Janet Jackson Song from 1989 declared a cybersecurity vulnerability for CRASHING Hard Drives

WTF?!

It sounds like something out of an urban legend: Some Windows XP-era laptops using 5400 RPM spinning hard drives can allegedly be forced to crash when exposed to Janet Jackson’s 1989 hit “Rhythm Nation.”

“People of the world today, are we looking for a better way of life?” sang Janet Jackson on her 1989 hit Rhythm Nation, not knowing that the better way of life she was talking about didn’t include certain hard drives. It’s just been revealed that the song has the power to crash particular models of laptops, and it has now been recognized as a cybersecurity vulnerability.

But Microsoft Software Engineer Raymond Chen stands by the story in a blog post published earlier this week, and the vulnerability has been issued an official CVE ID by The Mitre Corporation, lending it more credibility.

It was discovered that the effect could be replicated on other laptops from multiple manufacturers, all of which shared a common feature; the same 5,400 RPM hard disk drive was found in the machines, which were popular sometime around 2005, or 16 years after Rhythm Nation just missed out on topping the Billboard Hot 100 chart.

Don’t play this near any laptops from the mid-2000s [https://youtu.be/OAwaNWGLM0c]

The problem is that the song contains one of the natural resonant frequencies for that particular hard drive model. It caused the HD platters to contact the drive head, resulting in a crash.

The laptop manufacturers addressed the problem by adding a custom filter in the audio pipeline that detected and removed the offending frequencies during audio playback. The phasing out of 5,400 RPM hard drives in laptops and the declining popularity of Jackson’s song likely helped, too.

Nevertheless, the quirk was added to the register of Common Vulnerabilities and Exposures by The Mitre Corporation on August 17 and has been acknowledged by security vendor Tenable. Listed as CVE-2022-38392, it is described as “a certain 5400 RPM OEM hard drive, as shipped with laptop PCs in approximately 2005, allows physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video.”

In April last year, researchers at the Ben Gurion University in Israel demonstrated a technique called AiR-ViBeR that could steal data from air-gapped PCs—systems that are physically isolated with no online access—without being detected.

[https://youtu.be/XGD343nq1dg]

The proof-of-concept originated from the theory that it’s possible to use vibrations produced by electromechanical components like a CPU, GPU, or case fans in combination with special malware that is able to encode the data to be transmitted through direct manipulation of the fan speed.