LED-it-GO: Leaking (A Lot of) Data from Air-Gapped Computers via the (Small) Hard Drive LED

Guri, Mordechai; Zadov, Boris; Elovici, Yuval

doi:10.1007/978-3-319-60876-1_8

Cited by 83 publications

(60 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A Snoopy drone can exploit the WiFi, impersonate the identified network and trick smart devices into joining it, so as to collect all the information entered on this disguised network. In addition, UAVs can perform 3D through-wall mapping [ 116 ], leak data from air-gap computers [ 117 ], or even carry traditional spying devices to eavesdrop on conversations [ 5 ]. With the use of RFID tags, attack targets can be traced by a RFID reader at distances varying from one up to a few hundred meters [ 118 ].…”

Section: Attacks With Drones In Airport Critical Infrastructures: mentioning

confidence: 99%

Defending Airports from UAS: A Survey on Cyber-Attacks and Counter-Drone Sensing Technologies

Lykou

Moustakas

Gritzalis

2020

Sensors

169

View full text Add to dashboard Cite

As the fastest growing segment of aviation, unmanned aerial systems (UAS) continue to increase in number, technical complexity and capabilities. Numerous civilian and commercial uses are drastically transforming civil protection, asset delivery, commercial and entertaining activities. However, UAS pose significant challenges in terms of safety, security and privacy within society. An increasing phenomenon, nowadays, is drone-related incidents near airport facilities, which are expected to proliferate in frequency, complexity and severity, as drones become larger and more powerful. Critical infrastructures need to be protected from such aerial attacks, through effective counteracting technologies, risk management and resilience plans. In this paper, we present a survey of drone incidents near airports and a literature review of sensor technologies, able to prevent, detect, identify and mitigate rogue drones. We exhibit the benefits and limitations of available counter-drone technologies (C-UAS); however, defending airports against misused drone activity is a hard problem. Therefore, we analyze three realistic attack scenarios from malicious drones and propose an effective C-UAS protection plan for each case. We discuss applicability limitations of C-UAS in the aviation context and propose a resilience action plan for airport stakeholders for defending against airborne threats from misused drones.

show abstract

Section: Attacks With Drones In Airport Critical Infrastructures: mentioning

confidence: 99%

Defending Airports from UAS: A Survey on Cyber-Attacks and Counter-Drone Sensing Technologies

Lykou

Moustakas

Gritzalis

2020

Sensors

169

View full text Add to dashboard Cite

show abstract

“…Note that several APTs discovered in the last decade are capable of infecting air-gapped networks [40], e.g., Turla [41], RedOctober [42], and Fanny [43]. As a part of the targeted attack, the adversary may infiltrate BitWhisper [35] Optical Hard drive LED (LED-it-GO) [30] VisiSploit (invisible pixels) [32] Keyboard LEDs [30] Router LEDs [31] Infrared (IR) aIR-Jumper (security cameras & infrared) [34] Implanted infrared LEDs [33] the air-gapped networks using social engineering, supply chain attacks, or insiders. Receiver Implantation.…”

Section: Magneticmentioning

confidence: 99%

ODINI: Escaping Sensitive Data From Faraday-Caged, Air-Gapped Computers via Magnetic Fields

Guri

Zadov

Elovici

2020

IEEE Trans.Inform.Forensic Secur.

Self Cite

View full text Add to dashboard Cite

Air-gapped computers are computers which are kept isolated from the Internet, because they store and process sensitive information. When highly sensitive data is involved, an air-gapped computer might also be kept secluded in a Faraday cage. The Faraday cage prevents the leakage of electromagnetic signals emanating from various computer parts, which may be picked up by an eavesdropping adversary remotely. The air-gap separation, coupled with the Faraday shield, provides a high level of isolation, preventing the potential leakage of sensitive data from the system. In this paper, we show how attackers can bypass Faraday cages and air-gaps in order to leak data from highly secure computers. Our method is based on an exploitation of the magnetic field generated by the computer's CPU. Unlike electromagnetic radiation (EMR), low frequency magnetic radiation propagates though the air, penetrating metal shielding such as Faraday cages (e.g., compass still works inside Faraday cages). Since the CPU is an essential part of any computer, our covert channel is relevant to virtually any device with a CPU: desktop PCs, servers, laptops, embedded systems and Internet of Things (IoT) devices. We introduce a malware code-named 'ODINI' that can control the low frequency magnetic fields emitted from the infected computer by regulating the load of the CPU cores. Arbitrary data can be modulated and transmitted on top of the magnetic emission and received by a magnetic receiver ('bug') placed nearby. We provide technical background and examine the characteristics of the magnetic fields. We implement a malware prototype and discuss the design considerations along with the implementation details. We also show that the malicious code does not require special privileges (e.g., root) and can successfully operate from within isolated virtual machines (VMs) as well. We present signal generation, transmission algorithms, and discuss data encoding and modulation schemes. We analyze the covert channel and evaluate it on various types of computers. Finally, we propose different types of defensive countermeasures such as signal detection and signal jamming to cope with this type of threat.

show abstract

“…By modulating the blinking pattern, the attacker can exfiltrate some stolen information (e.g., user credentials) to a remote location. This has been demonstrated with hard-drives, monitors, and networking equipment [ 27 ].…”

Section: Attacksmentioning

confidence: 99%

The Security of IP-Based Video Surveillance Systems

Kalbo

Mirsky

Shabtai

et al. 2020

Sensors

Self Cite

View full text Add to dashboard Cite

Over the last decade, video surveillance systems have become a part of the Internet of Things (IoT). These IP-based surveillance systems now protect industrial facilities, railways, gas stations, and even one’s own home. Unfortunately, like other IoT systems, there are inherent security risks which can lead to significant violations of a user’s privacy. In this review, we explore the attack surface of modern surveillance systems and enumerate the various ways they can be compromised with real examples. We also identify the threat agents, their attack goals, attack vectors, and the resulting consequences of successful attacks. Finally, we present current countermeasures and best practices and discuss the threat horizon. The purpose of this review is to provide researchers and engineers with a better understanding of a modern surveillance systems’ security, to harden existing systems and develop improved security solutions.

show abstract

LED-it-GO: Leaking (A Lot of) Data from Air-Gapped Computers via the (Small) Hard Drive LED

Cited by 83 publications

References 12 publications

Defending Airports from UAS: A Survey on Cyber-Attacks and Counter-Drone Sensing Technologies

Defending Airports from UAS: A Survey on Cyber-Attacks and Counter-Drone Sensing Technologies

ODINI: Escaping Sensitive Data From Faraday-Caged, Air-Gapped Computers via Magnetic Fields

The Security of IP-Based Video Surveillance Systems

Contact Info

Product

Resources

About