Hackers can steal sensitive PC data by tracking monitor brightness
If you think that your computer is safe from cyberattacks when it's not connected to the internet, you are making a big mistake! A scary new study has revealed that along with the old trick of injecting data-stealing malware, hackers can even use the brightness of your PC's monitor to attack your system and steal sensitive information from it. Here's all about it.
Changing brightness to steal data from air-gapped computers
Air-gapped computers are seen as one of the hardest to hack, as they don't have internet, which prevents them from connecting with third-party, potentially malicious, computers, servers, or network devices. However, in a recent study, the researchers at Israel's Ben Gurion University found that such systems can also be compromised by simply changing the brightness of their screen.
How such an attack would work?
As the team told The Hacker News, the optical channel attack works by delivering a malware that steals the data, be it files or passwords, and then delivers it to the hacker by modulating it "within the screen brightness." Basically, it relays the information by changing the RGB color values of the LCD, something that a camera-equipped device can detect but humans cannot.
Data is encoded in the form of bytes
The collected data is encoded by the malware as a stream of bytes and then relayed through brightness changes as 0 and 1 in a Morse code-like pattern. The researchers said, "In the proposed modulation, the RGB color component of each pixel is slightly changed."
User won't even notice as their data leaks
The attack detailed here can theoretically allow a threat actor to inject malware via pen drive and then use the same for relaying information via nearly invisible brightness changes. "These changes are invisible since they are relatively small and occur fast," the team explained, adding that "the overall color change of the image on the screen is [also] invisible to the user."
However, you don't have to worry just yet
While the trick sounds scary, it is imperative to note that it cannot be used to carry out mass attacks against regular users. This is mainly because the entire hack revolves around physically installing malware and cameras, which is not possible for bulk attacks. However, if someone specifically targets you or an organization, then there is definitely something to worry about.
