Dr. Mordechai Guri

Modern LCD screens are equipped with a special controllable light source at the back of the screen called a backlight. This hardware allows dynamic control of the level of light intensity on the screen, resulting in better contrast ratios. It exists on all modern LCD screens, including desktop, TV, and laptop screens. This paper demonstrates how attackers can exploit air-gapped computers' backlights to exfiltrate sensitive information. Malware on a compromised computer can steal sensitive data and encode it over small changes in screen brightness by controlling the backlight illumination levels. Small changes in screen illumination can be detected within video streams taken by cameras, such as local security or smartphone cameras tens of meters away. The data concealed in the video stream is then demodulated, decoded, and delivered to the attacker. We present technical details and discuss backlight control software and stealth characteristics. We examine the channel's limitations under various parameters and evaluate it with different types of displays and at several distances. We also present relevant countermeasures for this type of optical attack.