GPU-FAN: Leaking Sensitive Data from Air-Gapped Machines via Covert Noise from GPU Fans

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Modern computer networks are secured with a wide range of products, including firewalls, intrusion detection and prevention systems (IDS/IPS), and access control mechanisms. But despite the multiple layers of security, these measures can be bypassed by motivated attackers. To cope with this threat, an ‘air-gap’ is a network security measure that may be taken where highly sensitive information needs to be protected. In this approach, the internal network is isolated from the Internet, physically and logically, to create a physical boundary with the outer digital world. In this paper, we show that attackers can leak data from air-gapped networks via covert acoustic signals. Our method doesn’t require speakers on infected computers. Malware running on the computer can use the GPU (graphics processing unit) fans and evasively control its speed. While the slight changes in the RPM (rotation per minute) speed are not noticeable to users, they can be used to modulate and encode binary information. A nearby receiver, such as a compromised smartphone or a laptop, can receive the covert acoustic signals and demodulate and decode the binary information. We discuss the attack model on air-gapped networks and provide relevant technical background and the characteristics of the GPU fans. We also present the covert channel’s design, implementation, and evaluation. The results show that a brief amount of sensitive information can be leaked several meters away via covert noises generated from the GPU fans.

Original languageEnglish
Title of host publicationSecure IT Systems
Subtitle of host publication27th Nordic Conference, NordSec 2022, Proceedings
EditorsHans P. Reiser, Marcel Kyas
PublisherSpringer Cham
Number of pages18
ISBN (Electronic)9783031222955
ISBN (Print)9783031222948
StatePublished - Jan 2023
Event27th Nordic Conference on Secure IT Systems, NordSec 2022 - Reykjavic, Iceland
Duration: 30 Nov 20222 Dec 2022

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume13700 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference27th Nordic Conference on Secure IT Systems, NordSec 2022


  • Acoustic
  • Air-gap
  • Covert channel
  • Exfiltration
  • GPU

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science (all)


Dive into the research topics of 'GPU-FAN: Leaking Sensitive Data from Air-Gapped Machines via Covert Noise from GPU Fans'. Together they form a unique fingerprint.

Cite this