The Light That Talks: Reading Data Out of a Blinking Indicator
The challenge
The night guard at a Rhodes Logistics depot kept noticing the status light on a wall-mounted access controller flickering after hours, always for about forty seconds, always around the same time. The unit has no network connection and no screen, which is exactly why it was chosen for the door it controls. Security filmed one of the episodes and a technician wrote the blinks down: short flash, long flash, gap. The transcription is below. Somebody is reading it from the car park.
What you'll learn
- Recognise Morse from the shape of a transcription
- Explain what a covert channel is and why a status LED is one
- Describe how an air gap is defeated without any network
- Name the everyday outputs that can carry data out of an isolated device
Skills tested
Prerequisites
- None
How it works
A covert channel is any way of moving information that the people who built the system never counted as a way of moving information. It does not need bandwidth. Four digits is a door code, a PIN, or the first block of a key, and forty seconds is plenty.
Air gapping assumes the threat travels over a network, so it removes the network. What it does not remove is everything else the device can still vary: an indicator LED, a fan that can be made to spin at chosen speeds, a coil that whines at a chosen frequency, a screen whose brightness can be modulated. A compromised device that can change any of those on command, with a camera or a microphone in line of sight, has an output.
Morse is what you would expect a low-effort implant to use. It is two symbols, it survives a slow or noisy observation channel, and every decoder in the world already understands it. Recognising the shape is the whole skill: dots and dashes, letters split by a space, words split by a separator.
Common mistakes
- Trying base64 or hex first. Neither has dots or dashes in its alphabet, and both return an error marker straight away. The input tells you what it is.
- Submitting the whole decoded phrase. The answer label asks for the number, which is the part that has value to whoever is watching.
- Dismissing it because the device has no network. That is the point of the technique, not an argument against it.
How to defend against it
Treat physical emissions as an interface.
- Remove the line of sight. An isolated device belongs where no camera, window or reflective surface can watch its front panel, and cameras covering the same room should not be on a network an attacker can reach.
- Cover or disable indicator LEDs on equipment that handles secrets. Tape is a legitimate control here and costs nothing.
- Sign firmware and verify it at boot. A status light only transmits when something is running that wants it to.
- Rotate anything that a device could have leaked once you have reason to believe it was compromised, starting with door codes that humans memorised years ago.