  Air-gapped computers are computers which are kept isolated from the Internet,
because they store and process sensitive information. When highly sensitive
data is involved, an air-gapped computer might also be kept secluded in a
Faraday cage. The Faraday cage prevents the leakage of electromagnetic signals
emanating from various computer parts, which may be picked up by an
eavesdropping adversary remotely. The air-gap separation, coupled with the
Faraday shield, provides a high level of isolation, preventing the potential
leakage of sensitive data from the system. In this paper, we show how attackers
can bypass Faraday cages and air-gaps in order to leak data from highly secure
computers. Our method is based on an exploitation of the magnetic field
generated by the computer CPU. Unlike electromagnetic radiation (EMR), low
frequency magnetic radiation propagates though the air, penetrating metal
shielding such as Faraday cages (e.g., compass still works inside Faraday
cages). We introduce a malware code-named ODINI that can control the low
frequency magnetic fields emitted from the infected computer by regulating the
load of the CPU cores. Arbitrary data can be modulated and transmitted on top
of the magnetic emission and received by a magnetic receiver (bug) placed
nearby. We provide technical background and examine the characteristics of the
magnetic fields. We implement a malware prototype and discuss the design
considerations along with the implementation details. We also show that the
malicious code does not require special privileges (e.g., root) and can
successfully operate from within isolated virtual machines (VMs) as well.
