Malware Turns Computers Into Cellular Antenna

A team of Israeli researchers have improved on a way to steal data from air-gapped computers, thought to be safer from attack due to their isolation from the Internet.

They’ve figured out how to turn the computer into a cellular transmitter, leaking bits of data that can be picked up by a nearby low-end mobile phone.

While other research has shown it possible to steal data this way, some of those methods required some hardware modifications to the computer. This attack uses ordinary computer hardware to send out the cellular signals.

Their research, which will be featured next week at the 24th USENIX Security Symposium in Washington, D.C., is the first to show it’s possible to steal data using just specialized malware on the computer and the mobile phone.

“If somebody wanted to get access to somebody’s computer at home — let’s say the computer at home wasn’t per se connected to the Internet — you could possibly receive the signal from outside the person’s house,” said Yisroel Mirsky, a doctoral student at Ben-Gurion University and study co-author.

The air-gapped computer that is targeted does need to have a malware program developed by the researchers installed. That could be accomplished by creating a type of worm that infects a machine when a removable drive is connected. It’s believed this method was used to deliver Stuxnet, the malware that sabotaged Iran’s uranium centrifuges.

The malware, called GSMem, acts as a transmitter on an infected computer. It creates specific, memory-related instructions that are transmitted between a computer’s CPU and memory, generating radio waves at GSM, UMTS and LTE frequencies that can be picked up by a nearby mobile device.

The GSMem component that runs on a computer is tiny. “Because our malware has such a small footprint in the memory, it would be very difficult and can easily evade detection,” said Mordechai Guri, also a doctoral student at Ben-Gurion.

Source

FCC To Tighten Rules On Robocalls

The top U.S. telecommunications regulator wants to make it more difficult for telemarketers and other businesses to robocall and text messages consumers under changes to autodialing rules being proposed.

The Federal Communications Commission plans to vote on June 18 on the proposal, which would give legal cover to telephone companies to offer consumers technologies that would block robocalls, regardless of where they originate.

“The FCC wants to make it clear: Telephone companies can – and in fact should – offer consumers robocall-blocking tools,” FCC Chairman Tom Wheeler said in a blog post.

The wireless carriers have worried that blocking automated calls could be construed as violations of the law that requires them to ensure that all calls placed over their networks reach their intended recipients.

The proposal would also reassert that consumers have to agree to receive automated calls and texts and clarify that they can revoke their consent in any “reasonable” way, including a simple request for calls to stop, without the need to file convoluted paperwork.

Robocalls and robotexts are by far the most common cause of consumer complaints at the FCC, topping 215,000 in the last year alone. Consumer advocates and the majority of U.S. states attorneys general had pressed the FCC to clarify the robocall rules.

Numerous business associations, including the U.S. Chamber of Commerce, have also pushed for clarifications, facing a growing number of lawsuits prompted by violations such as calling cellphone users whose numbers used to belong to someone else.

The FCC’s proposal would reassert that companies should try to avoid numbers reassigned to consumers who have not agreed to receive their calls. If they do not know that a number has been reassigned, they are allowed one call to find out.

The business community had also complained that some lawsuits unfairly target them for using dialing technologies that could be modified to become autodialers. FCC officials said any technology with the capacity to dial random or sequential numbers qualifies as an autodialer, even if it would require modification.

U.S. law prohibits telemarketing calls to both landline and cellphones of consumers who have not given written consent.

Source