安全与密码学2018arxiv.org
通过磁场从法拉第笼隔离的气隙计算机中窃取数据
Escaping Data from Faraday-Caged, Air-Gapped Computers via Magnetic Fields
进阶 · 约 40 分钟读完前置知识：物理隔离/air-gap 安全、电磁学基础、信号调制与解码
导读
论文研究如何从法拉第笼屏蔽、物理隔离（air-gapped）的计算机中窃取数据：恶意软件通过控制 CPU 负载产生规律变化的磁场，再由附近的磁力计（如智能手机）接收解码。实测传输距离最远约 100cm，但那时速率只有 1bps，10bps 需要靠近到约 10cm；论文还提到存在热学 TEMPEST 攻击。
HN 关注点：这种绕过法拉第笼的"磁学版 TEMPEST"侧信道，讨论它的实际可利用性、防护成本，以及磁屏蔽与磁通信的相关经验。
HN 评论精选
这几条评论里：支持 1 补充 1 亲历 1
支持速率随距离急剧下降，实用门槛高，物理间隔即可缓解，并补充了热学侧信道。
这是磁学版的 TEMPEST，很妙。磁场强度按平方反比衰减，论文里也提到了，这限制了距离：最远做到 100cm，但那时只有 1bps；要 10bps 就得靠近到约 10cm。看起来很难利用，但想象一下服务器紧贴墙壁或地板，有人在墙的另一侧放个窃听装置。看来只要服务器周围留足空间就够了，离地板和墙 1 米应该就能缓解。我以前知道光和超声波的方式，从论文里还知道原来有热学 TEMPEST 攻击。
rdtsc查看英文原文
This is brilliant - magnetic TEMPEST. Though magnetic field intensity drops off with an inverse cute law, they mention that in the paper, which restricts the distance. It seems they got up to 100cm but it's 1bps at that point. For 10bps need to be only about 10cm way. Seems hard to exploit but imagine server being next to a wall/floor and someone placing a bug right next to the wall on the other side. Seems just leaving enough space around the server would be enough. Put it 1m away from floor and walls and it should mitigate it. I knew about the light and ultrasound before, but also learned from the paper there is apparently a thermal TEMPEST attack as well.
亲历用硬盘壳 MU-Metal 做磁屏蔽的亲身实践，以及商用磁域网芯片的见闻。
有意思，让我想起两件相关的事。1）一个朋友玩 3D 打印机，测电机轴后粘的磁铁的转速时遇到奇怪干扰，最后发现传感器灵敏到能测出步进电机自身的磁场；解决办法是把旧机械硬盘的壳剪开包在电机上——硬盘壳是 MU-Metal（坡莫合金），可以当磁屏蔽，用现成废料就管用。2）一年前遇到一家公司卖能在"个人磁域网"上通信的芯片，没给硬指标，但声称可在 2 米范围内传音视频，还能穿透水（水会屏蔽大多数无线电）；我索要样品没得到回应，仍然很想买几片做实验。
crankylinuxuser查看英文原文
That's neat. It does remind me a few things. They're only related by this topic. 1. A buddy was experimenting with 3d printers, and was measuring the spin on a magnet superglued on the back of a NEMA 17 shaft. He had weird interference going on. We eventually figured out the sensor was sensitive enough to measure the magnetic field in the stepper itself. Our solution was to take a spinning rust HD case, and cut/wrap it around the stepper. Spinning rust cases are made out of MU-Metal. Think of them as magnetic shielding. And in our case, it worked with nothing more than scrap we had around. 2. There was a company I ran across a year ago that was selling chips that could communicate over a personal magnetic area network. They didn't give hard numbers, but claimed they could transmit audio and video within a 2m bubble. They also worked through stuff like water (which kills most radio). I asked for some samples, but fell on deaf ears. I'd still love to have/purchase a few chips to experiment with.
补充提议用随机噪声主动干扰各类侧信道（含 LED 和磁场）。
随机乱闪的 RGB 灯虽然烦人，但看起来是干扰一切状态 LED 数据外泄的好办法。我也好奇，为什么气隙数据中心不在法拉第笼内外都播撒随机信号噪声。
arcaster查看英文原文
As obnoxious as randomly pulsating RGB led's are, it seems like a great way to defeat data exfiltration with status LED's of any kind. I'm also curious why air-gapped data centers don't blast the air-waves both inside and outside of the faraday cages with randomized signal noise.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2018Hacker News 讨论帖161 分 · 72 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选