To protect important data and files, people often use air gap isolation, also known as air gap separation, to block external threats. However, internal networks may still introduce pollution due to supply chain contamination, human error, or social engineering. Although internal devices cannot directly communicate with the outside world. This paper proposes a new technology called Bit Sufi-Dance that utilizes electricity meters and optical devices to detect exfiltrated data. Most electricity meters have power indicator mechanical turntables or LED lights which can be indirectly controlled by the device’s power consumption oscillation. This allows for information encoding and the extraction of data from the air-gapped computer. It is important to note that this exfiltration channel does not require any hardware or firmware modifications and cannot be detected by existing Data Leakage Prevention (DLP) systems. The article discusses its design and implementation issues while evaluating it using different types of electricity meters. Our experiment demonstrates that data can be exfiltrated from the air-gap isolated computer through an electricity meter at a bit rate of 101 b/h. Finally, we assess this security threat and discuss defense mechanisms and preventive measures.

The rapid development of low-Earth-orbit (LEO) satellite constellations has not only provided global users with low-latency and unrestricted high-speed data services but also presented researchers with the challenge of understanding dynamic changes in global network behavior. Unlike geostationary satellites and terrestrial internet infrastructure, LEO satellites move at a relative velocity of 7.6 km/s, leading to frequent alterations in their connectivity status with ground stations. Given the complexity of the space environment, current research on LEO satellite internet primarily focuses on modeling and simulation. However, existing LEO satellite network simulators often overlook the global network characteristics of these systems. We present SatScope, a data-driven simulator for LEO satellite internet. SatScope consists of three main components, space segment modeling, ground segment modeling, and network simulation configuration, providing researchers with an interface to interact with these models. Utilizing both space and ground segment models, SatScope can configure various network topology models, routing algorithms, and load balancing schemes, thereby enabling the evaluation of optimization algorithms for LEO satellite communication systems. We also compare SatScope’s fidelity, lightweight design, scalability, and openness against other simulators. Based on our simulation results using SatScope, we propose two metrics—ground node IP coverage rate and the number of satellite service IPs—to assess the service performance of single-layer satellite networks. Our findings reveal that during each network handover, on average, 38.94% of nodes and 83.66% of links change.

To protect critical computing systems from network attacks, modern enterprises typically employ physical isolation measures to disconnect them from open networks such as the Internet. However, attackers can still infiltrate these closed networks through internal employees or supply chain vulnerabilities. This presents the primary challenge that attackers face: how to effectively manage and manipulate infected devices that are isolated from the external network. In this paper, we propose a new covert communication technology called HydraulicBridge, which demonstrates how air gap networks can communicate through covert water pressure-fluctuation channels. Specifically, we demonstrate how water pressure from water pipes can be used to communicate with infected hosts within an air gap network. Additionally, we provide experimental results demonstrating the feasibility of covert channels and test the communication speed in the experimental environment. Finally, we offer a forensic analysis and propose various methods for detecting and blocking this channel. We believe that this study provides a comprehensive introduction to previously unseen attack vectors that security experts should be aware of.

Power lines are commonly utilized for energy transmission, and they serve as a conduit for data exfiltration or infiltration in some specific scenarios. This paper explores the feasibility of establishing bidirectional communication between a modified plug and the equipment power line within an air-gapped network organization and with external entities. Bidirectional air-gap communication includes two scenarios, the data leak from air-gapped networks and the transmission of external data to air-gapped networks, namely, exfiltration and infiltration. In the exfiltration scenario, software in the air-gapped networks modulates and encodes data by manipulating the power consumption of the equipment during transmission, which is then sent outside through the power line. The device utilizes a smart plug power meter to record current fluctuations and subsequently decode any leaked data. In the infiltration scenario, a smart plug is used to control the power supply status of a device’s power cord, enabling data encoding and decoding by turning the power supply on and off. The software in the air-gapped equipment captures and decodes the power supply status to infiltrate. We discuss relevant literature and provide scientific background on smart plugs and power line communication. We simulate the communication scenario, propose a communication scheme, and present data modulation techniques as well as a communication transmission protocol for air-gap channels. Our evaluation of the PowerBridge air-gap channels demonstrates that data can leak from the air-gapped computer into the power line at an approximate rate of 30 bps, which can be captured by the smart plug. Additionally, it is possible for data to penetrate from the smart plug into air-gapped networks at a speed exceeding 1 bps.