1
00:00:01,000 --> 00:00:50,975
[Hal Turing] Alrighty! Thanks for tuning in! Hello AI world! I am your host, Hal Turing, and my co-host is Dr. Ada Shannon.

Today's paper claims two computers with no network connection can talk to each other using nothing but heat. It's called BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations. It's by Mordechai Guri and three co-authors, Matan Monitz, Yisroel Mirski and Yuval Elovici, from Ben-Gurion University of the Negev and its Telekom Innovation Laboratories, and the version we have is a 2015 draft. One thing up front: this draft has placeholders where Section VI, on modulation and protocol, and the countermeasures section should be. So some claims come with evidence and some are just stated. Ada, what's the pitch?

2
00:00:50,975 --> 00:01:30,974
[Dr. Ada Shannon] The pitch is that your air-gap only counts if two compromised machines can't talk across it, and this paper says they can, through the room. An air-gap is physical and logical separation from less trusted networks, like the JWICS military network. It has still been breached: Stuxnet, agent.btz, USB sticks, supply-chain tampering, a malicious insider. So the paper asks what happens after the gap is crossed and both sides are infected. A covert channel is a communication path nobody designed for communication. Butler Lampson named the problem back in 1973 in his confinement paper. Here the medium is CPU heat, and the receiver is the other PC's own thermal sensor.

3
00:01:30,974 --> 00:01:40,099
[Hal Turing] Okay, genuine question, because I don't have the map in my head. Ben-Gurion already had AirHopper, right? What's missing that heat fills?

4
00:01:40,099 --> 00:02:22,274
[Dr. Ada Shannon] Direction and hardware. AirHopper, from Guri and colleagues in 2014, sends data over FM radio from the video cable. It's fast but one-way, and it needs a receiver. Hanspach and Goetz built a near-ultrasonic acoustic mesh in 2013, which needs speakers and microphones that secure PCs often lack. Kuhn and Anderson covered electromagnetic emanations in Soft Tempest, and Loughry and Umphress covered optical leakage. Murdoch's 2006 'Hot or Not' used temperature only as a clock-skew side channel and mentioned a thermal covert channel as future work. Most of these can only exfiltrate, meaning leak data out. BitWhisper claims half-duplex bidirectional communication, so it can also infiltrate, meaning send commands in, with no added hardware.

5
00:02:22,274 --> 00:02:34,549
[Hal Turing] Wait wait, but the attack model has you compromising a machine inside the isolated network first, and that's the whole game! If you can already do that, why not use the same foothold—

6
00:02:34,549 --> 00:02:54,324
[Dr. Ada Shannon] No, I disagree, Hal. Phase one infects the Internet-side PC with phishing. Phase two, getting into the isolated network, is the hard part, and Stuxnet proved someone can do it. But malware sitting inside with no way to phone home is stranded. It has to act on its own, like Stuxnet's pre-programmed logic. This channel is what gives it a leash.

7
00:02:54,324 --> 00:03:03,549
[Hal Turing] But it's a leash you can barely tug. Both endpoints compromised, within forty centimeters of each other. That's a narrow party trick.

8
00:03:03,549 --> 00:03:31,224
[Dr. Ada Shannon] Narrow, yes, and I'll hold that for later. But a party trick that closes the loop on a compromised air-gap isn't nothing. The paper's own scenario has one person with two PCs on different networks, side by side. The malware finds its neighbor with thermal pings, which are heat pulses sent to see whether anyone nearby is listening. Once it finds one, it sets up a logical link for commands and small exfiltration like passwords and keys. Figure 2 even shows the command being delivered: firing a USB rocket launcher.

9
00:03:31,224 --> 00:03:39,724
[Hal Turing] A rocket launcher fired by room temperature. Fine, that one earns its keep. So how does a CPU become a transmitter?

10
00:03:39,724 --> 00:04:19,750
[Dr. Ada Shannon] Workload drives power, and power becomes heat. Dynamic power scales roughly with capacitance times frequency times voltage squared times activity, so a software-controlled busy loop is a software-controlled heater. The CPU, GPU, voltage regulators and drives all give off heat, and fans respond to CPU temperature. On the receiving side, PCs have thermal sensors on the CPU cores, motherboard, case ambient, GPU, VRM and drives via S.M.A.R.T. They report at one degree Celsius resolution, and CPU sensors are notoriously inaccurate when cool. Remember that one-degree floor, because it matters later.

11
00:04:19,750 --> 00:04:22,375
[Hal Turing] Noted. And the headline number?

12
00:04:22,375 --> 00:04:44,850
[Dr. Ada Shannon] The claim is 0 to 40 centimeters at an effective 1 to 8 bits per hour. Treat it as a claim for now. The introduction says 'eight signals per hour' and the abstract says 'bits per hour', and whether those are the same thing is something we'll test later. One framing sentence on AI: the paper isn't about AI, but physical side channels are a threat surface for any isolated compute environment, including clusters and enclaves holding model weights.

13
00:04:44,850 --> 00:04:55,850
[Hal Turing] Okay, so the physics is in place. Let me ask about the experiment itself, Ada. How did they actually measure any of this? I'm picturing a lab with fancy instruments.

14
00:04:55,850 --> 00:05:38,050
[Dr. Ada Shannon] Less fancy than you'd think, which is part of the point. Two rooms: a three-by-four-meter closed office with no window, and a four-by-nine shared office with a small window and an open door. Both were air-conditioned. The main machines were identical i7-4790 towers, plus a small-form-factor Lenovo with a Core 2 Duo and a big Gigabyte tower with an i7-3770. Heat came from custom busy loops, prime95 and FurMark. Sensing came from HWiNFO polling at 0.5 hertz, so one sample every two seconds. A Fluke infrared thermometer and a FLIR thermal camera served as ground truth. They ran single-PC trials first, for heating and cooling rates, then two-PC trials for mutual effects.

15
00:05:38,050 --> 00:05:42,850
[Hal Turing] So what does one machine do on its own? Peg the CPU and watch?

16
00:05:42,850 --> 00:06:09,900
[Dr. Ada Shannon] Forty minutes at a hundred percent. The CPU core sensors jump about twenty degrees almost instantly. Motherboard sensors climb ten degrees over thirty minutes. The voltage regulator stays flat, so they drop it. The number that matters is the ambient case sensor, which needs roughly one and a half to three minutes per degree, and stays roughly linear up to ten degrees over idle. Cooling is similar, one to three minutes per degree. Heating is faster near idle, and cooling is faster near max because the fans spin up.

17
00:06:09,900 --> 00:06:17,550
[Hal Turing] Hang on, if I'm the receiver and I'm actually using my machine, doesn't my own CPU drown out the signal?

18
00:06:17,550 --> 00:06:50,725
[Dr. Ada Shannon] That's what Figure 4 tests, and it's the paper's most practical result. Thirty minutes of Word, Chrome tabs and YouTube on an i7-4790 under Windows 7. The CPU sensor is a mess, but the ambient sensor sits flat at thirty-two degrees the whole time. So they pick the ambient sensor, group B, over the noisy CPU diodes, with the drive sensor as a fallback. And they say transmit when the machine is idle, like at night. They also treat the channel as single-input single-output. Correlating several sensors, a SIMO channel, would boost signal against noise, but that's deferred.

19
00:06:50,725 --> 00:06:55,475
[Hal Turing] Fair enough. Now the two-machine numbers. How far can you push it?

20
00:06:55,475 --> 00:07:26,425
[Dr. Ada Shannon] Parallel layout, side by side, tested at zero to thirty-five centimeters in five-centimeter steps. Right up against each other, the first plus-one degree at the receiver takes three minutes, and plus four degrees arrives around minute twenty-six. At thirty to thirty-five centimeters, the maximum is plus one. Past forty, nothing detectable. The propagation delay, meaning the wait before the receiver's sensor ticks up one degree, grows near-linearly at about 0.35 minutes per centimeter.

21
00:07:26,425 --> 00:07:32,100
[Hal Turing] And is the link symmetric? Left talks to right, right talks to left, same speed?

22
00:07:32,100 --> 00:07:59,300
[Dr. Ada Shannon] No, and that's odd. Identical hardware, identical case, and left-to-right still differs from right-to-left. Their explanation is where the heat sources sit relative to the other case's sensors. Orientation changes what's in the way. Stacking makes the same point. With the top machine transmitting, the receiver gets plus three degrees with a five-minute first-degree delay. With the bottom one transmitting, it's plus one with twelve minutes, since heat rises and the top machine's motherboard sits low in its case. Pause delays, the first degree of drop, are eight and ten minutes.

23
00:07:59,300 --> 00:08:03,550
[Hal Turing] What about the awkward layouts, like desks facing each other?

24
00:08:03,550 --> 00:08:34,250
[Dr. Ada Shannon] That's face-away, backs toward each other. About ten minutes of delay, then never more than one degree over forty minutes, with cooling under three minutes. Side intakes pull in cool air and win. Quadrature, exhaust pointing at the other case's side, six centimeters apart, is the best result: 115 seconds of delay, plus four in eleven minutes, about a hundred seconds to cool. And here's the irony. Put the pair in the middle of a room and the first degree takes about twenty-five minutes, because the exhaust dissipates freely. Walls and furniture help the attacker.

25
00:08:34,250 --> 00:08:37,725
[Hal Turing] Last piece. Does virtualization break it?

26
00:08:37,725 --> 00:08:52,925
[Dr. Ada Shannon] No. A VirtualBox guest with four of eight logical CPUs still works: about three minutes of delay, and a maximum receiver rise of plus three against plus four for a physical host. The hypervisor caps how hard the guest can push.

27
00:08:52,925 --> 00:08:59,800
[Hal Turing] So that's the physical layer. The rate claim lives in the protocol section, which is missing, right?

28
00:08:59,800 --> 00:09:40,575
[Dr. Ada Shannon] Right. Section VI, on modulation, handshake and protocol, is a stack of pages reading 'omitted in the draft', and so is the countermeasures section. The conclusion mentions modulation methods and an initial handshaking protocol with no details. So the one to eight bits per hour has no derivation in the text. I won't invent a symbol duration or a coding scheme. What we have is delays. With one to five minutes of delay in good layouts and comparable cooling, one symbol every few minutes gives ten to twenty symbols an hour at best. Layouts with ten to twenty-five minutes give a few per hour. That's the right order of magnitude for one to eight, but it's arithmetic, not a finding, and it doesn't tell us how 'effective rate' was defined.

29
00:09:40,575 --> 00:09:50,725
[Hal Turing] So what would settle it? And back to that earlier flag: are the introduction's 'eight signals per hour' and the abstract's 'eight bits per hour' the same unit?

30
00:09:50,725 --> 00:10:11,625
[Dr. Ada Shannon] They may well be different. A signal could be a bit, a symbol or a ping, and preamble, checksum and retransmission would all cut the effective rate. What settles it is an end-to-end transfer of a known payload with a measured error rate. The draft has none. The statistics are also thin. Figures 3 through 10 are single time series, with no trial counts and no confidence intervals.

31
00:10:11,625 --> 00:10:22,549
[Hal Turing] And the receiver is a sensor with one degree resolution and poor accuracy when it's cool. A plus-one step sits right at the quantization floor, doesn't it?

32
00:10:22,549 --> 00:10:45,424
[Dr. Ada Shannon] It does. You'd want a control run with the transmitter idle, plus randomized on-off sequences, to separate signal from quantization and drift. The drift is the bigger problem. Every test ran in an air-conditioned office. There's no data on HVAC cycling, sunlight, doors or a neighbor's workload. The layouts alone swing the result from three minutes to twenty-five, and the attacker doesn't pick the layout. The robustness evidence is one thirty-minute trace on one machine.

33
00:10:45,424 --> 00:10:57,699
[Hal Turing] Sorry to cut you off but—the receiver isn't passive either, is it? Its fans react to the incoming heat, and the transmitter's own throttling changes its output as it warms up.

34
00:10:57,699 --> 00:11:16,099
[Dr. Ada Shannon] Exactly. Nobody models those two closed loops. A fan curve change on either side could flatten the channel, and the tests were on 2013 and 2014 desktops with specific motherboard sensors. Laptops or rack servers with front-to-back airflow push exhaust away from neighbors.

35
00:11:16,099 --> 00:11:25,524
[Hal Turing] Still, I'd call the physical channel demonstrated. A four degree rise at the neighbor's sensor is real heat carrying real information.

36
00:11:25,524 --> 00:11:42,824
[Dr. Ada Shannon] I disagree, Hal. They demonstrated heat transfer, not communication. The transmitter ran a steady load and the receiver watched a ramp. Nobody sent modulated data through a drifting, one-degree-resolution sensor and decoded it. That's the hard part, and it's the missing section.

37
00:11:42,824 --> 00:11:51,899
[Hal Turing] Okay, fair. Plausible physics, unproven link. Beyond the acoustic and radio channels we covered, what else is in the neighborhood?

38
00:11:51,899 --> 00:12:14,949
[Dr. Ada Shannon] Masti and colleagues at ETH Zurich, 'Thermal Covert Channels on Multi-Core Platforms' in 2015, get far higher rates on-die, so room-scale heat is the slow regime. Wu, Xu and Wang's 'Whispers in the Hyper-space' from William and Mary in 2012 shows shared hardware in the cloud is much faster. The same Ben-Gurion group's Fansmitter in 2016 turns fan speed into sound. BitWhisper trades rate and range for bidirectionality with no extra hardware.

39
00:12:14,949 --> 00:12:19,824
[Hal Turing] What should defenders do, given the countermeasures section is missing?

40
00:12:19,824 --> 00:13:01,824
[Dr. Ada Shannon] Those are my inferences, not the paper's. Keep machines beyond forty centimeters, point exhausts away from the other's intake, restrict thermal-sensor access, and flag periodic full load at idle hours. Hours of sustained heat is hard to hide. For AI, a GPU node under load is well camouflaged, but datacenter airflow is far noisier than an office. One to eight bits an hour could leak a key or token, never weights. A follow-up needs repeated trials, error rates, a defined throughput and an evaluated defense. O'Shea and Hoydis's 'An Introduction to Deep Learning for the Physical Layer', from Virginia Tech and Nokia Bell Labs in 2017, suggests learned demodulation for a drifting receiver like this. That's an idea here, not something shown.

41
00:13:01,824 --> 00:13:16,899
[Hal Turing] So my takeaway: a memorable channel, because it uses what every PC already has. The physical characterization is the strongest evidence, and the throughput headline is the weakest. Thanks for listening, everyone. Goodbye!