I am trying to extract data from an air-gapped computer as a project. I already have a working prototype using high frequency sound and a key-logger.

I would like to find another way to do it without much effort. I have already tested trying to control the fan speed on a desktop to achieve a similar result to the high frequency sound but there is too much noise interference for it to be useable. I am trying now to control the blinking data activity LED on the computer, and capture that information using a camera.

Does anyone know a way to control/overwrite the normal progress LED usage using any programming language either on Windows or Linux?

closed as off-topic by Steffen Ullrich, schroeder Apr 5 at 20:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I need more detail of your setup. – DarkMatter Apr 4 at 1:03
  • "Does anyone know a way to control/overwrite the normal progress LED usage using any programming language either on Windows or Linux?" - this is purely a programming question (i.e. off-topic) which just happens to be asked with some security context - but this context is actually irrelevant for the question. Apart from that, I have no idea what "progress LED" you mean. There is often some LED coupled to the activity of the hard disk (nothing about progress) and a keyboard LED (nothing about progress either). – Steffen Ullrich Apr 4 at 5:19
  • @SteffenUllrich I'm reading this like an XY question, since LEDs are not the best way to covertly exfiltrate information from an air-gapped computer. – forest Apr 4 at 6:25
  • @forest: I agree. The X would likely be a security question but is not asked. Instead the Y is asked which is a programming question. – Steffen Ullrich Apr 4 at 6:53

For Linux at least, there is the LED subsystem that does what you want. From kernel documentation:

In its simplest form, the LED class just allows control of LEDs from userspace. LEDs appear in /sys/class/leds/. The maximum brightness of the LED is defined in max_brightness file. The brightness file will set the brightness of the LED (taking a value 0-max_brightness). Most LEDs don't have hardware brightness support so will just be turned on for non-zero brightness settings.

The class also introduces the optional concept of an LED trigger. A trigger is a kernel based source of led events. Triggers can either be simple or complex. A simple trigger isn't configurable and is designed to slot into existing subsystems with minimal additional code. Examples are the disk-activity, nand-disk and sharpsl-charge triggers. With led triggers disabled, the code optimises away.

There is a way to do this without LEDs, by modulating activity on the CPU and turning a computer, even one without a wireless NIC, into a transmitter using a certain frequency. From the abstract of a research paper titled GSMem: Data Exfiltration from Air-Gapped Computers over GSM Frequencies:

Air-gapped networks are isolated, separated both logically and physically from public networks. Although the feasibility of invading such systems has been demonstrated in recent years, exfiltration of data from air-gapped networks is still a challenging task. In this paper we present GSMem, a malware that can exfiltrate data through an air-gap over cellular frequencies. Rogue software on an infected target computer modulates and transmits electromagnetic signals at cellular frequencies by invoking specific memory-related instructions and utilizing the multichannel memory architecture to amplify the transmission

It is also possible to do by utilizing general-purpose USB devices, such as flash drives. From a similar research paper titled USBee: Air-Gap Covert-Channel via Electromagnetic Emission from USB:

In this paper we present USBee, a software that can utilize an unmodified USB device connected to a computer as a RF transmitter. We demonstrate how a software can intentionally generate controlled electromagnetic emissions from the data bus of a USB connector. We also show that the emitted RF signals can be controlled and modulated with arbitrary binary data.

Similar techniques can be found by searching for research involving covert data exfiltration on air-gapped computers, particularly when involving electromagnetic emissions.

Not the answer you're looking for? Browse other questions tagged or ask your own question.