Using normal sound and ultrasound, attackers can disrupt the process of reading or writing data to the hard disk. Also, this method can be used to disrupt the launch of the operating system, and in some cases - to damage the hard drives. This conclusion was made by a group of information security specialists based on a series of own experiments.
At the same time, particularly complex devices are not needed, almost suitable means are suitable. In order to perform a sound attack, we need local sound sources, the purpose of which will be a hard disk. The source can be ordinary inexpensive speakers or even laptop speakers. The attack is as follows: the victim visits a certain site or receives a message with a sound file inside. Logging on to the site or opening a message, the sound starts to play, and the user's hard disk crashes.
Researchers
who have studied sound effects on HDD work at the University of Michigan and Zhejiang Universities. Last week, the joint team spoke about the results of its work at one of the information security symposia, the San Francisco IEEE Symposium on Security and Privacy.
Attackers without specialized hardware
can cause hard disk errors by simply playing a recorded audio file in a special way. Sound waves with specific characteristics affect heads and disc plates. In addition, ultrasonic waves affect the anti-shock HDD sensor, which is triggered by forcing heads to park.
Even if you do not disable the HDD, violations of its work
can cause a malfunction of the operating system or problems in the work of various applications. If the sound is played continuously (and the person cannot hear the same ultrasound to stop the playback), then the laptop or computer, which is affected by sound waves, will constantly fail. And the cause of the problem in this case is very difficult to find.
“Our research has shown that even ordinary sound waves can cause malfunctioning of heads, which cannot normally move under the influence of sound. Ultrasonic waves give false positives of the anti-shock sensor, which causes the disc to stop, ”the specialists report says.
In one experiment, a Western Digital Blue WD5000LPVX hard drive computer was used. Sound waves were generated with certain characteristics: 5 kHz and 115.3 dB, as well as 5 kHz and 117.2 dB. The volume roughly corresponds to the signal of the car or the noise of a working chainsaw.
As it turned out, prolonged exposure to sound with such characteristics can cause data loss, software crashes, or damage to the hard disk.
The experiments were carried out with disks from three different manufacturers: Western Digital, Toshiba and Seagate. Scenario "sound attack" also included the effects of ultrasound. “Ultrasound leads to problems with the read head in fewer cases than normal sound. But this type of attack allows you to damage the hard drive in another way - for example, emergency parking, ”the report says.
The results of the experiment showed that the researchers succeeded in damaging the HDD by repeatedly triggering the disc head parking. He continued to work, but was already less reliable, in addition, some normal sectors were marked as bad.
Experts did not stop at this. They conducted another experiment, this time with the HP Elite Minitower desktop PC, equipped with an HP DC7600U speaker. Using the device’s own sound system, the experimental sound attack system was able to disrupt the operation of the Western Digital Blue WD5000LPVX HDD hard drive.
“For attacks of this kind do not need any tricks. Enough site with automatically starting to play sound with the desired characteristics of attackers or phishing email with a sound file of the same configuration. The built-in audio system of a laptop or PC does not always allow to reproduce sound in full quality, but in many cases the frequency spectrum is sufficient to affect the HDD, ”the researchers say.
The operating system is not always normally perceives the strange work of the hard disk. The same Windows 10 may crash with a message like UNEXPECTED_STORE_EXCEPTION. This means that the memory manager tries to access the data on the disk, but cannot write data due to a read / write problem.
By the way, practical confirmation of the experimental part was ready long before the start of the tests themselves. No, this is not a mistake - the fact is that in April of this year, the fire alarm system, more precisely, the sound it produced,
brought down more than 30% of servers in the Digiplex data center near Stockholm.