Malware Uses Router LEDs to Steal Data From Secure Networks

itman · Jun 6, 2017

Specially-designed malware installed on a router or a switch can take control over the device’s LEDs and use them to transmit data in a binary format to a nearby attacker, who can capture it using simple video recording equipment.

This attack scenario is the creation of a talented team of researchers from the Cyber Security Research Center at the Ben-Gurion University of the Negev in Israel, who previously researched other types of data exfiltration scenarios relying on hard drive LEDs, coil whine, headphones, and others.

Attackers need to install malware on routers, switches
The entire operation is centered around a piece of malware the researchers created and named xLED.

This malware will intercept specific data passing through the router, break it down into its binary format, and use a router LED to signal the data to a nearby attacker, with the LED turned on standing for a binary one and the LED turned off representing a binary zero.

An attacker with a clear line of sight to the equipment can record the blinking operation. This “attacker” can be a security camera, a company insider, recording equipment mounted on a drone, and various other setups where a video recording device has a clear sight of the router or switch’s blinking LEDs.

The more router LEDs, the higher the exfiltration speed
During their tests, researchers say they’ve tested various configurations for the video recording setup, such as optical sensors, security/CCTV cameras, extreme cameras, smartphone cameras, wearable/hidden cameras, and others.

The research team says it achieved the best results with optical sensors because they are capable of sampling LED signals at high rates, enabling data reception at a higher bandwidth than other typical video recording equipment.

Researchers say that by using optical sensors, they were able to exfiltrate data at a rate of more than 1000 bit/sec per LED. Since routers and switches have more than one LED, the exfiltration speed can be increased many times over if multiple LEDs are used for data exfiltration. Basically, the more ports the router and switch has, the more data the malware can steal from the device.
Click to expand...

https://www.bleepingcomputer.com/ne...uter-leds-to-steal-data-from-secure-networks/

NormanF · Jun 6, 2017

Most people who have home networks have secured networks through their router modems.

What the study revealed is that even hardware can be compromised with the right exploit kit.

What hackers and black malware writers are capable of is made possible by flaws they can exploit to take over compromised systems.

Log in or Sign up

Malware Uses Router LEDs to Steal Data From Secure Networks

itman Registered Member

NormanF Registered Member

Log in or Sign up

Malware Uses Router LEDs to Steal Data From Secure Networks

itman Registered Member

NormanF Registered Member

Useful Searches