For decades, air-gapped systems which are physically isolated from external networks have been the last line of defense for high-security environments: nuclear facilities, defense networks, R&D labs, and critical infrastructure. But in 2025, even isolation isn't enough. Why? Because attackers have learned to blink the data out. Welcome to the covert world of optical data exfiltration, where malware manipulates LEDs, Morse code becomes a medium, and surveillance cameras act as listening posts. Leaking Data with Light Leaking Data with Light The technique is deceptively simple, yet incredibly effective. A compromised air-gapped system is infected with specialized malware via insider access, compromised USB, or supply chain infiltration. The malware encodes sensitive data (passwords, cryptographic keys, documents) into binary or Morse code. The data is then modulated into optical signals by blinking an on-board LED, typically: HDD activity LED Keyboard indicators (Num Lock, Caps Lock Router port status LEDs IR LEDs in surveillance cameras An attacker with line-of-sight access using a smartphone, camera drone, telescope, or hijacked CCTV, records the blinking patterns. On the attacker’s side, the optical data is decoded into plaintext using signal processing or computer vision tools. A compromised air-gapped system is infected with specialized malware via insider access, compromised USB, or supply chain infiltration. A compromised air-gapped system is infected with specialized malware via insider access, compromised USB, or supply chain infiltration. The malware encodes sensitive data (passwords, cryptographic keys, documents) into binary or Morse code. The malware encodes sensitive data (passwords, cryptographic keys, documents) into binary or Morse code. The data is then modulated into optical signals by blinking an on-board LED, typically: HDD activity LED Keyboard indicators (Num Lock, Caps Lock Router port status LEDs IR LEDs in surveillance cameras The data is then modulated into optical signals by blinking an on-board LED, typically: HDD activity LED Keyboard indicators (Num Lock, Caps Lock Router port status LEDs IR LEDs in surveillance cameras HDD activity LED HDD activity LED Keyboard indicators (Num Lock, Caps Lock Keyboard indicators (Num Lock, Caps Lock Router port status LEDs Router port status LEDs IR LEDs in surveillance cameras IR LEDs in surveillance cameras An attacker with line-of-sight access using a smartphone, camera drone, telescope, or hijacked CCTV, records the blinking patterns. An attacker with line-of-sight access using a smartphone, camera drone, telescope, or hijacked CCTV, records the blinking patterns. On the attacker’s side, the optical data is decoded into plaintext using signal processing or computer vision tools. On the attacker’s side, the optical data is decoded into plaintext using signal processing or computer vision tools. How It Works How It Works Let’s break it down with an example using a surveillance camera with an IR LED: Step 1: Malware Deployment Step 1: Malware Deployment Malware is delivered via infected firmware, insider USB drive, or a pre-installed rootkit. The malware gains access to the camera's IR LED controls, often available via low-level APIs or debug interfaces. Malware is delivered via infected firmware, insider USB drive, or a pre-installed rootkit. The malware gains access to the camera's IR LED controls, often available via low-level APIs or debug interfaces. Step 2: Data Encoding & Modulation Step 2: Data Encoding & Modulation Sensitive data (e.g., "RootPassword123") is converted to binary or Morse code: `"R" in Morse: .-. ` Or `in binary: 01010010` `"R" in Morse: .-. ` Or `in binary: 01010010` Data is framed with start/stop sequences to aid synchronization during decoding. Timing is critical: On-off intervals must be consistent (e.g., 100 ms on, 100 ms off per bit). Data is framed with start/stop sequences to aid synchronization during decoding. Timing is critical: On-off intervals must be consistent (e.g., 100 ms on, 100 ms off per bit). Step 3: Optical Transmission Step 3: Optical Transmission The IR LED blinks rapidly and is invisible to the human eye, but detectable to most cameras or IR sensors. `LED on = binary 1` `LED off = binary 0` `LED on = binary 1` `LED off = binary 0` Transmission rates vary from 10–100 bits per second, depending on LED type and brightness. Transmission rates vary from 10–100 bits per second, depending on LED type and brightness. Step 4: Optical Capture Step 4: Optical Capture Attacker positions a camera within LOS (line-of-sight). Could be: A tampered building camera Drone-mounted camera at night Smartphone from a nearby building Frame-by-frame analysis captures the blinking pattern. OpenCV or similar libraries are used to extract and decode the signal. A tampered building camera Drone-mounted camera at night Smartphone from a nearby building Frame-by-frame analysis captures the blinking pattern. OpenCV or similar libraries are used to extract and decode the signal. Step 5: Reconstruction Step 5: Reconstruction Software demodulates the light pulses, reconstructs the binary stream, and decodes it back into human-readable content. Real-World Implementations Real-World Implementations These aren’t just theoretical. Here are some notable proof-of-concept attacks that have demonstrated this technique in the wild: aIR-Jumper (Ben-Gurion University): aIR-Jumper (Ben-Gurion University): Attack Medium: IR LEDs on surveillance cameras Data Rate: ~20 bits per second Range: Up to 25 meters Attack Medium: IR LEDs on surveillance cameras Data Rate: ~20 bits per second Range: Up to 25 meters LED-it-GO LED-it-GO Attack Medium: Hard drive activity LEDs Data Rate: ~100 bits per second Range: Up to 30 meters Attack Medium: Hard drive activity LEDs Data Rate: ~100 bits per second Range: Up to 30 meters xLED xLED Attack Medium: Keyboard indicator LEDs (Caps Lock, Num Lock, etc.) Data Rate: ~60 bits per second Range: Up to 20 meters Attack Medium: Keyboard indicator LEDs (Caps Lock, Num Lock, etc.) Data Rate: ~60 bits per second Range: Up to 20 meters Glowworm Glowworm Attack Medium: Audio-to-light leakage from power LEDs Data Rate: Passive signal leakage, not encoded by malware Range: Detectable with line-of-sight sensors Attack Medium: Audio-to-light leakage from power LEDs Data Rate: Passive signal leakage, not encoded by malware Range: Detectable with line-of-sight sensors Risk Factors: Where It Can Happen Risk Factors: Where It Can Happen This attack is especially dangerous in: High-security air-gapped labs Industrial control systems (ICS) Secure server rooms with exposed LEDs Offices using IR-equipped surveillance for night monitoring High-security air-gapped labs Industrial control systems (ICS) Secure server rooms with exposed LEDs Offices using IR-equipped surveillance for night monitoring If you have: Line-of-sight LEDs, Malware infection vector, Surveillance infrastructure, then, you have a viable covert exfiltration channel. Line-of-sight LEDs, Malware infection vector, Surveillance infrastructure, then, you have a viable covert exfiltration channel. How to Defend Against LED Covert Channels Mitigation requires a multi-layered approach: 1) Physical Controls 1) Physical Controls Block LEDs with opaque tape or shield covers. Use blackout enclosures or anti-IR glass in sensitive areas. Place sensitive systems in non-transparent, enclosed environments. Use blackout enclosures or anti-IR glass in sensitive areas. Place sensitive systems in non-transparent, enclosed environments. 2). Monitoring 2). Monitoring Detect unauthorized LED blinking patterns using optical sensors or machine learning-based anomaly detection. Log and audit LED usage via firmware (where applicable). Detect unauthorized LED blinking patterns using optical sensors or machine learning-based anomaly detection. Log and audit LED usage via firmware (where applicable). 3). Firmware & OS Hardening 3). Firmware & OS Hardening Disable or isolate camera LED control APIs unless strictly necessary. Deploy BIOS/firmware validation tools in air-gapped systems. Disable keyboard LEDs and router port LEDs where unused. Disable or isolate camera LED control APIs unless strictly necessary. Deploy BIOS/firmware validation tools in air-gapped systems. Disable keyboard LEDs and router port LEDs where unused. Final Thoughts Final Thoughts The blink of an LED was once harmless—a passive sign of activity. But in 2025, even a flicker can be a cyber whisper, bleeding secrets into the night. In a world where radio silence is no longer enough, organizations must now think in photons as well as packets. So, the next time your devices start blinking oddly, don’t call IT, call the CIA. So, the next time your devices start blinking oddly, don’t call IT, call the CIA.
