Abstract

You might think that one sure-fire way to keep your computer safe from hackers is to disconnect it from the internet entirely. But did you know that even without internet, a computer can transmit data using light, sound, vibrations, or even heat? In this project, you will investigate how a spy or hacker can steal data from an "air-gapped" computer that has no internet connection. You can even use a smartphone equipped with a sensor app to demonstrate how the data can be picked up by a nearby smartphone.

Objective

Investigate how an air-gapped computer can transmit data using physical quantities like light, sound, vibration, or heat, even without an internet connection.

Introduction

If you read the news, you have probably read about data being hacked or stolen from computers or phones. The hacks can range from revealing embarrassing personal details to credit card numbers or contact information, and can happen to single individuals or entire companies. There are some practices you can follow to keep your data safe online, like using strong passwords, avoiding clicking on suspicious links or downloading email attachments from people you do not know, and keeping the security software on your computer up to date. But what can you do to make sure your data is completely, 100% safe? What if you disconnect your computer from the internet entirely, by physically unplugging the ethernet cable or turning off Wi-Fi? Could that prevent anyone else from accessing your data?

That might seem like an extreme measure for an average internet user. After all, most of what you use your computer for probably involves the internet. If you are not online, then you cannot play games with friends, watch movies, or use social media. But sometimes, companies and governments have extremely sensitive information (like classified military documents) or computers that control very important equipment (like a nuclear power plant). They do not want to risk those computers being hacked, so the computers are air-gapped—they are not physically connected to the rest of the internet (Figure 1). Normally, computers are connected to the internet through a router or modem via either a hardwired or wireless connection. Those routers/modems are connected to servers, which are connected to other servers...indirectly connecting millions of computers all around the world. An air-gapped computer is physically separated with no hardwired or wireless connection to the rest of the internet. It may still be part of an air-gapped network, and connected to other computers on a private network, but not the rest of the internet.

So, what if you are a hacker or a government spy and you want to install malware (malicious computer software) on an air-gapped computer? How could you do it? One method involves using social engineering to trick people into inserting removable media (like a CD or USB flash drive) into the computer. This is a way to physically transport data to the computer without an internet connection, and was used to spread the Stuxnet virus in Iran (see Wired.com article in bibliography). That might be a good way to get data on to a computer, but how do you get data off the computer? What if you cannot get the USB flash drive back?

Computers send information using binary code, a series of ones and zeroes (also called on/off, high/low, or true/false). Normally, whenever you download a song, view a website, or send an email, these ones and zeroes are sent as electronic signals through a wire like an ethernet cable, or as electromagnetic waves through a connection like Wi-Fi or Bluetooth. An air-gapped computer physically lacks the means to send signals over a wired or wireless connection. However, even without an internet connection, computers still transmit signals into the world around them. They make noise, they blink lights, they vibrate, and they get hot. Light, sound, vibration, and heat are all physical quantities that we can use to send information. For example, imagine clicking a flashlight on and off to send binary code—"on" for 1, and "off" for 0. We can observe these physical quantities with our own senses like sight, sound, and touch; and we can also measure them with electronic sensors. For example:

• A thermometer measures temperature
• A photosensor measures light
• A microphone measures sound
• An accelerometer measures vibration

Many of these sensors are built into a device that most of us carry around every day—a smartphone! What if an office building has some air-gapped computers with sensitive information on them, but employees are allowed to have their personal phones in the building? If the computer can transmit a binary signal using some physical quantity that can be measured with a sensor, then the phone could record the signal. This can happen even though the phone and computer are not connected to each other through the internet. If the air-gapped computer has malware installed on it (for example, using a USB flash drive like with the Stuxnet virus, or by a disgruntled employee), it could be forced to broadcast sensitive information like secret files or passwords.

The bibliography contains a very extensive list of references that show how computers without an internet connection can transmit a signal, using a variety of physical methods and sensors (including some that were not mentioned in this introduction). In this project, you will investigate one (or more) of these methods to determine how you can send a signal from an air-gapped computer to a nearby sensor with the help of a sensor app. You will not need to write your own malware to do this—as a proof of concept, you can use controls that are built-in to your computer or operating system (for example, to change the screen brightness). You will attempt to answer questions like "What is the range of the signal?" and "Will a human using the computer notice the signal?" The exact method you pick and procedure you follow will be up to you, but the materials and procedure sections contain plenty of tips to get you started.

Terms and Concepts

• Air gap
• Network
• Malware
• Social engineering
• Removable media
• Stuxnet
• Binary
• Sensor
• Thermometer
• Photosensor
• Microphone
• Accelerometer
• Noise
• Interference
• Bit rate

Questions

• Think about people instead of computers. What are some ways that you could communicate with other people without talking? What senses would the other person use to "listen" to you?
• Use your senses to observe your computer. What can you see, feel, hear, or even smell (we do not recommend tasting your computer)? Do certain actions make the computer noisier or hotter or make the lights blink? Can you imagine how those changes could be interpreted as ones and zeroes (for example, a loud noise vs. a quiet noise)?
• Think about sensors that you encounter in everyday life. For example, your house might have a thermometer that displays the temperature. You might use a headset with a microphone to play online games with your friends. Do you think any of these sensors could measure physical changes in your computer?

Materials and Equipment

The materials (and software) you need for this project will depend on what physical quantity you want to measure and how you will record it. Here are some suggestions:

• Laptop or desktop computer.
  • Depending on the method you choose, you might need permission to install software on the computer. Check with your teacher or librarian before using a school or library computer for this project.
  • Some methods, particularly those that generate heat by running stress tests, or control the computer's cooling fans to make noise, could damage the computer if you are not careful. If you want to use these methods, try finding an old computer that you are not worried about breaking.
• Smartphone with a sensor app such as phyphox, available for free on Google Play for Android devices (version 4.0 or newer) or from the App Store for iOS devices (iOS 9.0 or newer).
  Note: Phyphox does not support the light sensor on iOS devices. If you need the light sensor, you have to use Android devices for your experiment. Note that on some devices the light sensor is only updated when there is a coarse change of illuminance. This means that if the light intensity does not change or only changes slightly, the sensor appears to not record any data. The recording will continue once the light intensity changes again. If your experiments allows, it helps to wiggle the phone or the light source (e.g. flashlight) slightly to induce minimal reading fluctuations and keep the sensor active.
• If you do not use a phone, you can also purchase a variety of sensors from a vendor like Amazon.com:
  • Infrared thermometer. Used to measure the temperature of a surface.
  • Decibel meter. Used to measure sound levels.
  • Lux meter. Used to measure light levels (not sensitive enough to detect individual LEDs, but can detect changes in screen brightness).
  • Electricity usage monitor. Used to measure electrical power consumption.
  • Webcam or video camera. Used to observe blinking LEDs.

Experimental Procedure

Global Connections

Variations

Careers

If you like this project, you might enjoy exploring these related careers:

Related Links

• Science Fair Project Guide
• Other Ideas Like This
• Pure Mathematics Project Ideas
• Science With Your Smartphone Project Ideas
• Cybersecurity Project Ideas
• My Favorites

Cite This Page

General citation information is provided here. Be sure to check the formatting, including capitalization, for the method you are using and update your citation, as needed.

MLA Style

APA Style