[Paper Review] Exfiltration of Data from Air-gapped Networks via Unmodulated LED Status Indicators

Zhengwen Zhou, Zhang, Weiming+2 more|arXiv (Cornell University)|Nov 9, 2017

Internet Traffic Analysis and Secure E-voting12 references3 citations

TL;DR

This paper proposes a covert optical communication channel using unmodulated LED status indicators on keyboards in air-gapped networks, employing binary frequency shift keying (B-FSK) to achieve imperceptible data exfiltration. The method enables reliable, human-invisible data transmission up to 5.08 meters using a standard IP camera, significantly improving covertness over traditional on-off keying (OOK).

ABSTRACT

The light-emitting diode(LED) is widely used as an indicator on the information device. Early in 2002, Loughry et al studied the exfiltration of LED indicators and found the kind of LEDs unmodulated to indicate some state of the device can hardly be utilized to establish covert channels. In our paper, a novel approach is proposed to modulate this kind of LEDs. We use binary frequency shift keying(B-FSK) to replace on-off keying(OOK) in modulation. In order to verify the validity, we implement a prototype of an exfiltration malware. Our experiment show a great improvement in the imperceptibility of covert communication. It is available to leak data covertly from air-gapped networks via unmodulated LED status indicators.

Motivation & Objective

• To address the limitation of existing covert channels that rely on modulated LEDs or visible flicker, which can be detected by users.
• To demonstrate that unmodulated LED indicators (Class I) can be repurposed for covert communication without user suspicion.
• To design and implement a practical attack model (KLONC) that leverages standard hardware (IP camera, keyboard LED) for data exfiltration.
• To improve covertness by minimizing perceptible flicker through B-FSK modulation, reducing detectability compared to OOK.
• To evaluate the effective transmission distance and signal quality under varying angles and distances in real-world conditions.

Proposed method

• Proposes B-FSK modulation to encode binary data using two distinct flicker frequencies for '1' and '0', replacing traditional OOK to reduce perceptibility.
• Designs a malware prototype (KLONC) that controls the keyboard's LED status via software to generate modulated light signals.
• Employs a standard IP camera as the receiver to capture and decode the modulated light signals from the LED.
• Uses theoretical modeling and experimental validation to determine the upper bound of effective transmission distance based on emitting angle and brightness.
• Applies a brightness model: $ B = rac{1.77}{d^2} imes ext{cos}( heta) $, where $ d $ is distance and $ heta $ is the emitting angle, to estimate signal strength.
• Compares B-FSK with OOK in terms of flicker frequency and detectability, showing B-FSK achieves lower flicker values and better covertness.

Experimental results

Research questions

• RQ1 Can unmodulated LED status indicators (Class I) be effectively used to establish a covert optical channel without user detection?
• RQ2 How does B-FSK modulation improve the covertness of data exfiltration compared to traditional OOK in unmodulated LEDs?
• RQ3 What is the maximum effective transmission distance for a covert signal from a keyboard LED to a remotely placed IP camera?
• RQ4 How does the signal brightness vary with distance and angle, and what is the practical upper bound for reliable detection?
• RQ5 What are the most effective procedural and technical countermeasures against such LED-based covert channels?

Key findings

• The proposed B-FSK modulation method achieves significantly lower flicker values than OOK, reducing perceptibility and enhancing covertness.
• The KLONC prototype successfully exfiltrated data from an air-gapped network to a remote IP camera over distances up to 5.08 meters with a 62.66° emitting angle.
• Signal brightness at 4.02 meters was only about 10% of the brightness at 1.77 meters, confirming the rapid attenuation of optical signals with distance.
• Experimental results confirmed that human vision cannot distinguish the flicker at the selected B-FSK frequencies, validating the covertness of the method.
• The theoretical model of signal brightness as a function of distance and angle closely matched experimental observations, enabling accurate prediction of transmission limits.
• Countermeasures such as LED status monitoring with optical sensors showed high detection potential, though hardware constraints and low event probability limit practical effectiveness.