SoylentNews is people
SoylentNews
from the if-they-have-physical-access,-they-have-everything dept.
Apparently anything on a PC that makes noise or light is fair game for exploitation to breach air gapped PCs.
Researchers at Ben-Gurion University of the Negev in Israel have disclosed yet another method that can be used to exfiltrate data from air-gapped computers, and this time it involves the activity LED of hard disk drives (HDDs).
Many desktop and laptop computers have an HDD activity indicator, which blinks when data is being read from or written to the disk. The blinking frequency and duration depend on the type and intensity of the operation being performed.
According to researchers, a piece of malware can indirectly control the LED using specific read/write operations. More precisely, the size of the buffer being written or read is proportional to the amount of time the LED stays on, while sleeping causes the LED to be turned off. Experts have determined that these LEDs can blink up to 6,000 times per second, which allows for high data transmission rates.
The state of the LED can be translated into "0" or "1" bits. The data can be encoded using several methods: LED on is "1" and LED off is "0" (OOK encoding), off and on is "0" and on and off is "1" (Manchester encoding, which is slower but more reliable), or on for a certain duration is "1" and on for a different duration is "0" (Binary Frequency Shift Keying).
A piece of malware that is installed on the targeted air-gapped device can harvest data and exfiltrate it using one of these encoding systems. As for reception and decoding, the attacker must find a way to observe the targeted device's activity LED, either using a local hidden camera, a high-resolution camera that can capture images from outside the building, a camera mounted on a drone, a compromised security camera, a camera carried by a malicious insider, or optical sensors.
(Score: 2) by butthurt on Friday February 24 2017, @05:54PM
who, here, thinks that, for every single bit write operation, the led is turned off and on?
From the summary:
[...] the size of the buffer being written or read is proportional to the amount of time the LED stays on [...]
I didn't read the article but it's clear that they're talking about doing timed writes and observing the time that the write occurred and the amount of time it took. The actual data that end up being written are immaterial. That's not what's being observed.
how fast CAN you modulate an led? hint, a bit above audio range but NOT even close into entry-level RF range.
From the summary:
[...] these LEDs can blink up to 6,000 times per second [...]
I didn't read the article but it's clear that they're talking about the visible light from the LED, not RF emissions.