You know the LED light on your hard drive. Surely you have seen it… Do you think that computers that are not connected to a network are secure? Stuxnet has proven for the first time that they can be violated by the "air." But other than that, do you find it completely harmless to insert a USB drive into a computer that is not connected to the internet?
Security researchers from Israel's Ben Gurion University have shown that if an attacker manages to infect a computer, he could steal data remotely using a camera that can read the HDD LED.
The computers LEDs blink when the drive is in the reading stage and enrollments, but data can also be transmitted optically.
As reported by Wired, the malware invented by the researchers can cause an HDD LED to blink 6.000 times per second. If these lights are visible from a window, a drone or a telescopic camera lens can pick up the signals from some distance away.
The researchers explain in a publication that data can leak from HDD LEDs with speed 4kbps. Yes the speed is incredibly slow by today's standards but it is enough to steal all the encryption keys.
The "good" thing about this attack is that the LED lights on the HDD are blinking anyway, so no one can tell if the infected system is transmitting data.
Please note that with other malware, researchers have been able to intercept data from unplugged computers from computer speakers, FM waves, and heat.
The encoding system used to transfer data from HDD LEDs is called on-off typing, which is one of the methods of communication through visible light.
The researchers used a Nikon DSLR, a high-end security camera, a GoPro Hero5, a Microsoft LifeCam, a Samsung Galaxy S6, τα Glass της Google, και ένα αισθητήρας Siemens Photodiode.
The Siemens sensor was the fastest in data transfer (4kbps), while Galaxy S6 and GoPro Hero5 had bandwidth of 60 bits per second and 120 bits per second, respectively.
Fortunately, there are cheap methods to deal with this attack. Covering the LED or disconnecting it, or removing the computer from windows.
Watch the video
