LED-it-GO：通过（小）硬盘驱动器LED从空气间隙计算机泄漏（大量）数据
LED-it-GO: Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LED
摘要：
在本文中，我们提出了一种方法，允许攻击者隐蔽地泄漏数据从孤立的，空气间隙的计算机。我们的方法利用硬盘驱动器（HDD）活动LED，这存在于今天的大多数台式电脑，笔记本电脑和服务器。我们发现恶意软件可以间接控制HDD LED，快速打开和关闭（每秒高达5800次闪烁）-这一速度超过了人类的视觉感知能力。敏感信息可以通过LED信号进行编码和泄漏，然后可以通过不同类型的摄像机和光传感器远程接收。与其他LED方法相比，我们的方法是独特的，因为它也是隐蔽的-HDD活动LED经常频繁闪烁，因此用户可能不会怀疑其活动的变化。我们将讨论攻击场景，并介绍有关HDD LED及其硬件控制的必要技术背景。我们还提出了各种数据调制方法，并描述了一个用户级恶意软件的实现，不需要一个内核组件。在评估过程中，我们检查了不同颜色的HDD LED（红色、蓝色和白色）的物理特性，并测试了不同类型的接收器：远程摄像机、极限摄像机、安全摄像机、智能手机摄像机、无人机摄像机和光学传感器。最后，我们讨论了这种威胁的硬件和软件对策。我们的实验表明，敏感数据可以通过HDD LED以每秒4000比特的最大比特率成功地从空气间隙计算机泄漏，这取决于接收器的类型及其与发射器的距离。值得注意的是，这种速度比空气间隙计算机的现有光学隐蔽通道快10倍。这些速率允许加密密钥、加密日志以及文本和二进制文件的快速泄漏。
英文摘要：
In this paper we present a method which allows attackers to covertly leak data from isolated, air-gapped computers. Our method utilizes the hard disk drive (HDD) activity LED which exists in most of today's desktop PCs, laptops and servers. We show that a malware can indirectly control the HDD LED, turning it on and off rapidly (up to 5800 blinks per second) - a rate that exceeds the visual perception capabilities of humans. Sensitive information can be encoded and leaked over the LED signals, which can then be received remotely by different kinds of cameras and light sensors. Compared to other LED methods, our method is unique, because it is also covert - the HDD activity LED routinely flickers frequently, and therefore the user may not be suspicious to changes in its activity. We discuss attack scenarios and present the necessary technical background regarding the HDD LED and its hardware control. We also present various data modulation methods and describe the implementation of a user-level malware, that doesn't require a kernel component. During the evaluation, we examine the physical characteristics of different colored HDD LEDs (red, blue, and white) and tested different types of receivers: remote cameras, extreme cameras, security cameras, smartphone cameras, drone cameras, and optical sensors. Finally, we discuss hardware and software countermeasures for such a threat. Our experiment shows that sensitive data can be successfully leaked from air-gapped computers via the HDD LED at a maximum bit rate of 4000 bits per second, depending on the type of receiver and its distance from the transmitter. Notably, this speed is 10 times faster than the existing optical covert channels for air-gapped computers. These rates allow fast exfiltration of encryption keys, keystroke logging, and text and binary files.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
