymo mechanizmas judėtų pagal tam tikrus modelius. Netoliese esantis išmanusis telefonas ar įrenginys, neprijungtas prie izoliuoto tinklo, gali būti naudojamas disko mechanizmo garsui užfiksuoti ir jį atkoduoti į duomenis, kai jie įrašomi ar skaitomi, taip praktiškai pašalinant air gap'ą.

Jūsų kompiuterio ventiliatorius gali pakenkti jūsų duomenims

Jūsų sistemoje yra SSD ir nenaudojate pigaus bei triukšmingo HDD. Taigi, jei jūsų įrenginys yra air gapped, tada jautrių duomenų ištraukti neįmanoma. Well! Another group of Israeli researchers invented a method for you. Although your SSD doesn’t have an arm to rotate to make noise like with an HDD, your computer fan can be used to capture sound to compromise sensitive data from your air gapped computer. Šio tipo atakos metu, malware first infects the air gapped system (perhaps by an intruder to a secured facility), then the speed of the cooling fan will be changed in certain patterns. The sound can transmit the data to a nearby listening device.

WiFi signals can see through your walls

WiFi signals bounce off humans in a room. Researchers can see through walls to know how many people are in the room and identify individuals by movement and posture without needing any camera.