CTRL-ALT-LED: Leaking Data from Air-Gapped Computers Via Keyboard LEDs

Abstract

Using the keyboard LEDs to send data optically was proposed in 2002 by Loughry and Umphress [1] (Appendix A). In this paper we extensively explore this threat in the context of a modern cyber-attack with current hardware and optical equipment. In this type of attack, an advanced persistent threat (APT) uses the keyboard LEDs (Caps-Lock, Num-Lock and Scroll-Lock) to encode information and exfiltrate data from airgapped computers optically. Notably, this exfiltration channel is not monitored by existing data leakage prevention (DLP) systems. We examine this attack and its boundaries for today's keyboards with USB controllers and sensitive optical sensors. We also introduce smartphone and smartwatch cameras as components of malicious insider and 'evil maid' attacks. We provide the necessary scientific background on optical communication and the characteristics of modern USB keyboards at the hardware and software level, and present a transmission protocol and modulation schemes. We implement the exfiltration malware, discuss its design and implementation issues, and evaluate it with different types of keyboards. We also test various receivers, including light sensors, remote cameras, 'extreme' cameras, security cameras, and smartphone cameras. Our experiment shows that data can be leaked from air-gapped computers via the keyboard LEDs at a maximum bit rate of 3000 bit/sec per LED given a light sensor as a receiver, and more than 120 bit/sec if smartphones are used. The attack doesn't require any modification of the keyboard at hardware or firmware levels.

SmartLED: Smartphone-Based Covert Channels Leveraging the Notification LED

“…Finally, in comparison with related works dealing with LEDs, SmartlLED improves BER results of [9] and [13] in "dark" environments, while the remaining works cannot be compared in this regard. Moreover, [9] and [13] do not compare and analyse different environmental settings. On the other hand, SmartLED achieves bit rates of 0.15 and 0.23 bits/s for α 300 and 450 respectively.…”

“…Although they are smaller than other proposals (i.e. [9] and [13]), it must be recalled that the management of smartphone LEDs in Android impose practical limits that restrict the available choices for α. Moreover, as pointed out in Section IV-B, data exfiltration should be carried out in an stealthy way, so α should be kept within common limits.…”

“…Their use in networks protocols was one common application [7] and they have been specially applied in air-gapped computers, that is devices isolated from public or insecure networks. In this vein, a wide array of approaches have been proposed - [8] presents a malware to exfiltrate data through cellular GSM frequencies; [9] through the blinking pattern of keyboard LEDs; [3] through electric emissions on power lines; [4] through the magnetic fields of computers, using a smartphone to receive the covert signals with its magnetic sensor; [10] through the speakers of a computer considering acoustic signals emitted from its hard drive; [11] through the LED of a computer hard drive; [12] through blinking infrarred LEDs of computer devices; [13] through LEDs located in network equipments such as switches or routers; [6] through vibrations by controlling the fan speed of a computer; and [14] through the turn of power supplies into speakers by manipulating their internal switching frequency. With the same purpose but not focusing on air-gapped devices, [15] proposes the use of electromagnetic signals as a covert channel between a laptop and a smartphone.…”

“…By contrast, mobile devices are common receivers, being specially frequent the use of cameras for receiving information from LEDs. Indeed, the LED of assorted devices, like keyboads [9] or routers [13], has been considered for data transmission in covert channels. As a matter of fact, when the LED is the component at stake to build the covert channel, just [11] points out that the system is affected by light conditions specially considering night and daylight.…”

An Indicator-Based Visible Light Communication System Embedding on Operating Systems: Signal Design and Experimental Verification

“…In [7], a liquid crystal display screen, which can also be regarded as a kind of LED indicators, is served as a transmitter. In [8], the keyboard is used to send data optically. Monitor's indicators are used in [9].…”