Researchers have identified a covert channel named SPECTER that extracts sensitive data from air-gapped computers by manipulating USB power-management and device-state controls, with further coverage provided by Cyber Insider.
The technique, developed by experts at Korea University and 78ResearchLab, requires an attacker to have root or administrator privileges on the target machine. By toggling USB devices on and off, the malware creates signals that can be intercepted via a smartphone charging status, peripheral behavior or electromagnetic emissions. Experiments conducted on Windows 10 and Ubuntu 22.04 demonstrated that the method can transmit data at rates between 0.2 and 1 bit per second. While the slow speed limits the attack to small files like cryptographic keys or credentials, it highlights a significant vulnerability for isolated systems. The researchers noted that the process is not entirely stealthy, as it may trigger visible notifications or interrupt peripheral functionality. To mitigate these risks, security teams are advised to monitor for frequent USB enable, disable, suspend and resume events. This research underscores the importance of physical security for air-gapped environments, as even disconnected systems remain susceptible to sophisticated exfiltration methods that bypass traditional network defenses.
Source: Cyber Insider
