Tag: gap

用 SATA 界面產生的電磁訊號突破 Air Gap 限制傳輸資料

在 Hacker News 首頁上看到「SATAn: Air-Gap Exfiltration Attack via Radio Signals From SATA Cables」這個，透過 SATA 界面產生的電磁訊號突破 Air Gap 限制傳輸資料，對應的討論在「SATAn: Air-Gap Exfiltration Attack via Radio Signals from SATA Cables (arxiv.org)」。

Although air-gap computers have no wireless connectivity, we show that attackers can use the SATA cable as a wireless antenna to transfer radio signals at the 6 GHz frequency band.

翻了一下論文裡面提到的距離，在 PC-1 上測試到 120cm，對應的 SNR 有 9db：

Table IV presents the signal-to-noise ratio (SNR) received with the three transmitting computers. The signal transmitted from PC-1 has a strength of 20 dB at 30 cm to 9 dB at 120 cm apart. The signal generated from PC-1 and PC-2 were significantly weaker, with 15 dB at 60 cm (PC-2) and 7 dB at 30 cm (PC-3).

另外大概是 PoC 的關係，只有簡單測一下是可行的 (對於真的有利用 air gap 的環境當作一種保護機制的威脅就夠大了)，看起來沒有測極限可以跑多快：

We transmitted the data with a bit rate of 1 bit/sec, which is shown to be the minimal time to generate a signal which is strong enough for modulation.

關於反制的部份，這類的技術 (透過電磁訊號) 之前在其他的裝置上都有發生過，目前的 air gap 標準應該都有電磁訊號洩漏的防範了，這篇主要還是在展示 SATA 也可以這樣搞 XD

打破實體隔離限制傳遞資訊

GitHub 上的 fulldecent/system-bus-radio 這個專案可以打破實體隔離限制傳遞資訊：

Some computers are intentionally disconnected from the rest of the world. This includes having their internet, wireless, bluetooth, USB, external file storage and audio capabilities removed. This is called "air gapping". Even in such a situation, this program can transmit radio.

有些電腦因為種種因素而實體隔離 (像是因為安全因素，或是保密因素)，於是就有人研究各種方法傳遞資訊。這隻程式利用 system bus 在 Macbook Air 上產生 AM radio 訊號：

And run it on an Apple MacBook Air (13-inch, Early 2015):

./main

Then use a Sony STR-K670P radio receiver with the included antenna and tune it to 1580 kHz on AM.

這方法好硬... 但也證明了可以藉由這種方法傳遞訊息。

Update：強者我同事 ccn 在 Twitter 上找到一位日本人的 demo 影片：

英國計畫在 2018 年開始強制企業公佈男女的平均薪資及 Bonus

英國計畫從 2018 年開始，超過 250 人的公司必須公佈男女的平均薪資及 Bonus：「Companies will be forced to reveal their gender pay gap」：

The new rules, revealed on Friday, will apply to all companies with more than 250 employees.

除了平均薪資以及 bonus 外，還必須公開每個區間的人數：

In addition to publishing their average gender pay and bonus gap, around 8,000 employers across the country will also have to publish the number of men and women in each pay range.

目標是希望讓資訊更透明讓人力市場更健康：

The government is hoping that naming and shaming firms that pay women a lot less than men in the same jobs will push them to stop the practice, because it will make it harder for them to attract top talent.

可以看到目前估算出來的差異：

另外美國也在規劃類似的法案，不僅僅是性別，還包括了種族等其他資訊：

In the U.S., similar plans are also under discussions. President Obama announced a proposal earlier this month that would require companies with more than 100 employees to report how much they are paying their employees by race, ethnicity and gender.