Exfiltration of Data from a Standalone PC

### Exfiltration of Data from a Standalone PC

Data exfiltration refers to the unauthorized transfer of sensitive information from a system. Data exfiltration presents unique challenges when it comes to standalone PCs — computers that are not connected to a network or the internet. Despite the lack of direct connectivity, there are various methods, both physical and technical, that can be employed to exfiltrate data from such systems. This write-up explores some of the most prominent techniques.

— -

#### **1. Basic One:-Physical Access with Removable Media**

The simplest and most common method of exfiltrating data from a standalone PC is through physical access using removable media.

- **USB Drives and External Hard Drives**: These devices allow an insider or an unauthorized user to copy sensitive data onto a storage medium and physically transport it.
- **Optical Discs (CD/DVD)**: Data can also be copied onto CDs or DVDs, though this method is less common due to the limited use of optical drives in modern PCs.
- **SD Cards**: Small and easily concealed, SD cards are an effective way to exfiltrate data in environments where security checks might overlook them.

The risk associated with these methods can be mitigated by physically securing the PC, using tamper-evident hardware, and employing data loss prevention (DLP) tools that monitor or block the use of external storage devices.

— -

#### **2.Improved Hardware-Based Covert Channels**

Hardware-based methods utilize unintended electromagnetic or acoustic emissions from the PC to transmit data covertly.

- **TEMPEST Attacks**: Computers emit electromagnetic signals during operation. These signals can be intercepted and decoded using specialized equipment, allowing an attacker to retrieve sensitive data from the system.
- **Acoustic Signals**: Sound produced by PC components, such as fans or even speakers, can be modulated to encode data. This information can then be captured by nearby devices, such as a compromised smartphone or microphone.
- **Ultrasonic Communication**: Malware can manipulate a computer’s speakers to emit high-frequency sounds (inaudible to humans), which can be picked up by nearby devices like phones or microphones. The data encoded in these ultrasonic waves can then be extracted and decoded.

While these methods are highly sophisticated, protecting against them often requires electromagnetic shielding (for TEMPEST) or disabling unnecessary audio hardware.

— -

#### **3. Visual Channels for Data Transmission**

Visual methods involve encoding information into light signals or screen displays that can be captured and decoded.

- **LED Indicators**: Devices like network cards, hard drives, or even the PC’s power LED can be manipulated to blink in patterns that encode data. This signal can be recorded by a camera and later decoded.
- **Screen Flicker**: Data can be exfiltrated by imperceptibly altering the screen’s refresh rate or pixel values. A camera monitoring the screen can capture these flickers, and software can be used to extract the encoded information.
- **QR Codes or Visual Patterns**: Malware can display QR codes or other visual patterns on the screen that contain sensitive information. A nearby camera or another recording device can capture these images for later decoding.

These techniques can be mitigated by covering LEDs, disabling unnecessary visual output, or shielding monitors and displays from external observation.

— -

#### **4. Peripheral Devices Manipulation**

Peripherals like keyboards, mice, and printers can be manipulated to exfiltrate data.

- **Keyboard Sound Eavesdropping**: The distinct sound of typing can be captured and analyzed to reconstruct the keystrokes. Malware can utilize a PC’s microphone to listen to typing and exfiltrate passwords or other sensitive data through this sound.
- **Printer Channels**: Documents sent to printers can be compromised, with printers saving or forwarding copies. Printers with network connectivity can be manipulated to send out sensitive information directly, or the printed documents can be physically exfiltrated.
- **Firmware-Level Attacks**: By altering the firmware of connected devices like USB drives, keyboards, or mice, data can be stored on these devices for later retrieval. Malicious firmware can also enable covert communication channels.

Protecting against these types of attacks involves limiting the use of peripherals, auditing firmware, and implementing physical security measures to prevent tampering.

— -

#### **5. Thermal and Power Line Manipulation**

Temperature and power consumption patterns can also be manipulated for exfiltration.

- **Thermal Covert Channels**: Research has demonstrated that slight variations in the temperature of a CPU or GPU can encode information. These variations can be measured by nearby devices with thermal sensors to retrieve sensitive data.
- **Power Line Communication**: Computers draw power from electrical grids, and subtle variations in power consumption can be encoded with data. Attackers with access to the same power lines may detect these variations and extract the encoded information.

Mitigating these threats may involve using power line filters, placing restrictions on power access, and isolating machines from vulnerable thermal channels.

— -

#### **6. Reflections and Optical Attacks**

Screens and displays can emit light that reflects off nearby surfaces, which can then be recorded by distant cameras.

- **Screen Reflections**: An attacker can use a telescope or long-range camera to capture the reflection of a screen of objects like eyeglasses, windows, or other reflective surfaces. By analyzing these reflections, an attacker can extract the data displayed on the screen.

To prevent such attacks, using privacy filters on screens, adjusting the lighting of the workspace, and minimizing the exposure of reflective surfaces can be effective countermeasures.

Demonstration of one such technique for data exfiltration using the Acoustic Method

— -

### Conclusion

While a standalone PC might seem secure due to its lack of network connectivity, numerous covert channels exist that can be exploited for data exfiltration. These methods can range from physical access using USB drives to more sophisticated electromagnetic, acoustic, and visual techniques. Effective defense strategies involve both physical and technical security measures, such as limiting access to removable media, shielding hardware against emissions, disabling unnecessary peripherals, and securing the environment against visual or acoustic monitoring. Regular auditing and physical security checks are also essential in preventing such attacks.