Thursday, March 28, 2024

Hackers Can Exfiltrate Sensitive Data from Air-Gapped Computers Using Screen Brightness

New cybersecurity research shows that attackers can exfiltrate sensitive information from the air-gapped computers by manipulating the brightness of the screen.

The attack was discovered by a team of researchers from Ben-Gurion University of the Negev, Israel. The air-gapped computer attack introduces a new covert channel.

With the new optical covert channel attacker can exfiltrate the data while the user is working on the computer.

How the Attack Works

The attack assumes that the targeted system is already infected with the malware and by this optical covert channel method, attackers can exfiltrate data bypassing intrusion detection systems (IDS), firewalls and AV programs.

The malware collects sensitive information from the installed computer and then it encodes the data as a stream of bytes and modulates on the screen.

It is invisible to the human eye, but by recording the computer screen with a camera attackers can reconstruct the sensitive information by using image processing techniques.

optical covert channel

Researchers described two possible attack scenarios:

  • A malicious insider within the lime of compromised computer
  • A compromised local attacker for which the attacker has access to

With the attack model proposed by researchers, the RGB color component of each pixel is slightly changed and the changes are relatively small, fast and invisible.

Here you can find the video demonstration of the attack.

More details of the attack can be found in the paper published by researchers titled “BRIGHTNESS: Leaking Sensitive Data from Air-Gapped Workstations via Screen Brightness“.

Mitigations

  • Restricting access to sensitive computers
  • Prohibition of recording devices in the sensitive area
  • Using polarized film to cover the screen

Other Air-Gapped Computers Attack

Hackers can use Power Lines to Steal Data from Air-Gapped Computer

CIA Hacking Tool “Brutal Kangaroo” Revealed to Hack Air-Gapped Networks by using USB Thumb Drives -WikiLeaks

Hackers can use Surveillance Cameras and Infrared Light to Transfer Signals to Malware

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles