BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations
Mordechai Guri, Matan Monitz, Yisroel Mirski, Yuval Elovici
cs.CR
2015-03-27
BitWhisper is a bidirectional covert channel between air-gapped PCs using CPU heat and stock sensors. Range is 0–40 cm at 1–8 bits per hour, enough for short commands or passwords.
Air-gap doctrine says two physically isolated machines cannot exchange data even if both are compromised. Acoustic, optical, and electromagnetic leaks can carry bits one way, but they often need extra hardware or cannot send commands back into the isolated net.
BitWhisper tries a slower path: two off-the-shelf desktops talking through heat they already dump and thermal sensors they already have. The goal is not bulk transfer. It is short inbound commands and tiny outbound secrets across a desk.
The sender stresses or idles the CPU in software to modulate case exhaust. The receiver samples onboard thermal sensors and turns ambient temperature swings into bits. The channel is half-duplex; either PC can transmit or receive. CPU, GPU, and motherboard sensors idle near 33–35°C with typical 1°C resolution. The ambient case sensor tracks the room better than the CPU core sensor and is less jerked around by brief foreground spikes.
Hardware includes i7-4790 towers, a Lenovo SFF Core 2 Duo, and a larger Gigabyte tower. Layouts follow office desks: side by side, stacked, back to back, and at an angle. Distances run from contact to 35 cm. A VirtualBox guest can still heat the physical CPU enough to transmit. Sampling uses HWInfo at about 0.5 Hz. The modulation and handshake section is omitted in this arXiv draft; only physical-layer measurements are in the public text.
Beyond 40 cm the receiver does not see a usable temperature change. At contact, the first +1°C takes about three minutes and about +4°C accumulates by minute 26. At 30–35 cm the ceiling is about +1°C. In the parallel layout each extra centimeter adds roughly 0.35 minutes of thermal delay. Stacking is asymmetric: about five minutes when the sender sits on top, about twelve when it sits below, because motherboards usually live in the lower half of the case.
Forty minutes at 100% CPU raises core temperature by about 20°C and motherboard sensors by about 10°C. Ambient sensors need 1.5–3 minutes per degree. Writing documents, browsing many tabs, and watching video barely move ambient temperature, so a workstation can listen during the workday if it is not under unusual load. A VM guest's heating curve stays close to the host's. The stated rate is eight signals per hour, written in the abstract as 1–8 bits/h: enough for a short command or a password, not a file.
| Condition | Observation | Read-out |
| Distance >40 cm | no usable rise | desk-scale radius |
| 0 cm parallel | +1°C in 3 min, +4°C in 26 min | strongest, still minute-scale |
| 30–35 cm | at most +1°C | modulation must live at 1°C resolution |
For isolation and side-channel work, "air-gapped means no channel" becomes "there is a very slow bidirectional thermal channel at desk spacing." No radio, ultrasonic speaker, or visible LED is required, only two implanted office PCs. The rate sets the use: C2 heartbeats, toggling a module, lifting a password. It does not empty a disk. The 2015 numbers are still the right scale for air-gap threat talk, not an imagined broadband pipe.
Range is 40 cm. Case vents and layout change delay; open rooms and air-conditioning dilute the plume. The link is half-duplex and directionally asymmetric. Modulation details are missing from this draft, so handshake and bit-error behavior cannot be checked. One-degree resolution plus minutes of thermal inertia keep the ceiling at a few bits per hour. Both machines must already be compromised. Night-time idle is cleaner; the CPU core sensor is swamped by ordinary daytime load.