Exfiltrating data from Air-Gapped Networks via Router LEDs

A team of Israeli researchers has devised a new technique to exfiltrate data from a machine by using a malware that controls router LEDs.

A few months ago a group of researchers from Israeli Ben-Gurion University devised a new technique to exfiltrate data from a machine by using a malware that controls hard drive LEDs, now researchers applied the technique to routers.

The attack is very insidious because hacking a router it is possible to gain control over the entire network, for this reason, the researchers focused their efforts in stealing admin credentials of the device.

The team of experts led by the expert Mordechai Guri developed a specific firmware dubbed xLED that allowed them to control the LED while the router is working.

Alternatively, the group demonstrated how to force the router executing a malicious script to control the LED.

Algorithm 1 ModulateOOK
1: procedure ModulateOOK(nLED, data, T)
2: openLED(nLED); //opens the LED file for writing
3: while(data[i] !=0)
4: if(data[i] == ‘0’) //modulate 0 by turning the LED off
5: setLEDOff(nLED);
6: if(data[i] == ‘1’) //modulate 1 by turning the LED on
7: setLEDOn(nLED);
8: i++;
9: sleep(T); // sleep for time period of T
10: closeLED(nLED); // closes the LED file descriptor

below the shellscript released by the experts:

// Method #1
// turn the LED on
1: echo 0 > /sys/class/leds/led_name/brightness
// turn the LED off
2: echo 255 > /sys/class/leds/led_name/brightness
// Method #2
3: echo 1 > /proc/gpio/X_out // turn the LED on
4: echo 0 > /proc/gpio/X_out // turn LED off

The researchers also shared a proof-of-concept video of the attack:

To prevent this kind of attack the best option for the user it to put a tape over the LEDs, and to check the firmware running his/her router.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – router leds, data exfiltration)

[adrotate banner=”13″]