  Because computers may contain or interact with sensitive information, they
are often air-gapped and in this way kept isolated and disconnected from the
Internet. In recent years the ability of malware to communicate over an air-gap
by transmitting sonic and ultrasonic signals from a computer speaker to a
nearby receiver has been shown. In order to eliminate such acoustic channels,
current best practice recommends the elimination of speakers (internal or
external) in secure computers, thereby creating a so-called 'audio-gap'. In
this paper, we present Fansmitter, a malware that can acoustically exfiltrate
data from air-gapped computers, even when audio hardware and speakers are not
present. Our method utilizes the noise emitted from the CPU and chassis fans
which are present in virtually every computer today. We show that a software
can regulate the internal fans' speed in order to control the acoustic waveform
emitted from a computer. Binary data can be modulated and transmitted over
these audio signals to a remote microphone (e.g., on a nearby mobile phone). We
present Fansmitter's design considerations, including acoustic signature
analysis, data modulation, and data transmission. We also evaluate the acoustic
channel, present our results, and discuss countermeasures. Using our method we
successfully transmitted data from air-gapped computer without audio hardware,
to a smartphone receiver in the same room. We demonstrated the effective
transmission of encryption keys and passwords from a distance of zero to eight
meters, with bit rate of up to 900 bits/hour. We show that our method can also
be used to leak data from different types of IT equipment, embedded systems,
and IoT devices that have no audio hardware, but contain fans of various types
and sizes.
