AirKeyLogger: Hardwareless Air-Gap Keylogging Attack

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

This paper presents AirKeyLogger - a novel radio frequency (RF) keylogging attack for air-gapped computers.Our keylogger exploits radio emissions from a computer's power supply to exfiltrate real-time keystroke data to a remote attacker. Unlike hardware keylogging devices, our attack does not require physical hardware. Instead, it can be conducted via a software supply-chain attack and is solely based on software manipulations. Malware on a sensitive, air-gap computer can intercept keystroke logging by using global hooking techniques or injecting malicious code into a running process. To leak confidential data, the processor's working frequencies are manipulated to generate a pattern of electromagnetic emissions from the power unit modulated by keystrokes. The keystroke information can be received at distances of several meters away via an RF receiver or a smartphone with a simple antenna. We provide related work, discuss keylogging methods and present multi-key modulation techniques. We evaluate our method at various typing speeds and on-screen keyboards as well. We show the design and implementation of transmitter and receiver components and present evaluation findings. Our tests show that malware can eavesdrop on keylogging data in real-time over radio signals several meters away and behind concrete walls from highly secure and air-gapped systems.

Original languageEnglish
Title of host publicationProceedings - 2023 IEEE 47th Annual Computers, Software, and Applications Conference, COMPSAC 2023
EditorsHossain Shahriar, Yuuichi Teranishi, Alfredo Cuzzocrea, Moushumi Sharmin, Dave Towey, AKM Jahangir Alam Majumder, Hiroki Kashiwazaki, Ji-Jiang Yang, Michiharu Takemoto, Nazmus Sakib, Ryohei Banno, Sheikh Iqbal Ahamed
PublisherInstitute of Electrical and Electronics Engineers
Pages637-647
Number of pages11
ISBN (Electronic)9798350326970
DOIs
StatePublished - 1 Jan 2023
Event47th IEEE Annual Computers, Software, and Applications Conference, COMPSAC 2023 - Hybrid, Torino, Italy
Duration: 26 Jun 202330 Jun 2023

Publication series

NameProceedings - International Computer Software and Applications Conference
Volume2023-June
ISSN (Print)0730-3157

Conference

Conference47th IEEE Annual Computers, Software, and Applications Conference, COMPSAC 2023
Country/TerritoryItaly
CityHybrid, Torino
Period26/06/2330/06/23

Keywords

  • air-gap
  • covert-channel
  • keylogging
  • radio emission

ASJC Scopus subject areas

  • Software
  • Computer Science Applications

Fingerprint

Dive into the research topics of 'AirKeyLogger: Hardwareless Air-Gap Keylogging Attack'. Together they form a unique fingerprint.

Cite this