While reading the news, I have seen a lot of people try exfiltrating data from compromised systems that are air-gapped using a variety of different methods whether it is from light, vibrations or sound. I thought it would be an interesting project to try and exfiltrate some data by flashing different colours on a monitor.
The Basic Idea
The basic idea is getting a screen to flash certain colours in a certain combination and record it using a camera. Then I could get a python script to analyze the video and if the screen flashes red then the bit is 1 and if the screen is blue then the bit is 0 and if it is neither it is a separator which is shown as "|". I can then run this through a program that will reconstruct it to its original message. Simple in concept, but a bit more annoying to figure out.
The Code
Projecting the Message
This code converts text into binary data (8-bit binary letters) and displays it on a turtle graphics window in the form of flashes of red, blue, and green colours. Red represents 1, blue represents 0 and green the meant to be the separator between the two. Through the use of the parser, the user can change the message, the speed between the flashes of colour and the waiting period before and after the message. The binary representation of the message and the time taken to display it are also printed in the console.
import time
import turtle
from argparse import ArgumentParser
def splash(pause, wait, message):
wn=turtle.Screen()
wn.setup(width=1.0, height=1.0)
data_in_binary = ""
wn.bgcolor("green")
time.sleep(wait)
time1 = time.time()
for letter in message:
for bit in format(ord(letter), '#010b')[2:]:
if bit == "1":
wn.bgcolor("red")
data_in_binary += "1"
time.sleep(pause)
else:
wn.bgcolor("blue")
data_in_binary += "0"
time.sleep(pause)
end_time = time.time()
wn.bgcolor("green")
time.sleep(pause)
print(data_in_binary)
print("time elapsed: ",end_time-time1)
print("bits: ", len(message)*8)
wn.bgcolor("green")
time.sleep(wait)
def main():
parser = ArgumentParser(description="Light Binary Project Screen")
parser.add_argument("-m","--message",
action="store", default="testing123,",
help="The message. The default is testing123"
)
parser.add_argument("-s","--speed",
action="store", default=0.2,
help="Pause between flashes of colour."
)
parser.add_argument("-w","--wait",
action="store", default=10,
help="Wait period before and after flashes."
)
args = parser.parse_args()
try:
speed = float(args.speed)
wait = float(args.wait)
except:
print("Please put a float for speed")
exit()
splash(speed, wait, args.message)
if __name__ == "__main__":
main()
Analyzing the video
This code analyzes video data, either from a webcam or from a video file, and extracts binary data from the light values of an individual pixel in the frame of the video picked by the user. The extracted binary data is then processed to remove repetitive bits, remove noise, and finally converted to text format which is printed to the console. The user can specify the video source and the sensitivity.
import cv2
from argparse import ArgumentParser
def click_function(event, x,y,flags,param):
if event == cv2.EVENT_LBUTTONDBLCLK:
global global_x, global_y, collection
global_x = x
global_y = y
collection = True
def what_colour(r,g,b):
if r > 245-sens and g < 10+sens and b < 10+sens:
return "1"
elif r < 10+sens and g < 10+sens and b > 245-sens:
return "0"
else:
return "|"
def format(string):
if string == "":
return "NO INFO GIVEN"
format = ""
current_bit = string[0]
current_count = 0
for i in range(len(string)):
if string[i] == current_bit:
current_count += 1
else:
if current_count >= fuzzy:
format += current_bit
current_bit, current_count = string[i], 1
if current_count >= fuzzy:
format += current_bit
stripped = format.replace("|", "")
formatted_binary = ' '.join(stripped[i:i+8] for i in range(0, len(stripped), 8) )
text = "".join(chr(int(byte, 2)) for byte in formatted_binary.split())
print("\n\n\n\n\n\n\n\n")
print("Binary: ", formatted_binary)
print("Text: ", text)
def webcam(camera_id):
raw = ""
collection,raw = False, ""
vid = cv2.VideoCapture(camera_id)
print("Camera's up")
while True:
_, frame = vid.read()
cv2.imshow("image", frame)
cv2.setMouseCallback('image',click_function)
b,g,r = frame[global_y,global_x]
if collection:
bit = what_colour(r, g, b)
print(bit,end="")
raw += bit
if cv2.waitKey(1) & 0xFF == ord('q'):
break
vid.release()
cv2.destroyAllWindows()
format(raw)
def analyze_file(file_location):
raw = ""
global collection
collection = False
video = cv2.VideoCapture(file_location)
video.set(cv2.CAP_PROP_POS_FRAMES, 0)
ret, img = video.read()
while True:
cv2.imshow("image", img)
cv2.setMouseCallback("image", click_function)
if cv2.waitKey(1) & 0xFF == ord("q") or collection:
break
cv2.destroyAllWindows()
video = cv2.VideoCapture(file_location)
success, img = video.read()
while success:
b,g,r = img[global_y,global_x]
bit = what_colour(r, g, b)
print(bit,end="")
raw += bit
success, img = video.read()
format(raw)
def main():
parser = ArgumentParser(description="Light Binary for Reading light")
parser.add_argument("-c","--camera",
action="store", default=0, choices=("0","1","2","3"),
help="Different camera"
)
parser.add_argument("-f","--file",
action="store", default=None,
help="video file address file."
)
parser.add_argument("-rgb",
action="store", default=90,
help="RGB Senstivity"
)
parser.add_argument("-sens", "-senstivity",
action="store", default=1,
help="senstivity gets rid of single bit pickups. If you got a good camera you can go to 0")
args = parser.parse_args()
try:
global sens,fuzzy,raw
sens = int(args.rgb)
fuzzy = int(args.sens)
raw = ""
except:
print("failed")
exit()
if args.file != None:
analyze_file(args.file)
else:
webcam(int(args.camera))
if __name__ == "__main__":
main()
Improvements
One improvement is splitting up the screen into multiple sections and having multiple streams concurrently showing. This could at least double the speed at which information is shown. This would add an extra level of complexity but with added speed, it is definitely worth the thought.
Another possible improvement is getting rid of the separator colour of green. This would be quite a complex task but it would at least speed up the process by 33%. This would also enable me to just use a flashing light or colour to communicate data. This would be a fun future project.
Final Notes
Overall this was a fun project. If you want to try out this project you can find it here on my GitHub. You will also find out some test videos on my GitHub. If you have any questions you can always leave a comment below or feel free to reach out to me on Twitter at @dingo418.
