Dr. Mordechai Guri

Sensitive networks hold and process confidential information and, therefore, are kept separate from the Internet. This defensive measure is known as an ‘air gap.’ In this paper, we show that attackers can exploit networked printers to exfiltrate data from air-gapped networks. We show that malware in the network can control the printer display screen and status LEDs and modulate sensitive information over them using documented and undocumented firmware and software level commands. Local or remote adversaries can intercept and decode these signals from a few meters to hundreds of meters away. For reception, they can use a smartphone, a local surveillance camera, or camera mounted on a drone. The display panels of printers are currently not monitored or protected by any security measures, such as intrusion detection systems (IDS) and intrusion prevention systems (IPS), which makes this attack highly evasive. We provide technical details, discuss the attack model, and present related work. We evaluate this new type of attack and discuss the necessary countermeasures, both defensive and preventive.