Researchers Reveal USB Power‑Based Side‑Channel That Can Exfiltrate Data from Air‑Gapped PCs

Security researchers have demonstrated a novel side‑channel attack named SPECTER that can siphon information from computers isolated from any network by exploiting the power signals on USB ports.

Air‑gapped systems are traditionally regarded as highly secure because they lack direct network connections, forcing organizations to rely on physical separation to protect sensitive data. However, side‑channel techniques that leverage electromagnetic, acoustic, or power‑line emissions have increasingly shown that isolation alone is insufficient to guarantee secrecy.

SPECTER works by subtly modulating the current drawn through a USB port. By rapidly changing the power draw—such as by toggling charging states or manipulating attached peripherals—the compromised machine can encode binary data onto the power line. A malicious device connected to the same USB hub, or even a smartphone used for charging, can detect these fluctuations and reconstruct the transmitted information.

In a controlled laboratory setup, the researchers equipped a target computer with a compromised driver that could control USB power levels. They then used a simple USB‑connected device to monitor the power variations and successfully recovered sample data, including text strings and cryptographic keys, without any network traffic or data‑line communication. The proof‑of‑concept confirms that even a seemingly innocuous charging cable can become a covert exfiltration conduit.

The discovery raises concerns for sectors that depend on air‑gap strategies, such as critical infrastructure, defense, and financial services. Mitigation may involve disabling USB charging ports, employing data‑only cables that block power delivery, or installing monitoring tools that flag abnormal power‑draw patterns. Existing hardware‑based filters and firmware checks could also be updated to detect the rapid power changes characteristic of the SPECTER method.

While the attack currently requires the presence of malicious software on the isolated machine, its feasibility underscores the need for broader threat modeling that includes non‑network channels. Industry analysts expect vendors to explore detection signatures and for security policies to incorporate stricter controls on USB peripherals, especially in environments that rely on physical isolation as a primary defense layer.