USBee – The Software-Only Air Gapping USB Device

Many of us worry about our security and protection when you start using PCs and devices. This is even more worrisome when you start to deal with secure PCs, devices which are connected to no networks and designed to stand alone without interaction with other devices. Over the past few months more and more reports have come in with ingenious solutions to attack these “air-gapped” PCs. The latest solution turns any USB into a hacking device for these machines. Say Hello to the USBee, the first software-only air gapping hacking device.

Developed as an advancement to an NSA hardware modified USB device, the USBee uses a software-only method and can be installed on any device. Researchers from Ben-Gurion University in Israel released a paper on Monday, claiming that the USBee was a “software-only method for short-range data exfiltration using electromagnetic emissions from a USB dongle”. The solution is an improvement thanks to its unique approach, as stated, “unlike other methods, our method doesn’t require any [radio frequency] transmitting hardware since it uses the USB’s internal data bus”.

Any USB 2.0 device could be turned into a listening device, with certain types of cameras and devices that don’t receive information from a computer, however, are immune to this form of an attack. Transmitting at around 80 bytes per second the USBee could steal your 4096-bit encryption key is under 10 seconds!

Do you fear your USB devices? What do you plug-in that could be used to monitor and transmit your secrets? Has the day of secure devices passed or do we just need to place a laptop in a sealed room with no electronics for it to be “safe”?