Categories: NewsSecurity

xLED Malware Lets Criminals Exfiltrate Sensitive Information Through Router LEDs

Internet criminals have come up with yet another creative way to steal data from secure corporate networks. This new method revolves around infecting routers and switches with a new type of malware. As a result of such an infection, the malicious software can control the device’s LEDs and use them to transmit information in the binary format. This does require the attacker to be nearby, though, but it is still a troublesome development.

Led-controlling Malware Is Becoming a Problem

It is quite problematic to think of malware which transmits data by controlling the LEDs fading on a modem or network switch. Since these devices constantly display LEDs – which often flicker if traffic is routed through the device – it is quite difficult to determine when something malicious is going on. Moreover, the assailant needs to be close to the infected device to capture this information, which can be done by using off-the-shelf video recording equipment.

It is evident not too many criminals will use this method of attack anytime soon. However, company employees who hold a grudge against the enterprise they work for could certainly use this malware to their advantage. That is, assuming they get their hands on a working sample. For now, this attack vector is merely a proof of concept developed by researchers in Israel. However,  it shows data can be extracted from networks by manipulating LEDs on these devices.

The malware developed for this particular purpose goes by the name of xLED. The malicious software is capable of intercepting particular data passing through a router or network switch. This information is then converted into a binary data stream and rebroadcasted using the LEDs found on the front of said router or switch. It sounds like a complicated way of broadcasting sensitive data, but it is also an inconspicuous method of doing so. Anyone with a clear line of sight can record the LEDs flashing and exfiltrate data from doing so.

Related Post

As is somewhat to be expected, more LEDs on the router or switch will result in more information being transmitted. Various configurations of these devices have been tested, and it turns out data can be exfiltrated at a rate of up to 1000 bits/second per LED. Multiple LEDs will exponentially increase the amount of information broadcasted. Most enterprise-grade routers and switches have at least seven LEDs these days.

One thing to take into account is how assailants will still need to install this malware on the router or switch. That is not all that difficult, as criminals have been quite successful in doing so for quite some time now. It does not appear xLED or any other similar versions of this malware require physical access to the router or switch to be installed. This means a regular malware distribution campaign can be quite useful to infect routers and switches with this type of malware.

Although this is a relatively new threat, it is not the most convenient way to exfiltrate sensitive information from companies by any means. It is a very impractical way of going about things, to say the least. That does not mean criminals will be dissuaded from giving it a try, though, assuming they can gain access to internal security cameras to record the stream of binary information transmitted by the LEDs. Rest assured this type of malware may make the rounds in the coming years, though, as it is an inconspicuous way of stealing sensitive information.

If you liked this article, follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin, cryptocurrency, and technology news.

JP Buntinx

JP Buntinx is a FinTech and Bitcoin enthusiast living in Belgium. His passion for finance and technology made him one of the world's leading freelance Bitcoin writers, and he aims to achieve the same level of respect in the FinTech sector.

Published by
JP Buntinx
Tags: malwarexLED

Recent Posts

WAX Price Up 44%, Increased User Adoption Signals Growing Interest in the Platform

WAX price is up over 44% today, making it the biggest gainer on With…

2 hours ago

5 Underrated Metaverse Coins With Great Long Term Potential

Metaverse coins are all the hype these days, with coins like Decentraland and Axie Infinity…

6 hours ago

Ankr Price Up 11% Amid Binance Listing and Polkadot Parachain Integration

Ankr price is up over 11% today, making it one of the biggest gainers on…

10 hours ago

Keep Network Price Up 45% Amid Upcoming Threshold Merger

Keep Network price is up over 45% today, making it the biggest gainer on…

23 hours ago

Nugenesis Patented Gasless NFT Platform Will Bring Mainstream Adoption

NuGenesis has 4 patents pending for its gasless NFT multi-cross chain system. It sees NFTs…

1 day ago

Top 5 Metaverse Coins With Fully Functional Apps to Watch In 2022

The hottest trends in crypto right now are meme coins and metaverse projects. With Facebook's…

1 day ago

This website uses cookies.