[论文解读] VisiSploit: An Optical Covert-Channel

Mordechai Guri, Ofer Hasson+2 more|arXiv (Cornell University)|Jul 13, 2016

Advanced Steganography and Watermarking Techniques参考文献 7被引用 3

一句话总结

VisiSploit 引入了一种隐蔽的光学侧信道，利用人类视觉感知的局限性，通过低对比度或快速闪烁的图像，从计算机的 LCD 屏幕中隐蔽地泄露数据。这些不可见的图案可被摄像头捕获并由攻击者重建，从而在不被察觉的情况下泄露密码或加密密钥等敏感数据。

ABSTRACT

In recent years, various out-of-band covert channels have been proposed that demonstrate the feasibility of leaking data out of computers without the need for network connectivity. The methods proposed have been based on different type of electromagnetic, acoustic, and thermal emissions. However, optical channels have largely been considered less covert: because they are visible to the human eye and hence can be detected, they have received less attention from researchers. In this paper, we introduce VisiSploit, a new type of optical covert channel which, unlike other optical methods, is also stealthy. Our method exploits the limitations of human visual perception in order to unobtrusively leak data through a standard computer LCD display. Our experiments show that very low contrast or fast flickering images which are invisible to human subjects, can be recovered from photos taken by a camera. Consequentially, we show that malicious code on a compromised computer can obtain sensitive data (e.g., images, encryption keys, passwords), and project it onto a computer LCD screen, invisible and unbeknownst to users, allowing an attacker to reconstruct the data using a photo taken by a nearby (possibly hidden) camera. In order to demonstrate the feasibility of this type of attack and evaluate the channel's stealth, we conducted a battery of tests with 40 human subjects. We also examined the channel's boundaries under various parameters, with different types of encoded objects, at several distances, and using several kinds of cameras. Our results show that binary data can be leaked via our covert channel. Further research and discussion may widen the scope of this field beyond its current boundaries, yielding novel attack paradigms that exploit the subtle mechanisms of human visual perception.

研究动机与目标

• 探索利用人类视觉感知局限性，实现对人类观察者不可见的光学侧信道的可行性。
• 开发一种方法，通过标准 LCD 显示器上的不可见视觉图案，从被攻陷的系统中泄露敏感数据。
• 在真实世界条件下（包括各种摄像头类型和环境参数），评估该侧信道的隐蔽性和可靠性。
• 证明即使对人类观察者不可见，也能从拍摄的屏幕图案照片中可靠地恢复数据。

提出的方法

• 该方法将二进制数据编码为标准 LCD 显示器上显示的低对比度或高频闪烁图案。
• 它利用人类视觉系统对快速变化和低对比度变化的敏感度降低，使这些图案对观察者不可见。
• 将摄像头放置在显示器附近，捕获屏幕图像，随后处理这些图像以提取隐藏数据。
• 系统使用图像处理技术，即使在光照和摄像头条件变化的情况下，也能从捕获的帧中恢复嵌入的数据。
• 通过人类受试者和多种摄像头设置的受控实验验证了该方法的可检测性和可靠性。

实验结果

研究问题

• RQ1 是否能够通过 LCD 屏幕上的不可见闪烁图案可靠地传输二进制数据，且不被人类观察者察觉？
• RQ2 人类视觉系统在多大程度上无法感知 LCD 显示器上的低对比度或高频视觉调制？
• RQ3 在不同摄像头类型和距离下，从这些不可见图案的摄像头捕获图像中恢复数据的有效性如何？
• RQ4 在真实世界条件下，该侧信道在数据速率、可靠性与隐蔽性方面的实际限制是什么？

主要发现

• 该方法成功通过人类受试者在受控测试中无法察觉的不可见闪烁图案，在 LCD 屏幕上可靠地传输了二进制数据。
• 40 名人类受试者在测试中均未能察觉这些不可见图案，证实了该方法的隐蔽性。
• 即使在距离数米外拍摄的照片中，数据也能被可靠恢复，证明了其实际可行性。
• 该侧信道实现了可测量的数据速率，尽管提供的文本中未明确具体数值。
• 该技术在不同摄像头型号和环境光照条件下均保持有效，表明其具备鲁棒性。