If someone told you that a song had become a cybersecurity vulnerability , would you believe it? Well, it's true. Recently, news broke that a Janet Jackson song could potentially crash some laptops still running Windows XP.
Microsoft software engineer Raymond Chen recounted the incident , saying he heard the story from a colleague in Windows XP product support. According to the blog post, Jackson's 1989 hit song, "Rhythm Nation," could disrupt a 5400 rpm laptop hard drive model used in several laptops.
Microsoft learned of the problem when a laptop manufacturer informed the company's Windows team about the mysterious glitch. Initially, the company thought it had something to do with the Rhythm Nation music video playing on laptops. But what made the problem even stranger was that the Rhythm Nation clip was also crashing Windows laptops.
“A colleague of mine shared a story about Windows XP product support,” said Raymond Chen. The story details how "a major computer manufacturer discovered that playing Janet Jackson's 'Rhythm Nation' music video would fail on certain laptop models."
MITRE assigned Janet Jackson's "Rhythm Nation" music video a vulnerability ID of CVE-2022-38392 because some older laptops malfunctioned while playing it. An attack using the specified composition could cause an emergency system shutdown due to hard drive failures associated with resonance occurring when playing certain frequencies.
It is observed that the frequency of some instruments in the clip coincides with the oscillations produced in the discs that rotate at a frequency of 5400 rpm, which causes a strong increase in the amplitude of their oscillations.
It turned out that the song contained one of the natural resonant frequencies for the 5400 RPM model of laptop hard drives that they and other manufacturers were using.
The vendor resolved the issue by adding a custom filter in the audio pipeline that would detect and remove offending frequencies during audio playback.
And I'm sure they put a digital version of a "Do Not Remove" tag on that audio filter. (Although I'm afraid in the many years since the workaround was added, no one remembers why it was there. Hopefully, your laptops will no longer carry this audio filter to protect against damage to a hard drive model that already do not use).
The information about the problem was shared by a Microsoft employee, who by analyzing user complaints, one of the major equipment manufacturers found that the "Rhythm Nation" composition leads to failures in certain models of hard drives based on magnetic hard drives used in laptops made by this manufacturer.
The manufacturer solved the problem by adding a special filter to the sound system that blocks unwanted frequencies during playback. However, this solution didn't provide complete protection; for example, there was a case where the problem occurred not on the device playing the clip, but on a nearby laptop.
The problem was also fixed in laptops from other manufacturers sold around 2005. Information about the effect is being disclosed because it is now largely irrelevant and the problem does not occur in modern hard drives.
Miter saw fit to include it in the Registry of Common Vulnerabilities and Exposures (CVE), the definitive list of cybersecurity vulnerabilities we all need to know about. It is listed as CVE-2022-38392 and has already been recognized by security vendor Tenable.
Although the bug seems comical, side channel attacks are a real threat. Israeli researcher Mordechai Guri has found ways to attack computers, including making memory emit radiation in the same bands Wi-Fi uses and scrambling information in those emissions.
So owners of laptops with old, slow hard drives should be very careful if they listen to Janet Jackson tunes while working.
Finally, if you are interested in learning more, you can find the details at the following link.