Disk activity LED used to exfiltrate data from an air-gapped computer

http://cyber.bgu.ac.il/advanced-cyber/

by jloughry • 9 years ago

3 4 9 years ago

cyber.bgu.ac.il

jloughry2• 9 years ago

This is interesting because the disk activity LED is covert, not clandestine. There's no need to try to hide the activity; communication is buried in the normal busy activity of the hard disk.

woliveirajr2• 9 years ago

You can exfiltrate data from air-gapped computer by any means that leaks signals. Some are obvious (wi-fi !?!), fun begins when you use means that aren't normally considered.

If I remember correctly (and I'll try to find links afterwards), these were already used:

1 - Heat from the CPU/GPU (link: https://www.wired.com/2015/03/stealing-data-computers-using-...)

2 - Fan noise/speed (link: https://www.wired.com/2016/06/clever-attack-uses-sound-compu...)

3 - audio from the speaker (link: http://www.telegraph.co.uk/technology/internet-security/1049...)

4 - audio from the HDD activity (link: https://www.theregister.co.uk/2016/08/15/air_gap_breached_by...)

5 - electromagnetic radiation (https://www.wired.com/2015/07/researchers-hack-air-gapped-co...)

And some ways that I didn't see yet, but might be possible:

6 - monitor (by changing part of the screen, the colors, or something like that, creating subtle patterns)

7 - keyboard lights (flickering in high speed, perhaps)

8 - power consumption

edit: added electromagnetic radiation

jloughry2• 9 years ago

Other intentional sources:

1. vibration from haptic feedback devices

2. modulation of an optical mouse's light

3. infrared LED plugged into headphone jack

Unintentional sources of leakage:

4. ultrasonic vibrations from power supply components (capacitors) correlated with CPU instructions

woliveirajr2• 9 years ago

Being a father who suffered watching those Frozen princess many times, I found LED-it-GO very amusing...

Disk activity LED used to exfiltrate data from an air-gapped computer

Related Stories