Israeli researcher Mordechai Guri has published his paper ETHERLED. ETHERLED is a new technique that allows attackers to leak data from air-gapped devices by controlling the status LEDs. This attack can be used on a wide range of devices, including PCs, printers, network cameras, and embedded controllers. Data can be encoded and modulated over the optical signals generated by the LEDs. An attacker with line-of-sight to the device can intercept and decode these signals. BleepingComputer’s write-up explains that the malware either modifies the NIC’s firmware or driver, or toggles link speed and the interface itself, and blinks out the data as Morse-style dots and dashes. The firmware route is by far the fastest: the paper reports up to 100 bit/s that way, versus at most 2 bit/s via ethtool-style LED control or link-speed changes, with capture ranges from 10 m for a webcam to over 100 m with a telescope. Defensive countermeasures for this attack include physically obscuring the LEDs or monitoring for unusual activity. Black electrical tape remains an underrated security control.
