> Any signal that you can modulate can be an exfiltration channel, and fan noise is no different.

This KVM has HDMI input and can directly emulate USB mass storage; fan-modulation is the lowest-bandwidth (side-)channel available to the attackers.

You can exfiltrate data from a machine which is not connected to the KVM. A high-security machine may be even air-gapped most of the time, but be physically nearby.

I don’t think too many of these devices will end up in server rooms as opposed to home labs. And the ones that do end up in a datacenter are very unlikely to be allowed to ever reach the internet.

If the microphone was used for exfiltrating data, it would work against random targets that happened to let the KVM connect to the internet, and who have a nearby machine infected with some malware. That kind of non-targeted attack can be damaging but is semi-useless to the attacker.

I wonder if that's feasible in a room filled with many servers and fans going?

Yes, just modulate the fan noise on the transmitter, and apply a filter on the receiver.

Doesn't being able to modulate the fan presume you already control the target device?

It's possible to get malware onto even air-gapped machines. This is a way to then communicate across the air-gap.