OK, we’re not talking stage microphones here but the dinky mics that are built into computers. Yet the concept is somewhat frightening: did you know computer viruses can transmit high frequency communications…and spread. This is the WWZ scenario of AV/IT convergence…
Researchers proved the "badBIOS" virus, found in October, is “transmitting itself by audio broadcasts at inaudible frequencies.”
This malware can get onto a computer via an infected USB stick, then dig into the machine’s BIOS and take over the computer’s microphone and speakers and communicate with other computers by high-frequency sounds that humans can’t hear.
It was so unbelievable as an idea that many other experts rejected the notion. Everyone always underestimates the hurdles that criminals can jump in the name of crime.
Until researchers from Fraunhofer Institute for Communication, Information Processing, and Ergonomics in Germany have now provided some proof-of-concept. Using a program originally developed for transmitting acoustic information underwater, they managed to get computers to exchange inaudible broadcasts over distances of up to 65 feet. You can see their paper in the Journal of Communications.
Importantly, it wasn’t just two computers talking, but also a demonstration of “how the scenario of covert acoustical communication over the air medium can be extended to multi-hop communications and even to wireless mesh networks”. In a mesh network, if you would wipe a machine clean, as soon it is turned on, it would be infected again by at least one of the remaining machines yet to be wiped.
The bandwidth of this method is incredibly small, only a few bits per second, so currently it can’t extract large files from target machines. But you can bet some black hat is working on that. It does work well as a “keylogger,” that steals usernames and passwords that can be used in conjunction with other black hat tricks for further access.
So think about this scenario: a jam-packed concert where someone has figured out an acoustic-enabled virus…
The more we are dragged into an IP world, the more we will have to be in the IT security business… and security is the one area of business that is always destined to grow.
