SPECTER USB Leak Shows Air-Gapped PCs Can Exfiltrate Secrets

Korea University researchers revealed a covert channel that lets malware siphon data from isolated computers by manipulating USB power-management settings. The technique, dubbed SPECTER, was tested on Windows 10 and Ubuntu 22.04 and can transmit information at 0.2–1 bit per second through phone charging indicators, peripheral LEDs, or near-field radio signals.

How the Channel Works

SPECTER does not use the USB data bus. Instead, it encodes bits by toggling power-control commands that a host sends to a peripheral. When a device receives a power-on or power-off command, the host’s power-management firmware updates the device state. Malware can time these toggles to represent binary data. The host then emits observable side effects: a phone’s charging icon flickers, a mouse LED turns off, or a small electromagnetic pulse appears near the cable.

Phone Charging State as a Side Channel

An Android app on a Samsung Galaxy S22 or the on-screen indicator on an iPhone 13 Pro can read battery-status updates. Researchers logged 0.2 bits/s on Ubuntu and 0.25 bits/s on Windows. The signal appears as a brief flicker of the charging icon that repeats at the encoded bit rate. The channel requires the phone to be connected to the same USB port that the malware controls.

Peripheral Activity Channels

Disabling a USB mouse caused its LED to turn off, yielding 1 bit/s. A webcam and USB hub produced 0.25 bits/s, while keyboards and headset dongles offered no usable channel. Results varied with host and hardware. The malware must issue a power-off command to the device and wait for the firmware to acknowledge the change. The peripheral’s LED or power state change is the observable output that the attacker records.

RF Capture Path

A HackRF One paired with an LF-R 400 loop antenna touching the cable captured signals near 5 MHz. Reliable reception at distance was not achieved. The RF channel is the most subtle, requiring specialized hardware close to the cable, but it demonstrates that the power-management toggles generate measurable electromagnetic emissions.

Practical Impact

The bandwidth is too low for bulk data, but it suffices for short secrets. A compromised air-gapped machine could leak a password, an authentication token, or a cryptographic key without any network connection. The attack requires administrator or root access, so it is relevant to insider threats or malware that has already breached the system.

Detection and Mitigation

Because SPECTER relies on USB power commands, it can trigger visible side effects. Monitoring for unexpected changes in peripheral state—such as a mouse LED turning off or a webcam powering down—can raise alerts. Phone charging notifications that flicker or change state may also signal activity. RF monitoring is more complex and would need specialized hardware close to the cable.

Organizations that maintain air-gapped environments should restrict USB power-management privileges to trusted processes and audit peripheral behavior. Physical isolation of USB cables and shielding can reduce the RF channel, though the technique’s low data rate limits the threat to small secrets.

What to Verify Now

  • Check whether any USB devices on isolated machines show unexplained power state changes.
  • Ensure that only privileged processes can issue USB power-management commands.
  • Review logs for anomalous peripheral disconnections or LED toggles.
  • Consider deploying RF sniffers near critical cables if the environment warrants it.

Next Steps for Security Teams

  • Update incident-response playbooks to include USB power-channel exfiltration scenarios.
  • Conduct penetration tests that simulate SPECTER-style attacks on air-gapped systems.
  • Educate staff about the risk of insider malware that can manipulate USB power settings.

The SPECTER demonstration underscores that even physically isolated systems can leak secrets through subtle hardware controls. While the channel is slow, its existence expands the attack surface for adversaries who can gain local administrative access.

Explore more on this topic