Laser-based Covert Channel Attack Using Inaudible Acoustic Leakage from Multilayer Ceramic Capacitors

We propose a new covert-channel attack that exploits inaudible acoustic leakage from multilayer ceramic capacitors (MLCCs) using a laser Doppler vibrometer (LDV). Malware installed on a victim PC modulates the CPU load by transmitting data bits that induce acoustic noise from an MLCC on the victim PC's motherboard. Unlike conventional attacks that use a microphone to capture such acoustic leakage, we use an LDV aimed at the MLCC to capture the acoustic leakage from the MLCC. Using LDV, instead of microphones, the attacker can exploit inaudible high-frequency signals and penetrate transparent obstacles such as a glass side panel on the victim's PC by shining a laser on the target MLCC. The proposed method requires less privilege compared to conventional covert acoustic channel attacks that require privilege to use IO devices(e.g., loudspeaker, microphone). In addition, the proposed method exploits the acoustic leakage from MLCCs instead of a loudspeaker. Therefore, the proposed method is possible to attack PCs that do not have loudspeaker installed. Compared with conventional LDV-based eavesdropping attacks, the proposed method extends them to MLCC leakage in the covert-channel setting. We experimentally verify the proposed attack by measuring inaudible acoustic leakage from MLCC, induced by modulated CPU load, by using an LDV and evaluating the bitrate.