AIR-FI generated covert Wi-Fi-band signals from memory buses

Reconstruction

AIR-FI shows that disabling or removing a normal Wi-Fi transmitter does not make a computer electromagnetically silent. Malware performs carefully chosen memory operations so that activity on DDR memory buses produces electromagnetic emissions in frequency bands used by Wi-Fi. Data is encoded by controlling that memory activity.

A nearby Wi-Fi-capable device can observe physical-layer information associated with those emissions and recover the signal. The physical origin is ordinary high-speed digital switching: memory buses move electrical signals at rates that create measurable electromagnetic energy, and software can influence the switching pattern through its workload. The researchers reported reception at distances of several meters in their tested configurations.

AIR-FI is still a post-compromise channel. Practical success depends on memory hardware, workload control, receiver support, distance and RF noise. It does not mean any process can create a reliable Wi-Fi link from any computer with networking disabled.

Mechanism & boundary

1. 01

   Execute malware on the isolated machine

   Attacker-controlled code must already run on the protected host.

   Boundary: air-gapped host / attacker-controlled workload

2. 02

   Encode data into memory activity

   The transmitter chooses memory-access patterns that correspond to the secret bitstream.

   Boundary: secret data / DDR workload

3. 03

   Generate Wi-Fi-band electromagnetic emissions

   High-speed switching on the memory bus produces data-dependent RF energy without using a dedicated Wi-Fi transmitter.

   Boundary: memory bus / electromagnetic environment

4. 04

   Observe with a nearby Wi-Fi receiver

   A compatible nearby device measures physical-layer information associated with the emissions.

   Boundary: protected hardware / nearby radio

5. 05

   Decode and forward

   Receiver software reconstructs the encoded data and can then relay it through its own ordinary connectivity.

   Boundary: covert RF signal / external network

Timeline

1. Dec 12, 2020

   AIR-FI preprint released

   report

   The paper described Wi-Fi-band emissions generated through memory-bus activity and evaluated nearby reception.

Claims & evidence

Implications

AIR-FI separates two security claims that are often conflated: 'this machine has no active Wi-Fi interface' and 'this machine cannot emit a Wi-Fi-band signal'. The demonstrated risk remains local and hardware-dependent, but it makes memory activity and nearby radio-capable devices part of a high-assurance RF threat model.

Controls & mitigations

• Exclude untrusted Wi-Fi-capable devices from the physical security zone around protected systems.
• Use RF monitoring and shielding appropriate to the relevant bands when the threat model warrants emanation controls.
• Constrain untrusted code and investigate unusual sustained memory-access patterns where such telemetry is meaningful.

What remains unknown

• Feasibility depends on memory generation, bus topology, receiver chipset and exposed physical-layer measurements.
• Range and rate vary with hardware, placement, shielding and ambient RF noise.
• The paper demonstrates a covert channel after compromise, not an initial infection technique or autonomous AI behavior.

Connected research