[论文解读] LED-it-GO: Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LED

Mordechai Guri, Boris Zadov+2 more|arXiv (Cornell University)|Feb 22, 2017

Advanced Malware Detection Techniques被引用 7

一句话总结

本文提出了一种名为LED-it-GO的隐蔽数据外泄技术，利用空气隔离计算机的硬盘活动LED，通过每秒最高4,000比特的速率传输数据。通过以高达5,800 Hz的高频调节LED的开关状态，恶意软件可将敏感信息（如加密密钥或击键记录）编码为肉眼不可见的可见光信号，经由远程摄像头和传感器捕获，即使在无直接网络连接的情况下也能实现外泄。

ABSTRACT

In this paper we present a method which allows attackers to covertly leak data from isolated, air-gapped computers. Our method utilizes the hard disk drive (HDD) activity LED which exists in most of today's desktop PCs, laptops and servers. We show that a malware can indirectly control the HDD LED, turning it on and off rapidly (up to 5800 blinks per second) - a rate that exceeds the visual perception capabilities of humans. Sensitive information can be encoded and leaked over the LED signals, which can then be received remotely by different kinds of cameras and light sensors. Compared to other LED methods, our method is unique, because it is also covert - the HDD activity LED routinely flickers frequently, and therefore the user may not be suspicious to changes in its activity. We discuss attack scenarios and present the necessary technical background regarding the HDD LED and its hardware control. We also present various data modulation methods and describe the implementation of a user-level malware, that doesn't require a kernel component. During the evaluation, we examine the physical characteristics of different colored HDD LEDs (red, blue, and white) and tested different types of receivers: remote cameras, extreme cameras, security cameras, smartphone cameras, drone cameras, and optical sensors. Finally, we discuss hardware and software countermeasures for such a threat. Our experiment shows that sensitive data can be successfully leaked from air-gapped computers via the HDD LED at a maximum bit rate of 4000 bits per second, depending on the type of receiver and its distance from the transmitter. Notably, this speed is 10 times faster than the existing optical covert channels for air-gapped computers. These rates allow fast exfiltration of encryption keys, keystroke logging, and text and binary files.

研究动机与目标

• 展示一种利用硬盘活动LED对空气隔离计算机进行隐蔽、高带宽数据外泄的方法。
• 解决在传统网络通道不可用的物理隔离系统中数据外泄的挑战。
• 开发一种用户级恶意软件，可在无需内核权限的情况下控制硬盘LED，提升隐蔽性与可行性。
• 评估使用各种光传感器和摄像头接收调制LED信号的物理与技术可行性。
• 针对空气隔离环境中此类光学侧信道攻击提出实用的防护对策。

提出的方法

• 运行在用户空间的恶意软件通过控制磁盘I/O操作的时序，间接触发硬盘LED的开关状态。
• 系统采用开关键控（OOK）调制技术，将数据编码为快速、人眼不可见的LED闪烁，最高可达每秒5,800次闪烁。
• 评估了红色、蓝色和白色LED在光学传输特性方面的表现，包括带宽和信噪比。
• 测试了多种接收设备——从智能手机摄像头到安防摄像头和无人机摄像头，以及专用光传感器——在信号接收与解码性能方面的表现。
• 该方法利用了硬盘LED在正常运行时本就存在闪烁的特性，使人工调制更难被用户察觉。
• 实现过程中避免使用内核级组件，从而可通过用户态恶意软件部署，无需权限提升。

实验结果

研究问题

• RQ1 硬盘活动LED能否作为空气隔离系统中隐蔽、高带宽的数据外泄通信信道？
• RQ2 使用标准摄像头和传感器通过LED基光学侧信道通信，最高可实现多大的数据传输速率？
• RQ3 LED颜色（红色、蓝色、白色）的选择如何影响信号传输的可靠性和带宽？
• RQ4 由于LED的正常工作行为，此类攻击在多大程度上可避免被用户察觉？
• RQ5 使用硬盘LED进行光学数据外泄的实际限制和环境因素有哪些？

主要发现

• 硬盘LED可调制至高达5,800 Hz的频率，远超人眼视觉感知范围，从而实现高速数据传输。
• 实现的最高数据外泄速率达每秒4,000比特，比以往针对空气隔离系统的光学隐蔽信道快了十倍。
• 不同颜色的LED表现出不同的传输性能，其中白色LED在信噪比和带宽方面表现最佳。
• 多种消费级摄像头——包括智能手机、无人机和安防摄像头——在数米距离内成功接收并解码了调制信号。
• 即使接收设备未正对LED，攻击依然有效，表明其对视线变化具有良好的鲁棒性。
• 该方法完全在用户空间运行，无需内核访问权限，从而在真实场景中显著提升了隐蔽性与可行性。