
Disk activity LED used to exfiltrate data from an air-gapped computer - jloughry
http://cyber.bgu.ac.il/advanced-cyber/
======
woliveirajr
You can exfiltrate data from air-gapped computer by any means that leaks
signals. Some are obvious (wi-fi !?!), fun begins when you use means that
aren't normally considered.

If I remember correctly (and I'll try to find links afterwards), these were
already used:

1 - Heat from the CPU/GPU (link: [https://www.wired.com/2015/03/stealing-data-
computers-using-...](https://www.wired.com/2015/03/stealing-data-computers-
using-heat/))

2 - Fan noise/speed (link: [https://www.wired.com/2016/06/clever-attack-uses-
sound-compu...](https://www.wired.com/2016/06/clever-attack-uses-sound-
computers-fan-steal-data/))

3 - audio from the speaker (link:
[http://www.telegraph.co.uk/technology/internet-
security/1049...](http://www.telegraph.co.uk/technology/internet-
security/10490846/New-computer-virus-secretly-leaks-data-through-air.html))

4 - audio from the HDD activity (link:
[https://www.theregister.co.uk/2016/08/15/air_gap_breached_by...](https://www.theregister.co.uk/2016/08/15/air_gap_breached_by_disk_drive_noise/))

5 - electromagnetic radiation ([https://www.wired.com/2015/07/researchers-
hack-air-gapped-co...](https://www.wired.com/2015/07/researchers-hack-air-
gapped-computer-simple-cell-phone/))

And some ways that I didn't see yet, but might be possible:

6 - monitor (by changing part of the screen, the colors, or something like
that, creating subtle patterns)

7 - keyboard lights (flickering in high speed, perhaps)

8 - power consumption

edit: added electromagnetic radiation

~~~
jloughry
Other intentional sources:

1\. vibration from haptic feedback devices

2\. modulation of an optical mouse's light

3\. infrared LED plugged into headphone jack

Unintentional sources of leakage:

4\. ultrasonic vibrations from power supply components (capacitors) correlated
with CPU instructions

------
jloughry
This is interesting because the disk activity LED is _covert_ , not
clandestine. There's no need to try to hide the activity; communication is
buried in the normal busy activity of the hard disk.

------
woliveirajr
Being a father who suffered watching those Frozen princess many times, I found
LED-it-GO very amusing...

