How malware crosses an air gap: USB firmware, sound, light and radio
An air-gapped computer has no Ethernet, no Wi-Fi, no Bluetooth, and no route to the internet of any kind. On paper, malware cannot reach it, and data cannot leave it. In practice, isolation is a transport problem, and transport problems get solved. Documented cases of data crossing air gaps fall into two families: removable media carried by humans, and covert channels built from hardware that was never meant to communicate.
Stuxnet: the documented breach
The best-documented case remains Stuxnet, the worm that sabotaged centrifuges at Iran's Natanz enrichment plant and surfaced in 2010. Kim Zetter's book Countdown to Zero Day, excerpted at Wired in 2014, describes how early infections appeared at five 'patient zero' contractor organizations, including Behpajooh, Neda Industrial Group, Foolad Technic and CGJ - companies plausibly positioned to carry hardware into the plant. Infected USB flash drives made the final hop past the gap. Inside networks, the worm copied itself over LANs with a Windows print-spooler zero-day, and onto new machines from drives via the .LNK shortcut flaw known as CVE-2010-2568. Kaspersky's 2018 Securelist report on USB-borne threats notes that the same LNK exploit was later reused by Equation, Flame, Regin and HackingTeam, and that it still ranked among the top drive-root threats years after Microsoft closed the last vulnerable code path in March 2015. The same report describes ProjectSauron, documented in 2016, using modified USB drives with hidden reserved partitions of several hundred megabytes to move data out of air-gapped networks.The covert-channel research lineage
Since the mid-2010s, Mordechai Guri's group at Ben-Gurion University in Israel has published a catalogue of ways to move bits off a machine with no network interface at all: the blink of hard-drive activity LEDs, the whine of CPU and GPU fans, acoustic noise from disks, heat fluctuations, infrared from surveillance cameras, and radio emissions from ordinary components. The lab's research site indexes these projects. They are deliberate designs, not accidents: the attacker already runs code on the victim and needs a channel that no firewall can block, because there is no firewall in the path. USBee, the group's 2016 radio experiment, is the cleanest example. In the paper's own words, "software can intentionally generate controlled electromagnetic emissions from the data bus of a USB connector" - an unmodified USB port turned into a small transmitter. According to the paper, the signal carries 20 to 80 bytes per second over short distances and can be received with software-defined radio. The abstract also points back to COTTONMOUTH, a hardware implant from the NSA's ANT catalogue that hid a radio transceiver inside a USB plug. The research lineage, in other words, mirrors capabilities agencies built first.USB firmware: the inbound problem
Getting in through USB got a name in 2014, when researcher Karsten Nohl demonstrated at Black Hat that a device's own firmware can be reprogrammed so a stick acts as a keyboard, impersonates a network card, or silently alters files while its storage partition looks clean to any scan. Wired's headline on the work was blunt - the security of USB is fundamentally broken - because malware living in the device controller is invisible to antivirus products that inspect only the storage.Lab demos versus field reality
It matters which channels have actually been seen in the wild. USB delivery is field-proven: Stuxnet, the ProjectSauron hidden-partition drives, and Dark Tequila, the banking malware reported in 2018 that had spread through infected USBs in Mexico since at least 2013 while moving laterally between offline machines. Kaspersky's data puts the background risk in perspective: roughly one in four users worldwide experiences a 'local' incident - LAN or removable media - in a year, with 113.8 million removable-media detections in 2017 alone. The acoustic, light, thermal and radio channels are a different category: research demonstrations with low bit rates, short ranges, and a receiver that must physically sit near the victim.- Removable-media delivery: proven in the field, repeatedly, for over a decade.
- Firmware-level USB attacks: publicly demonstrated since 2014; rarely attributed in real incidents.
- Hidden USB partitions for exfiltration: reported in ProjectSauron.
- Acoustic, LED, thermal and radio covert channels: lab prototypes, not observed toolkits.