LaserShark: Establishing Fast, Bidirectional Communication into Air-Gapped Systems

Abstract

Physical isolation, so called air-gapping, is an effective method for protecting security-critical computers and networks. While it might be possible to introduce malicious code through the supply chain, insider attacks, or social engineering, communicating with the outside world is prevented. Different approaches to breach this essential line of defense have been developed based on electro- magnetic, acoustic, and optical communication channels. However, all of these approaches are limited in either data rate or distance, and frequently offer only exfiltration of data. We present a novel approach to infiltrate data to air-gapped systems without any additional hardware on-site. By aiming lasers at already built-in LEDs and recording their response, we are the first to enable a long-distance (25 m), bidirectional, and fast (18.2 kbps in & 100 kbps out) covert communication channel. The approach can be used against any office device that operates LEDs at the CPU’s GPIO interface.

Team

• Niclas Kühnapfel
• Stefan Preußler
• Maximilian Noppel
• Thomas Schneider
• Konrad Rieck
• Christian Wressnegger (Contact)

Proof-of-Concept Implementations

To foster future research and push forward defenses against covert channels, we make all code used during the experiments, raw data of the hardware measurements, and scripts to plot them available in the repository at:

https://github.com/intellisec/lasershark

Publication

A detailed description of our work will been presented at the 37th Annual Computer Security Applications Conference (ACSAC 2021) in December 2021. If you would like to cite our work, please use the reference as provided below:

@InProceedings{KuePreNopSchRieWre21,
author =    {Niclas Kühnapfel and Stefan Preußler and
Maximilian Noppel and Thomas Schneider and
Konrad Rieck and Christian Wressnegger},
title =     {LaserShark: Establishing Fast, Bidirectional
Communication into Air-Gapped Systems},
booktitle = {Proc. of 37th Annual Computer Security
Applications Conference (ACSAC)},
year =      2021,
month =     dec
}

A preprint of the paper is available here.

Video

The following video shows a simplified setup of the attack as descriped here that can be easily re-built at home with low-cost devices rather than strong lasers and a high-precision telescope as used for the real attack.