Many networks use a security measure known as "air gapping" to isolate a computer or network to prevent an outside connection from being established. This type of security is used in the military, governments, stock markets, and many others.

A group of researchers has created a malware that is capable of jumping airgaps by using the infrared signals on infected network's surveillance cameras where attackers can send and receive data.

How It Works

The proof-of-concept malware uses connected surveillance cameras to bridge such air gaps. Instead of trying to use the Internet to reach attacker-controlled servers, the malware weaves passwords, cryptographic keys, and other types of data into infrared signals and uses a camera's built-in infrared lights to transmit them. A nearby attacker then records the signals with a video camera and later decodes embedded secrets. The same nearby attackers can embed data into infrared signals and beam them to an infected camera, where they're intercepted and decoded by the network malware. The covert channel works best when attackers have a direct line of sight to the video camera, but non-line-of-sight communication is also possible in some cases.

The malware is known as aIR-Jumper.

aIR-Jumper uses several different schemes to encode the zeroes and ones that form the basic building blocks of all digital data. The malware breaks large data streams into small packets or frames that include a preamble, a payload, and a 16-bit cyclic redundancy check to ensure the data was sent correctly. The proof-of-concept attack uses an infected camera's own programming interfaces to control the infrared LEDs to transmit the data according to the encoding scheme and other parameters selected. Infrared LEDs are used to enable night vision so that cameras can produce images when there is little or no ambient light.

Network security is a constant cat and mouse game and this type of malware seem rather scary if it were to get into the wrong hands.

This is why it's so important to keep up to date with the latest in network security.




Sources: 1,2