Some academics from Israel analyzed and presented a new method of stealing data from air-gapped computers.
This method is based on making small adjustments to the brightness settings of an LCD screen. The adjustments are not visible to the naked eye, but can be detected from video feeds using algorithmic methods.
The academics described this novel method of data theft but stressed that there is no serious cause for concern, as it is not an attack that can easily be carried out by anyone.
The researchers named the attack BRIGHTNESS. It is designed for air-gapped setups, where computers are kept on a separate network without access to the internet.
Air-gapped computers are commonly used in government systems or business networks, which store highly confidential documents and personal data .
Experienced and creative hackers can find ways to infect these systems. They can, for example, use an infected USB plugged into them. However, stealing data from air-gapped computers is difficult.
That's what academics from Ben-Gurion University of the Negev in Israel have tried to do. For the past few years, they've been studying ways to extract data from already infected air-gapped computers.
Previous research had shown various data theft techniques.
But how does the new BRIGHTNESS attack work?
The steps of the attack are described below:
- Contamination of the air-gapped system
- The malware running on the infected computer collects the data/files it wants to steal.
- The malware changes a screen's color settings, ultimately modifying the brightness level.
- The brightness level is adjusted in a specific way so that a file is output, one bit at a time.
- The infected computer's screen is recorded.
- The video is analyzed and the file is reconstructed by analyzing the variations in screen brightness.
This small change in brightness is invisible to the human eye but not to modern high-resolution video cameras, which are equipped with smartphones, security , etc.
BRIGHTNESS attack is extremely slow
However, extracting data this way is extremely slow. In fact, it is the slowest technique for stealing data from air-gapped computers ever demonstrated. However, it can be effective in cases where the attacker wants to steal a very small amount of data, e.g. an encryption key. It is certainly not a suitable method for stealing a lot of data.
More information about this specific attack can be found in the research paper titled “BRIGHTNESS: Leaking Sensitive Data from Air-Gapped Workstations via Screen Brightness”.
