CTRL-ALT-LED: Leaking Data from Air-Gapped Computers via Keyboard LEDs

Abstract

Using the keyboard LEDs to send data optically was proposed in 2002 by Loughry and Umphress [1] (Appendix A). In this paper we extensively explore this threat in the context of a modern cyber-attack with current hardware and optical equipment. In this type of attack, an advanced persistent threat (APT) uses the keyboard LEDs (Caps-Lock, Num-Lock and Scroll-Lock) to encode information and exfiltrate data from airgapped computers optically. Notably, this exfiltration channel is not monitored by existing data leakage prevention (DLP) systems. We examine this attack and its boundaries for today's keyboards with USB controllers and sensitive optical sensors. We also introduce smartphone and smartwatch cameras as components of malicious insider and 'evil maid' attacks. We provide the necessary scientific background on optical communication and the characteristics of modern USB keyboards at the hardware and software level, and present a transmission protocol and modulation schemes. We implement the exfiltration malware, discuss its design and implementation issues, and evaluate it with different types of keyboards. We also test various receivers, including light sensors, remote cameras, 'extreme' cameras, security cameras, and smartphone cameras. Our experiment shows that data can be leaked from air-gapped computers via the keyboard LEDs at a maximum bit rate of 3000 bit/sec per LED given a light sensor as a receiver, and more than 120 bit/sec if smartphones are used. The attack doesn't require any modification of the keyboard at hardware or firmware levels.

arXiv admin note: text overlap with arXiv:1706.01140

References in corpus (3)

• Information Leakage from Optical Emanations
• Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers
• MAGNETO: Covert Channel between Air-Gapped Systems and Nearby Smartphones via CPU-Generated Magnetic Fields

Cited by in corpus (9)

• BRIGHTNESS: Leaking Sensitive Data from Air-Gapped Workstations via Screen Brightness
• ETHERLED: Sending Covert Morse Signals from Air-Gapped Devices via Network Card (NIC) LEDs
• GAIROSCOPE: Injecting Data from Air-Gapped Computers to Nearby Gyroscopes
• LANTENNA: Exfiltrating Data from Air-Gapped Networks via Ethernet Cables
• AiR-ViBeR: Exfiltrating Data from Air-Gapped Computers via Covert Surface ViBrAtIoNs
• POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers
• PIXHELL Attack: Leaking Sensitive Information from Air-Gap Computers via `Singing Pixels'
• PIXHELL: When Pixels Learn to Scream
• AIR-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers