{"id":458007,"date":"2022-08-26T08:32:53","date_gmt":"2022-08-26T06:32:53","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=458007"},"modified":"2022-08-26T08:39:52","modified_gmt":"2022-08-26T06:39:52","slug":"network-card-leds-can-leak-confidential-data-from-secure-devices-using-morse-code","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/458007-network-card-leds-can-leak-confidential-data-from-secure-devices-using-morse-code.html","title":{"rendered":"Network card LEDs can leak confidential data from secure devices using Morse code"},"content":{"rendered":"

Ben Gurion University\u2019s head of cyber security research and development, Dr Mordechai Guri, has discovered<\/a><\/strong> a new technique that sends Morse code signals via the LEDs on network interface cards.<\/p>\n

Attackers can use the technique, named ETHERLED, to leak data from air-gapped networked devices like PCs, printers, network cameras, embedded controllers, and servers.<\/p>\n

Dr Guri said air-gapped devices are highly secure hardware isolated from the Internet or other public networks due to the confidential information they process.<\/p>\n

However, by using the ETHERLED technique, attackers can still exfiltrate confidential data using devices\u2019 network cards.<\/p>\n

\u201cNetworked devices have an integrated network interface controller (NIC) that includes status and activity indicator LEDs.\u201d<\/p>\n

\u201cWe show that malware installed on the device can control the status LEDs by blinking and alternating colours, using documented methods or undocumented firmware commands.\u201d<\/p>\n

\u201cInformation can be encoded via simple encoding such as Morse code and modulated over these optical signals. An attacker can intercept and decode these signals from tens to hundreds of meters away,\u201d Dr Guri said.<\/p>\n

To decrypt the messages, attackers would need either a hidden camera with a direct line of sight or access to a surveillance camera vulnerable to remote exploitation.<\/p>\n

The ETHERLED method can leak passwords, RSA encryption keys, and keystrokes to cameras between 10 and 50m away from the compromised device.<\/p>\n

Dr Guri has recommended countermeasures that include covering the status LEDs with black tape, adding random noise to the modulated signals, and restricting the camera zones in relevant environments.<\/p>\n