SATAn hack can steal data directly from your SATA cable

New Air-Gap Attack Uses SATA Cable as an Antenna to Transfer Radio Signals

Researchers , have published a paper that demonstrates how a hacker could extract data from an otherwise secure system via its SATA cable.

The attack uses the SATA cable itself as a form of wireless transmitter, and the data it carries can be intercepted as a form of radio signal in the 6GHz band. The attack is appropriately referred to as SATAn.

All about SATA

SATA is a bus interface widely used in modern computers to connect the host bus to mass storage devices such as hard disk drives, optical drives, and SSDs.

The researchers found out that the SATA 3.0 cables generate electromagnetic emissions in various frequency bands, including 1 GHz, 2.5 GHz, 3.9 GHz, and +6 GHz. They explained that “the most significant correlation with the data transmission spans from 5.9995 GHz to 5.9996 GHz.” The researchers’ goal was to use the SATA cable to control the electromagnetic emission.

An air-gapped network is one that’s physically isolated from any other networks in order to increase its security.

The researchers also explained that the attack can operate from user mode. The method is effective even from inside a Virtual Machine (VM), and can successfully work with other running workloads in the background. However, on the VMs the attack effectiveness is significantly reduced.

In the final data reception phase, the transmitted data is captured through a hidden receiver or relies on a malicious insider in an organization to carry a radio receiver near the air-gapped system. “The receiver monitors the 6GHz spectrum for a potential transmission, demodulates the data, decodes it, and sends it to the attacker,” Dr. Guri explained.