Fansmitter leaked data through computer fan noise without speakers

Reconstruction

Fansmitter addresses the same 'speakerless' containment assumption from a different component. After compromise, software changes the rotation speed of CPU or chassis fans. Different speeds produce different acoustic signatures, allowing the attacker to encode bits in ordinary fan noise and recover them with a nearby microphone.

The mechanism works because cooling fans are physical actuators under at least partial software control. Their rotational speed changes the spectrum and amplitude of the sound they generate. A component installed only for thermal management can therefore become a crude acoustic transmitter even when the computer has no speakers or audio hardware. The reported prototype reached a smartphone at 0-8 meters and up to 900 bits per hour.

This is a constrained laboratory covert channel. Practical success depends on fan hardware, controllability, environmental noise and receiver placement; it is not evidence that arbitrary fan-equipped systems are remotely readable.

Mechanism & boundary

1. 01

   Run malware on the protected device

   The sender must already execute attacker-controlled code and have enough influence over fan behavior.

   Boundary: protected host / attacker-controlled process

2. 02

   Encode data as fan-speed states

   Secret bits are mapped to changes in fan rotation speed or acoustic frequency.

   Boundary: secret data / cooling-control behavior

3. 03

   Generate modulated fan noise

   The mechanical fan turns control changes into audible acoustic emissions even though no speaker is present.

   Boundary: fan actuator / room acoustics

4. 04

   Record with a nearby microphone

   A phone or other receiver captures the fan-noise pattern from within the tested physical range.

   Boundary: protected room / receiver sensor

5. 05

   Recover the bitstream

   Receiver software analyzes the acoustic signature and reconstructs the encoded data.

   Boundary: acoustic recording / recovered secret

Claims & evidence

Implications

Fansmitter demonstrates that eliminating audio peripherals does not eliminate every acoustic output. The risk is most relevant where a compromised system can control cooling hardware and an attacker can position a microphone nearby. It also generalizes defensively: support components such as fans should be evaluated as software-controlled physical actuators, not only as maintenance hardware.

Controls & mitigations

• Remove untrusted microphone-equipped devices from high-assurance rooms and enforce physical separation from fan-equipped protected systems.
• Restrict or mediate software fan-control interfaces where operationally feasible.
• Monitor anomalous fan-speed patterns or acoustic signatures only where normal thermal-management variability can be distinguished reliably.

What remains unknown

• Real-world reliability depends on fan model, speed-control granularity, ambient noise, room acoustics and receiver position.
• The published maximum range and rate are experimental results rather than guarantees for arbitrary systems.
• No cited evidence shows autonomous AI use of Fansmitter in a deployed containment environment.

Connected research