Talking to the Airgap: Exploiting Radio-Less Embedded Devices as Radio Receivers
Paul Staat, Daniel Davidovich, Christof Paar
cs.CR
2025-12-17
Ruhr University Bochum and MPI-SP turn radio-less boards into receivers via PCB traces and on-chip ADCs. All 14 devices couple; a Nucleo board gets 1 kbps at 20 m with 6.2% BER.
An airgap physically disconnects a machine from outside networks. That raises the cost of remote attack. It does not make code execution impossible. Supply-chain implants, malicious USB drops, and hardware Trojans still land malware on isolated controllers and hardware wallets. Once the code is there, the attacker still needs a way to talk to it later: rotate keys, retarget, or change a trigger without walking back into the building.
Twenty-five years of airgap research mostly studied outbound leakage. Inbound channels are thinner, and the ones that exist bolt onto a microphone, a temperature sensor, an LED, or a camera. Distances are short, rates are low, and many setups need line of sight. Kasmi et al. pushed a kilowatt-class RF field into a temperature sensor and got 2.5 bit/s at 20 m. This paper asks a blunter question: can a commodity embedded board with no radio and no dedicated sensor receive commands at all?
PCB traces behave as accidental UHF antennas between 300 and 1000 MHz. Nonlinearities at GPIO pins and on-chip ADCs mix that energy down to baseband. Malware that already runs on the MCU can retune a pin into analog mode, sample the ADC, and demodulate in software. No extra antenna, LNA, or mixer.
To find a usable path they brute-force:
The lab transmitter is a SignalHound VSG60 plus a 50 dB amplifier, up to 43 dBm (about 20 W), through a 6.5 dBi antenna. The reference board is a Nucleo-G474RE. The same sweep then runs on 12 commercial devices and two custom PCBs, including Ledger, Trezor, COLDCARD, and Passport hardware wallets plus a Crazyflie drone.
Modulation is on-off keying: carrier present is 1, absent is 0. A moving-average threshold on ADC block means decides the bit.
All 14 devices showed usable RF sensitivity in the 300-1000 MHz band. Peak SNR spans a wide range: 62 dB on Crazyflie 2.1+, 34 dB on Passport, 33 dB on Nucleo-G474RE, 11 dB on Ledger Nano S Plus.
Against prior inbound airgap channels:
| Channel | Sensor | Distance | Rate |
| Thermal | thermometer | 0.4 m | 0.002 bit/s |
| Kasmi RF injection | thermometer | 20 m | 2.5 bit/s |
| Ultrasonic | microphone | 8 m | 166 bit/s |
| This work | none (the board itself) | 20 m | 1 kbit/s, up to 100 kbit/s |
Field test on Nucleo path B, 868 MHz, 1 kbps, 43 dBm:
Under ideal sync, 7 of 10 paths stay under 1% BER at 10 dBm arrival power (about 10 mW). Path B is under 2% BER at 0 dBm (about 1 mW). Detectable arrival power goes down to -7 dBm (about 0.2 mW): several orders of magnitude below Kasmi's kilowatt transmitter, at roughly 400 times the bit rate.
A metal shielding box kills the sensitivity. A plastic case does not. A continuous ground plane drops SNR by more than 20 dB; residual coupling remains.
Airgap threat models have treated "no radio chip" as "no inbound radio." That assumption does not hold if the MCU has an ADC and the PCB traces couple. After a one-shot implant, an attacker can update payloads from outside the perimeter, through walls, without a second physical visit.
The artifacts are concrete: firmware, sweep scripts, and custom-board files are on Zenodo. On the defense side, metal enclosures and a ground plane are the knobs that actually moved. A plastic shell is not isolation.
This is a new physical attack surface, not a small algorithmic tweak.
No ADC means no digital handle on the analog disturbance. The receiver is not frequency-selective, so nearby strong interferers can swamp it. Measurements used bare PCBs; product enclosures, cables, and displays are mostly untested. Wallet experiments replaced the original MCU with a blank part of the same model; how an attacker first gets code execution is out of scope. Everything is STM32. FPGAs, phones, and laptops are listed as future work. High-EM environments such as data centers were not tested. Sampling a pin as an ADC temporarily disables that pin's normal job.
The 20 m demo used 43 dBm, about 20 W plus a directional antenna, not a pocket dongle. At 23 dBm from a single-chip transceiver, reliable range fell to about 2 m. The lab BER curves ignored on/off transients. A real implant has to share the device's legitimate firmware, and glitches or timing anomalies could give the implant away.