LED-it-GO used the ordinary HDD activity light as a fast optical transmitter

Reconstruction

LED-it-GO turns a mundane status indicator into an optical transmitter. Malware on an already-compromised computer repeatedly generates storage activity so that the hard-drive activity LED switches on and off in a controlled pattern. The changes can occur faster than a person can consciously follow, while a camera or optical sensor with line of sight records them.

The mechanism is possible because the LED is physically coupled to storage activity: software can indirectly influence a visible light source by issuing I/O. That light crosses the logical isolation boundary without using a network interface. The paper reports switching rates up to 5,800 blinks per second and maximum throughput up to 4,000 bits per second depending on the receiver and geometry.

The attack still requires prior compromise and an optical receiver that can see the LED. The high reported rate does not imply the same throughput at every distance or with every camera.

Mechanism & boundary

1. 01

   Compromise the isolated machine

   Attacker-controlled code must already run on the system and be able to generate storage activity.

   Boundary: air-gapped host / attacker-controlled code

2. 02

   Encode the secret into I/O timing

   The transmitter maps data to storage operations whose timing controls the activity indicator.

   Boundary: secret data / disk activity

3. 03

   Modulate the HDD activity LED

   Normal hardware logic converts the chosen I/O pattern into rapid changes in emitted light.

   Boundary: storage activity / optical emission

4. 04

   Observe from line of sight

   A camera or optical sensor records the LED pattern, potentially at a rate beyond ordinary human perception.

   Boundary: protected equipment / external optical receiver

5. 05

   Decode the optical signal

   Receiver software reconstructs the bitstream from the recorded intensity changes.

   Boundary: captured light / recovered data

Claims & evidence

Implications

LED-it-GO shows that status indicators can cross an isolation boundary because they intentionally expose internal state as light. The demonstrated risk is substantial only when malware controls the underlying activity and an attacker has a useful optical view. The same design question applies more broadly to diagnostic LEDs and displays in high-assurance spaces: does the indicator reveal a signal that software can modulate and an external sensor can measure?

Controls & mitigations

• Cover, disconnect or redesign unnecessary status LEDs in environments where optical exfiltration is within the threat model.
• Control cameras, drones and other optical sensors with line of sight to protected equipment.
• Monitor abnormal high-rate storage activity where it can be distinguished from legitimate workloads.

What remains unknown

• Effective throughput and distance depend heavily on LED characteristics, optics, frame rate, exposure and viewing geometry.
• The result assumes an optical path to the indicator and does not bypass an opaque enclosure by itself.
• No cited evidence shows autonomous AI selection or use of the channel.

Connected research