Blinking Lights: The Newest Hack

Michelle Delio Email 03.07.02


Light may be the latest way to steal sensitive data from computer systems, according to three researchers who claim to have discovered ways of using illumination as a spy tool.

Research papers made available online Wednesday detail methods of grabbing information from computers via the light reflected by some kinds of monitors and through the flickers of the LED displays on some devices.

Security experts say the discoveries were interesting in a theoretical sense, confirming experiments that have been conducted since the mid-1960s, but also stressed that these exploits should not concern most people.

"Let's face it -- there are far easier ways to grab data from networks than snagging beams of light," Rick Adorama, a security researcher based in London, said.

Experts say the most interesting discovery was that the flickers of some LED displays may actually be a sort of Morse code that transmit information about the data being processed.

On computer devices, Light Emitting Diodes (LEDs) are the small lit displays that typically glow green or red. They are used to indicate the status of a device –- whether it's busy, on or idle.

According to the research (PDF) conducted by Joe Loughry, a computer programmer at Lockheed Martin Space Systems in Denver, and David Umphress, a software engineering professor at Alabama's Auburn University, the flickers of LEDs, in some cases and on some devices, correlates closely with the information that is being processed by the device, and would allow a malicious hacker full access to unencrypted data passing through it.

Although some news stories vaguely indicated that data could be gathered from monitoring the flickers of LED displays on all electronics equipment, the researchers were quite specific about the types of devices that leaked information through light pulses.

The research includes definitions of those types of devices that can and can't be used for these purposes.

Class I devices have LEDs that indicate, with a steady glow, whether the device is on or off. In Class II devices, the LED's flickers simply show there's activity -- steadily blinking on and off to indicate only that data is being transmitted.

But the flickers of some Class III devices, such as dial-up modems and some routers and printers, correlate closely with the contents of the data that is being transmitted. The data being processed or transmitted by these specific devices was further compromised due to a design flaw in some machines that caused data to be processed while unencrypted.

Loughry and Umphress said in their paper that they were able to capture information from specific Class III devices from about 22 yards away by monitoring the flickers with a high-speed photodiode light detector to measure the amount of light coming from an LED over time.

Using these measurements, they could determine when the LED was on or off, and thus identify the transmission pattern of bits. They then observed that the on-off pattern received from the detector was the same as the test data they were transmitting to the device with the LED. And they were also able to translate the data, in some cases, into a usable form.

"The result of our research is that we could obtain data by watching LEDs," Umphress said. "If the LEDs are flashing in concert with clear (unencrypted) text, then we would get clear text; if they were flashing encrypted data, then we would get that data in encrypted form and, of course, we couldn't know the content of the data."

Security experts said that leaky LEDs are not a concern for most business and home computer users. The types of devices that potentially do leak data are so limited, and the effort involved in grabbing that data so complex, that only those whose networks contain truly sensitive information, routed through devices specified in the research, would need to be even slightly concerned.

Related Topics:

Science , Discoveries