Skip to content
בס״ד
Cyber Replay logo CYBERREPLAY.COM
Book a Call
Back to all articles
Security Operations 14 min read Published Jul 5, 2026 Updated Jul 5, 2026

Defend Air-Gapped Systems Against TrojPix-Style Covert Channels: Practical Controls for High-Security Environments

Practical, operator-grade controls to reduce covert-channel risk on air-gapped systems in high-security environments. Checklists, commands, and next steps.

By CyberReplay Security Team

TL;DR: Implement layered physical, procedural, and monitoring controls to cut covert-channel attack surface by most vectors - reduce detection time from days to hours with targeted monitoring, and limit exfiltration bandwidth to bits-per-minute where attacks exist. Use the checklists below to harden nursing home operational tech and medical devices fast, then schedule an assessment with a managed security provider.

Table of contents

Quick answer

Air-gapped system covert channel mitigation requires layered controls: strict physical separation, device allowlists and inventory, continuous RF and acoustic sweeps, host-based integrity checks, strict USB and peripheral policies, and a response playbook tied to an MSSP or MDR. Implementing the controls below should materially reduce the practical risk of data exfiltration over covert channels and lower mean detection time from multi-day discovery to hours when monitoring is configured.

For a fast external review or to arrange a hardened monitoring deployment, request a short assessment from a managed detection and response provider: Request a CyberReplay assessment. For details on available engagements and scopes, see CyberReplay’s cybersecurity services page.

Why this matters for nursing homes

Nursing homes rely on a mix of clinical devices, point-of-care workstations, and aging IT that is often physically isolated to meet privacy or regulatory goals. That isolation creates a false sense of security. Academic research and red-team tools show that air gaps can be bridged by covert channels - acoustic, electromagnetic, optical, thermal, and power-line modulation - at low bandwidth but sufficient to leak credentials, configuration files, or small patient records.

Risk impact for nursing homes:

  • Patient privacy breach - exposure of protected health information increases regulatory fines and notification costs.
  • Operational disruption - investigation and device quarantines can increase staffing overhead by 10-30% during an incident window.
  • Patient safety - delayed device availability increases clinical risk when devices require isolation for remediation.

Conservative operational target: reduce covert-channel attack surface by 60-80% in 90 days with targeted controls and reduce time-to-detect to under 24 hours for suspicious signals when monitoring is deployed.

Definitions: covert channel, TrojPix-style threats, and air gap

  • Covert channel: any unintended communication path that allows information flow outside designed interfaces. Examples include modulating speaker output, blinking LEDs, or RF emissions.
  • TrojPix-style threats: malware families and proof-of-concept tools that encode data into nonstandard channels for exfiltration from isolated systems. These are low-bandwidth but stealthy and purpose-built to bypass network controls.
  • Air gap: physical or logical separation of a sensitive system from untrusted networks. Air gaps reduce many risks but do not remove side-channel or covert-channel threats.

Key observation: covert channels trade bandwidth for stealth. A single credential or configuration blob can often be exfiltrated in minutes when a covert channel exists.

Core controls - physical and procedural

These are highest-leverage controls. Start here before heavy technical investment.

1) Physical device inventory and strict zoning

  • Maintain a current inventory of every device in isolated zones. Use serial, MAC, and physical asset tags.
  • Enforce zones: “critical air-gapped”, “limited-access lab”, “general IT”. Limit physical access to the air-gapped zone to vetted personnel.
  • Quantified outcome: inventory and zoning typically reduce unauthorized device presence by over 90% in audited environments.

2) Perimeter and room-level RF and acoustic hardening

  • For sensitive rooms, install RF-attenuating window film or Faraday cages for cabinets where practical. At minimum, control openings and cable penetrations.
  • Remove or shield speakers and microphones from critical hosts. Consider removing LEDs that can be manipulated to leak optical signals.

3) Strong USB and removable media policies

  • Disallow consumer USB devices. Use cryptographically signed USB drives for approved workflows only.
  • Require hardware write-blockers for any forensic or data-transfer task.
  • Enforce logging for any removable-media event with two-person authorization for transfers into or out of air-gapped zones.

4) Physical escort and process controls

  • Require escorted access for visitors and vendors. Log all maintenance events and produce post-maintenance checklists verifying no unauthorized devices were left behind.

5) Dedicated maintenance stations

  • Use dedicated jump stations that are inspected and hardened for file import/export. Inspect and reimage jump stations frequently - daily to weekly based on risk.

Checklist - physical and procedural

  • Complete asset inventory for all air-gapped devices within 14 days.
  • Implement documented zone access rules and enforce badges/keycards.
  • Remove all speakers/microphones or disable them in firmware where possible.
  • Adopt signed removable-media policy with two-person approvals.
  • Schedule weekly RF/acoustic sweep on a 30-90 day cadence depending on sensitivity.

Core controls - technical monitoring and detection

These controls detect attempted covert channels or reduce their effectiveness.

1) RF and electromagnetic monitoring

  • Deploy portable or fixed spectrum monitoring to scan common bands: 315 MHz - 2.4 GHz, and up through several GHz for known attacks. Baseline normal emissions and alert on anomalies.

Sample rtl-sdr scan with rtl_power (Linux, requires RTL-SDR dongle):

# scan 400 MHz - 1.6 GHz, output CSV for baseline analysis
rtl_power -f 400M:1600M:200k -i 10 -e 1h scan-baseline.csv
  • Operational note: automated alerts should be tuned to avoid frequent false positives. Start with threshold-based alerts then add anomaly detection.

2) Acoustic monitoring

  • For rooms where acoustic channels are realistic, deploy directional microphones or vibration sensors to detect modulated signals. Use spectral analysis to detect narrow-band tones that vary with CPU load or disk activity.

3) Host integrity and peripheral logging

  • Enable host-level logging of peripheral attach/detach events, process execution, and unusual power-state changes. For Linux, forward auditd events; for Windows, forward Sysmon events for device and process telemetry.

Example Sysmon config snippet to log USB and process events (Windows):

<!-- sample Sysmon rules to log Create, Stop and Driver load events -->
<Sysmon schemaversion="4.22">
  <EventFiltering>
    <ProcessCreate onmatch="include"/>
    <FileCreateTime onmatch="include"/>
    <DriverLoad onmatch="include"/>
  </EventFiltering>
</Sysmon>

4) Power and current monitoring

  • Monitor power rails on critical devices. Covert channels like PowerHammer manipulate current to send low-bandwidth signals. Sudden, patterned current variations outside baseline can indicate tampering.

5) Optical emitter detection

  • Use light sensors or cameras to detect high-frequency LED blinking patterns on devices. Capture and analyze at 1000 Hz sampling where practical.

6) Behavioral whitelisting and process allowlists

  • Where possible, enforce application allowlists and disable interpreters or scripting engines that are not required. Microsegmentation of services inside the host limits ability to run covert encoders.

Detection-to-response SLA

  • Target detection SLA: suspicious RF/acoustic anomaly escalated within 4 hours.
  • Target containment SLA: physical response team on-site within 8 hours for nursing homes with on-site security; if not possible, have remote forensics and containment playbook with MDR partner.

Implementation checklist - 30, 60, 90 day plan

Concrete, time-boxed actions for operators.

30 days - Stabilize

  • Build device inventory and zone map.
  • Disable non-essential microphones and speakers on air-gapped hosts.
  • Implement removable media policy and two-person approval.
  • Deploy host-level logging to a secure offline collector.

60 days - Detect

  • Run baseline RF scan and acoustic baseline in all critical rooms.
  • Deploy one portable spectrum analyzer and schedule weekly sweeps.
  • Configure SIEM rules for device attach/detach and unusual process execution.

90 days - Harden and integrate

  • Install long-term RF monitoring where risk justifies it and integrate alerts with MDR.
  • Implement power monitoring on at-risk cabinets.
  • Conduct a red-team simulation for covert-channel exfiltration and test detection pipeline.

Operational scenario - attack, detection, response, remediation

Scenario: an attacker implants a small transmitter disguised in a maintenance USB tool. Malware on the air-gapped workstation encodes a single patient file and blinks an LED and generates narrow-band RF patterns during a scheduled maintenance window. Exfiltration rate is low - a few bits per second - but sufficient to leak a single record in under 10 minutes.

Detection path in hardened environment:

  1. Baseline RF monitor flags a narrow-band emission at 433 MHz during a maintenance window.
  2. Alarm triggers SIEM rule that correlates with Sysmon event showing a new process spawned and an unexpected USB attach.
  3. MDR analyst receives alert - escalates to on-site security for physical inspection.
  4. Physical team discovers an unauthorized maintenance device and quarantines it.
  5. Forensic image and integrity checks confirm compromise. A reimage and certificate rotation occur.

Outcome and metrics:

  • Time-to-detect: reduced from estimated multi-day discovery to under 3 hours with monitoring and SIEM correlation.
  • Containment time: less than 8 hours from alert to physical quarantine when MDR coordinates with facility staff.
  • Residual impact: isolated device reimaged and credentials rotated - service-level impact limited to the affected workstation only.

Objections and trade-offs answered

Objection: “This sounds expensive and disrupts operations.” Answer: Prioritize controls by risk and impact. The highest ROI items are inventory, USB policy, and host logging - low cost and non-disruptive. RF and acoustic monitoring can be phased in at higher-risk areas.

Objection: “Legacy medical devices cannot be patched or taken offline.” Answer: Use zoning and dedicated jump stations. Where firmware cannot be updated, apply compensating controls - physical shielding, strict access control, and monitoring of power and emissions around those devices.

Objection: “We will get too many false positives from RF scans.” Answer: Start with scheduled baseline scans to create a noise profile, then tune threshold alerts. Use correlation with host logs to filter environmental noise. Over time, anomaly detection reduces false positives.

Get your free security assessment

If this air-gapped system covert channel mitigation is a live priority for your team, schedule your assessment for a focused review. Alternatively, request a tailored operational assessment and baseline from CyberReplay: Request CyberReplay operational help. We will map the biggest gaps, assign the first actions, and turn the article into a practical 30-day plan.

Air gaps reduce many risks but do not eliminate covert channels. For nursing homes and other high-security environments, the practical path is layered: enforce physical and procedural hardening first, then add targeted monitoring and host telemetry. A focused 90-day plan cuts exposure quickly while allowing operational constraints.

Next-step recommendation: run a prioritized assessment of your air-gapped zones that includes an asset inventory, a baseline RF and acoustic sweep, and a quick SIEM and host-logging health check. If you want low-friction help, book a brief 15-minute consultation to scope a short assessment: Schedule a 15-minute assessment. For a hands-on option, engage a managed security provider to run a 48-72 hour assessment and deliver prioritized remediation items: Request a 48-72 hour assessment. For other engagement types and operational help, see CyberReplay’s operational help page.

References

What should we do next?

Start with an inventory and a short assessment. Actionable next steps for a nursing home IT leader:

  • Within 14 days: complete air-gapped asset inventory and remove or lock down all non-essential peripherals.
  • Within 30 days: enforce removable-media policy and deploy host-level logging to a secure collector.
  • Within 60 days: baseline RF/acoustic emissions and schedule weekly sweeps for at least one month.

If you prefer external help, a managed detection and response engagement can perform the inventory and baseline in 48-72 hours and hand you a prioritized remediation plan - see https://cyberreplay.com/managed-security-service-provider/.

How do we detect acoustic or RF covert channels?

Detecting these channels requires baseline profiling and continuous monitoring:

  • RF: use spectrum analyzers or RTL-SDR devices to log power across bands. Automate baseline collection over 24-72 hours, then alert on narrow-band or periodic signals that exceed baseline thresholds.
  • Acoustic: collect audio samples and run short-time Fourier transform analysis to find narrowband carriers. Directional microphones reduce environmental noise.
  • Correlate with host telemetry: USB attach events, unusual process execution, or scheduled tasks increase confidence that an emission is malicious.

Quick command to create an RF baseline (example using rtl_power):

rtl_power -f 400M:1600M:200k -i 10 -e 12h rf-baseline.csv
# Then plot or analyze rf-baseline.csv for recurring peaks

What about legacy medical devices that cannot be patched?

Treat legacy devices as high-risk assets and apply compensating controls:

  • Move them to the most isolated zone possible and restrict physical access.
  • Place them inside shielded cabinets or Faraday enclosures if signals are a concern.
  • Limit maintenance to vetted staff and use dedicated, inspected jump stations for any data transfer.
  • Monitor power and emissions around these devices and correlate anomalies with device logs.

Will hardening break our SLAs or patient workflows?

Any change requires planning with clinical staff. Start with low-impact controls:

  • Inventory and zoning have no operational downtime.
  • USB policy can be phased in with approved signed-media processes.
  • RF sweeps are passive and non-intrusive.

For controls that may affect workflows, run a short pilot with affected teams for 7-14 days and measure impact on task completion time. Use the pilot data to refine controls to meet SLAs.

When should we call an MSSP or incident response team?

Call an MSSP or IR team when:

  • You detect unexplained narrow-band RF or acoustic signals correlated with host telemetry.
  • You find unauthorized devices in an air-gapped zone.
  • You confirm signs of data encoding or process-level anomalies on a sensitive host.

A managed partner can perform rapid triage, coordinate physical containment, and handle forensic imaging. If you need an immediate external assessment, consider https://cyberreplay.com/help-ive-been-hacked/ or https://cyberreplay.com/my-company-has-been-hacked/ to initiate response support.

When this matters

Air-gapped system covert channel mitigation matters whenever sensitive data sits on systems that are intentionally isolated but still accessible to people, maintenance workflows, or legacy devices. Prioritize this work in environments where exfiltrated small data items have high impact:

  • Healthcare and nursing homes with patient-identifiable data on isolated workstations or point-of-care systems.
  • Industrial control and OT settings where leaked credentials or control logic cause safety risk.
  • Forensic, research, or classified labs that use removable media or jump stations.
  • Facilities with frequent vendor maintenance, unmanaged peripherals, or elevated insider risk.

Red flags that should trigger immediate action:

  • Unexplained maintenance visits or devices left inside a secure zone.
  • New USB or peripheral attach events that lack approved change records.
  • Narrow-band RF or periodic acoustic tones coincident with device events, or unusual LED activity.
  • Patterned power fluctuations on cabinets or jump stations.

Next step: if you observe any of these red flags, schedule a focused operational assessment. A short managed security assessment can map assets, baseline emissions, and harden jump-station workflows; see https://cyberreplay.com/managed-security-service-provider/ and request targeted help at https://cyberreplay.com/cybersecurity-help/.

Common mistakes

Teams frequently implement good ideas but leave predictable operational gaps that enable covert channels. Common mistakes and immediate mitigations:

  • Treating the air gap as absolute security. Mitigation: adopt a covert-channel threat model and instrument emissions, power, and peripherals.
  • Skipping a full asset inventory. Mitigation: complete inventory with serials, MACs, and asset tags within 14 days.
  • Allowing generic USB or consumer removable media. Mitigation: use cryptographically signed media and enforce two-person approvals.
  • Using ad-hoc jump stations that are not inspected or reimaged. Mitigation: dedicate jump stations and reimage on a fixed cadence.
  • Relying on a single telemetry stream. Mitigation: correlate host logs, RF/acoustic baselines, and power monitoring before escalating.
  • Not enforcing maintenance escort and post-maintenance verification. Mitigation: require escorts, logged checklists, and two-person sign-off.

If you need help prioritizing fixes, a short operational review or a focused engagement can identify high-ROI items quickly; see https://cyberreplay.com/cybersecurity-services/.

FAQ

Q: How much data can TrojPix-style covert channels realistically exfiltrate?

A: It depends on channel and distance. Proofs-of-concept show rates from a few bits per minute up to several bits per second for optimized setups. In realistic nursing-home scenarios expect credentials or small configuration blobs to leak within minutes to an hour; large datasets remain impractical over covert channels.

Q: Will RF or acoustic monitoring create privacy concerns for patients?

A: Properly configured RF scans and narrowband acoustic detectors look for spectral anomalies and signatures rather than recording conversations. Work with your privacy officer so monitoring retains only signatures and does not store identifiable audio.

Q: Will hardening break clinical workflows or SLAs?

A: Start with low-impact, high-ROI controls: inventory, USB policy, host logging, and jump-station hardening. Pilot any change that may affect workflows for 7-14 days and measure impact before broader rollout.

Q: We found suspicious emissions or an unauthorized device. What should we do now?

A: Isolate the affected system, preserve forensic evidence, rotate credentials, and engage incident response. For rapid external triage and remediation, see https://cyberreplay.com/help-ive-been-hacked/ or request a short assessment at https://cyberreplay.com/managed-security-service-provider/.