The Rack Lights That Counted: A Binary Air-Gap Side Channel
The challenge
An air-gapped signing appliance at Ardenmoor has no network and no screen, but its power draw is not constant: a researcher clamped a meter on its supply and logged, once a second, whether the appliance was pulling high or low. Over the maintenance window the trace became a clean run of highs and lows, far too regular to be ordinary work. The appliance is leaking its maintenance code through how much current it draws. Decode the trace and read the code.
What you'll learn
- Recognise a two-state physical signal as a stream of bits
- Decode an 8-bit-per-character binary stream into text
- Explain why an air gap does not stop side-channel exfiltration
- Name other covert channels: fan, LED, heat, timing
- State the physical and procedural defences
Skills tested
Prerequisites
- What binary is
- That a byte is eight bits
How it works
A covert channel carries data over something that was never meant to be a communication link. A device with no network can still leak information through anything an observer can measure and the device can influence: power draw, temperature, fan noise, an LED, or the timing of its work.
Here the appliance modulates its current, high or low each second. A two-state signal is one bit per sample, so the trace is a bitstream. Eight bits per character makes it text, and decoding it recovers the maintenance code.
This is why an air gap is not isolation by itself. It stops packets, not physics, and a determined channel moves data slowly but reliably through the physical world.
Common mistakes
- Reading it as decimal or hex. The stream is only ones and zeros; it is binary.
- Forgetting byte alignment. Group the bits in eights before converting to characters.
- Expecting a key. Nothing is encrypted; the signal is simply encoded as bits.
- Over-decoding. One pass of the binary decoder yields readable text; no further step is needed.
How to defend against it
Close the physical channel, not just the network.
- Filter, smooth and isolate the power supply so draw cannot be modulated into a clean signal.
- Shield or enclose sensitive devices and control what can observe them (power, electromagnetic, acoustic, optical).
- Forbid measurement and recording equipment in sensitive areas, and monitor for unexplained regular patterns in any physical telemetry.
- Treat an air gap as one control among many, never as proof of isolation.