Abstract:Infrared (IR) light is invisible to humans, but cameras are optically sensitive to this type of light. In this paper, we show how attackers can use surveillance cameras and infrared light to establish bi-directional covert communication between the internal networks of organizations and remote attackers. We present two scenarios: exfiltration (leaking data out of the network) and infiltration (sending data into the network). Exfiltration. Surveillance and security cameras are equipped with IR LEDs, which are used for night vision. In the exfiltration scenario, malware within the organization access the surveillance cameras across the local network and controls the IR illumination. Sensitive data such as PIN codes, passwords, and encryption keys are then modulated, encoded, and transmitted over the IR signals. Infiltration. In an infiltration scenario, an attacker standing in a public area (e.g., in the street) uses IR LEDs to transmit hidden signals to the surveillance camera(s). Binary data such as command and control (C&C) and beacon messages are encoded on top of the IR signals. The exfiltration and infiltration can be combined to establish bidirectional, 'air-gap' communication between the compromised network and the attacker. We discuss related work and provide scientific background about this optical channel. We implement a malware prototype and present data modulation schemas and a basic transmission protocol. Our evaluation of the covert channel shows that data can be covertly exfiltrated from an organization at a rate of 20 bit/sec per surveillance camera to a distance of tens of meters away. Data can be covertly infiltrated into an organization at a rate of over 100 bit/sec per surveillance camera from a distance of hundreds of meters to kilometers away.

Light Ears: Information Leakage via Smart Lights

Security Concerns in IoT Light Bulbs: Investigating Covert Channels

EM Eye: Characterizing Electromagnetic Side-channel Eavesdropping on Embedded Cameras

Demons Hidden in the Light: Unrestricted Adversarial Illumination Attacks

Current Events: Identifying Webpages by Tapping the Electrical Outlet.

Peek-a-Boo: I see your smart home activities, even encrypted!

Evaluation and Defense of Light Commands Attacks Against Voice Controllable Systems in Smart Cars

Information Leakage from Optical Emanations

Hard Drive of Hearing: Disks That Eavesdrop with a Synthesized Microphone

All Your Bulbs Are Belong to Us: Investigating the Current State of Security in Connected Lighting Systems

xLED: Covert Data Exfiltration from Air-Gapped Networks via Router LEDs

Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems

The Dark (and Bright) Side of IoT: Attacks and Countermeasures for Identifying Smart Home Devices and Services

ZLeaks: Passive Inference Attacks on Zigbee based Smart Homes

PIXHELL Attack: Leaking Sensitive Information from Air-Gap Computers via `Singing Pixels'

Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic

A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic

Optical Air-Gap Attacks: Analysis and IoT Threat Implications

Information Leakage Through Mobile Motion Sensors: User Awareness and Concerns

Imaging privacy threats from an ambient light sensor

aIR-Jumper: Covert Air-Gap Exfiltration/Infiltration via Security Cameras & Infrared (IR)