BRIGHTNESS: Leaking Sensitive Data from Air-Gapped Workstations via Screen Brightness

Abstract

Air-gapped computers are systems that are kept isolated from the Internet since they store or process sensitive information. In this paper, we introduce an optical covert channel in which an attacker can leak (or, exfiltlrate) sensitive information from air-gapped computers through manipulations on the screen brightness. This covert channel is invisible and it works even while the user is working on the computer. Malware on a compromised computer can obtain sensitive data (e.g., files, images, encryption keys and passwords), and modulate it within the screen brightness, invisible to users. The small changes in the brightness are invisible to humans but can be recovered from video streams taken by cameras such as a local security camera, smartphone camera or a webcam. We present related work and discuss the technical and scientific background of this covert channel. We examined the channel's boundaries under various parameters, with different types of computer and TV screens, and at several distances. We also tested different types of camera receivers to demonstrate the covert channel. Lastly, we present relevant countermeasures to this type of attack. Lastly, we present relevant countermeasures to this type of attack.

2019 12th CMI Conference on Cybersecurity and Privacy (CMI)

References in corpus (8)

• Information Leakage from Optical Emanations
• Shoulder Surfing attack in graphical password authentication
• CTRL-ALT-LED: Leaking Data from Air-Gapped Computers via Keyboard LEDs
• Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers
• IREXF: Data Exfiltration from Air-gapped Networks by Infrared Remote Control Signals
• MAGNETO: Covert Channel between Air-Gapped Systems and Nearby Smartphones via CPU-Generated Magnetic Fields
• VisiSploit: An Optical Covert-Channel to Leak Data through an Air-Gap
• Data Exfiltration via Multipurpose RFID Cards and Countermeasures

Cited by in corpus (5)

• ETHERLED: Sending Covert Morse Signals from Air-Gapped Devices via Network Card (NIC) LEDs
• GAIROSCOPE: Injecting Data from Air-Gapped Computers to Nearby Gyroscopes
• AiR-ViBeR: Exfiltrating Data from Air-Gapped Computers via Covert Surface ViBrAtIoNs
• PIXHELL Attack: Leaking Sensitive Information from Air-Gap Computers via `Singing Pixels'
• PIXHELL: When Pixels Learn to Scream