This website does readability filtering of other pages. All styles, scripts, forms and ads are stripped. If you want your website excluded or have other feedback, use this form.

Hard Drive LED Allows Data Theft From Air-Gapped PCs | SecurityWeek.Com


Security Experts:


HomeVirus & Threats

Hard Drive LED Allows Data Theft From Air-Gapped PCs

By Eduard Kovacs on February 23, 2017 Tweet

Researchers at Ben-Gurion University of the Negev in Israel have disclosed yet another method that can be used to exfiltrate data from air-gapped computers, and this time it involves the activity LED of hard disk drives (HDDs).

Many desktop and laptop computers have an HDD activity indicator, which blinks when data is being read from or written to the disk. The blinking frequency and duration depend on the type and intensity of the operation being performed.

According to researchers, a piece of malware can indirectly control the LED using specific read/write operations. More precisely, the size of the buffer being written or read is proportional to the amount of time the LED stays on, while sleeping causes the LED to be turned off. Experts have determined that these LEDs can blink up to 6,000 times per second, which allows for high data transmission rates.

The state of the LED can be translated into “0” or “1” bits. The data can be encoded using several methods: LED on is “1” and LED off is “0” (OOK encoding), off and on is “0” and on and off is “1” (Manchester encoding, which is slower but more reliable), or on for a certain duration is “1” and on for a different duration is “0” (Binary Frequency Shift Keying).

A piece of malware that is installed on the targeted air-gapped device can harvest data and exfiltrate it using one of these encoding systems. As for reception and decoding, the attacker must find a way to observe the targeted device’s activity LED, either using a local hidden camera, a high-resolution camera that can capture images from outside the building, a camera mounted on a drone, a compromised security camera, a camera carried by a malicious insider, or optical sensors.

The team at Ben-Gurion University of the Negev has published a video showing how such an attack can be carried out with the aid of a drone:

In the past few years, researchers have come up with several ways of exfiltrating data from air-gapped systems, including via electromagnetic, acoustic, thermal and optical methods. However, the latest method is one of the most efficient, with a top exfiltration rate of 4000 bits per second, which is more than enough to silently steal passwords, encryption keys and files.

The USBee method presented by researchers last summer achieved up to 4800 bps, but it only worked over a maximum distance of 10 meters (33 feet), while the HDD LED method works over longer distances as long as the transmitter is in the line of sight of the receiver.

An interesting observation, based on the measurements conducted by the researchers, is that blue LEDs produce the strongest optical signal.

The experts have proposed a series of countermeasures that can be used to prevent these types of attacks. These and additional technical details are available in their paper

Related: Hard Drive Noise Allows Data Theft From Air-Gapped Computers

Related: Air Gap or Not, Why ICS/SCADA Networks Are at Risk

Tweet Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Previous Columns by Eduard Kovacs:Hacktivist Attacks Declined 95 Percent Since 2015: IBM Slack Flaw Allows Hackers to Steal, Manipulate Downloads Wormable Windows RDS Vulnerability Poses Serious Risk to ICS Stack Overflow Discloses Security Breach Facebook Partially Restores Privacy Feature Abused in Massive Breach

2019 ICS Cyber Security Conference | USA [Oct. 21-24]

2019 ICS Cyber Security Conference | Singapore [April 2019]

Register an Invite to the CISO Forum on Nantucket

sponsored links Tags:

SecurityWeek Daily Briefing

      Looking for Malware in All the Wrong Places? First Step For The Internet's next 25 years: Adding Security to the DNS Tattle Tale: What Your Computer Says About You Be in a Position to Act Through Cyber Situational Awareness Report Shows Heavily Regulated Industries Letting Social Networking Apps Run Rampant 2010, A Great Year To Be a Scammer. Don't Let DNS be Your Single Point of Failure How to Identify Malware in a Blink Defining and Debating Cyber Warfare The Five A’s that Make Cybercrime so Attractive How to Defend Against DDoS Attacks Security Budgets Not in Line with Threats Anycast - Three Reasons Why Your DNS Network Should Use It The Evolution of the Extended Enterprise: Security Strategies for Forward Thinking Organizations Using DNS Across the Extended Enterprise: It’s Risky Business

Popular Topics

Security Community

Stay Intouch

About SecurityWeek

Copyright © 2019 Wired Business Media. All Rights Reserved. Privacy Policy