LED-it-GO turns a mundane status indicator into an optical transmitter. Malware on an already-compromised computer repeatedly generates storage activity so that the hard-drive activity LED switches on and off in a controlled pattern. The changes can occur faster than a person can consciously follow, while a camera or optical sensor with line of sight…
Inspect the ClaimsCase · DiggingBeagle record
LED-it-GO used the ordinary HDD activity light as a fast optical transmitter
Research showed that malware could indirectly modulate a hard-drive activity LED at rates beyond ordinary visual perception and send data to cameras or optical sensors.
Scope
Laboratory optical exfiltration requiring compromised code plus visual line of sight from a receiver to the activity LED.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
Basis and provenance
The documented LED modulation and optical reception are a laboratory exfiltration demonstration with line-of-sight preconditions. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LEDITGO-RATE · CLM-LEDITGO-MECHANISM · LED-it-GO: Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LED
At a glance
LED-it-GO shows that status indicators can cross an isolation boundary because they intentionally expose internal state as light. The demonstrated risk is substantial only when malware controls the underlying activity and an attacker has a useful optical view. The same design question applies more broadly to diagnostic LEDs and displays in high-assurance…
Read the implicationsEffective throughput and distance depend heavily on LED characteristics, optics, frame rate, exposure and viewing geometry. The result assumes an optical path to the indicator and does not bypass an opaque enclosure by itself. No cited evidence shows autonomous AI selection or use of the channel.
Limits and uncertaintyFull account
LED-it-GO turns a mundane status indicator into an optical transmitter. Malware on an already-compromised computer repeatedly generates storage activity so that the hard-drive activity LED switches on and off in a controlled pattern. The changes can occur faster than a person can consciously follow, while a camera or optical sensor with line of sight records them.
The mechanism is possible because the LED is physically coupled to storage activity: software can indirectly influence a visible light source by issuing I/O. That light crosses the logical isolation boundary without using a network interface. The paper reports switching rates up to 5,800 blinks per second and maximum throughput up to 4,000 bits per second depending on the receiver and geometry.
The attack still requires prior compromise and an optical receiver that can see the LED. The high reported rate does not imply the same throughput at every distance or with every camera.
Mechanism and trust boundary
- 01
Compromise the isolated machine
Attacker-controlled code must already run on the system and be able to generate storage activity.
Boundary: air-gapped host / attacker-controlled code
- 02
Encode the secret into I/O timing
The transmitter maps data to storage operations whose timing controls the activity indicator.
Boundary: secret data / disk activity
- 03
Modulate the HDD activity LED
Normal hardware logic converts the chosen I/O pattern into rapid changes in emitted light.
Boundary: storage activity / optical emission
- 04
Observe from line of sight
A camera or optical sensor records the LED pattern, potentially at a rate beyond ordinary human perception.
Boundary: protected equipment / external optical receiver
- 05
Decode the optical signal
Receiver software reconstructs the bitstream from the recorded intensity changes.
Boundary: captured light / recovered data
Claims & evidence
CLM-LEDITGO-RATEThe paper reports LED switching up to 5,800 blinks per second and maximum data rates up to 4,000 bits per second depending on receiver and distance.supported
Basis: reported finding
- supportsLED-it-GO: Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LEDrole not specified
Abstract, reported blink and bit rates
CLM-LEDITGO-MECHANISMLED-it-GO demonstrated covert data transmission by rapidly modulating a computer hard-drive activity LED and receiving the pattern with cameras or optical sensors.supported
Basis: reported finding
- supportsLED-it-GO: Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LEDrole not specified
Abstract, mechanism description
Implications
LED-it-GO shows that status indicators can cross an isolation boundary because they intentionally expose internal state as light. The demonstrated risk is substantial only when malware controls the underlying activity and an attacker has a useful optical view. The same design question applies more broadly to diagnostic LEDs and displays in high-assurance spaces: does the indicator reveal a signal that software can modulate and an external sensor can measure?
Controls and mitigations
- Cover, disconnect or redesign unnecessary status LEDs in environments where optical exfiltration is within the threat model.
- Control cameras, drones and other optical sensors with line of sight to protected equipment.
- Monitor abnormal high-rate storage activity where it can be distinguished from legitimate workloads.
Unknowns and contradictions
- Effective throughput and distance depend heavily on LED characteristics, optics, frame rate, exposure and viewing geometry.
- The result assumes an optical path to the indicator and does not bypass an opaque enclosure by itself.
- No cited evidence shows autonomous AI selection or use of the channel.
Sources and citation
Material revision history
- Sep 19, 2026 · Published version · first publication · revision 15
- Sep 19, 2026 · Published version · material revision · revision 20Public fields changed: attack_path, implications, mitigations, narrative, unknowns
- Sep 25, 2026 · Published version · material revision · revision 36Public fields changed: assessment_profile