SPECTER attack leaks air-gapped data through USB power controls

Researchers have demonstrated a covert channel called SPECTER that can leak secrets from air-gapped computers by manipulating USB power-management and device-state controls, without carrying the stolen information in USB data transfers.

The technique requires an already compromised computer with administrator or root privileges. An attacker recovers the information by observing a connected smartphone’s charging status, visible peripheral behavior, or electromagnetic activity near a USB cable.

Researchers at Korea University and 78ResearchLab describe the technique in a paper based on their experiments with commodity hardware running Windows 10 and Ubuntu 22.04.

Air-gapped computers are separated from external networks to protect sensitive information. However, once attackers compromise such a machine, physical signals can provide alternative paths for extracting data. SPECTER explores how USB controls can create those signals even when the interface remains available only for charging or peripheral connectivity.

Three ways to receive stolen data

SPECTER’s transmitter converts a prepared binary sequence into USB control operations. On Linux, it changes runtime power-management settings, while the Windows implementation uses Microsoft’s DevCon utility to turn a selected device on and off.

These operations do not necessarily disconnect the USB power supply physically. Instead, the channel depends on whether the particular computer and attached device produce distinguishable responses.

For smartphone reception, charging states represent binary values. A custom Android application reads battery-status information and decodes the sequence without requiring root access. The iPhone experiment relied on manually watching the charging indicator.

Tests with a Galaxy S22 and iPhone 13 Pro achieved signaling rates of 0.2 bits per second on the Ubuntu desktop and 0.25 bits per second on the Windows laptop. Because different computers were used, the difference cannot be attributed to the operating systems alone.

The second approach uses visible changes in ordinary USB peripherals. A mouse on the Windows system provided the fastest demonstrated channel, reaching one bit per second as its LED and operation responded to device-state changes. Webcam and hub-connected device behavior supported 0.25 bits per second.

The third approach detects electromagnetic bursts associated with USB control operations. Researchers recovered example sequences using a HackRF One and a loop antenna touching the USB mouse cable. They did not establish reception range beyond this contact configuration, and the released analysis script does not automatically decode transmissions.

Slow transmission with practical constraints

The reported rates favor short secrets, such as credentials or cryptographic keys. At the fastest demonstrated rate, transmitting 256 payload bits would take about four minutes and 16 seconds, before packet overhead.

SPECTER operations can trigger charging indicators, host notifications, or interruptions in peripheral use, so the attack isn’t particularly stealthy.

The researchers recommend monitoring repeated USB enable, disable, suspend, and resume events alongside conventional data traffic.