What do you do when you need to get data into an airgapped machine? Well, you might find yourself limited to basic input devices to interact with the computer in question. As [Nikolay Valentinovich Repnitskiy] demonstrates, though, you can do some fun stuff amidst such limitations.
[Nikolay] created what he calls a “unidirectional network” connection via a keyboard. Specifically, he took two Dell SK-8115 keyboards, and stripped them down to their controller PCBs. On one, he soldered photoresistors to a couple of the keyboard matrix pins, such that they’d fire a keypress when lit up. He then placed the other keyboard PCB such that the Num Lock and Caps Lock LEDs are lined up with the photoresistors. This made it possible to have one PC flash the keyboard LEDs in order to “type” on the other machine. This can be used to move data on to it, such as a little program which [Nikolay] prepared which can be made executable and used to further break into the machine and make it easier to pull data across more efficiently in future.
We looked at an earlier version of this hack some time ago. If you’ve been imagining creative ways to talk to airgapped computers, be sure to let us know on the tipsline!
OpenAI needs to consider this
We re back toi 2000s? This is oooold.
Back then we used cameras at some distance as the receiving end, not LDRs in direct contact.
Hexdump to screen and OCR the photos at leisure.
Or if you want to still use the photoresistors, just have the screen (or a portion of it) flash. Amplify the signal and you could have a one-way uart.
I’m a little confused as to how this can be considered a meaningful attack vector, when it requires both physical access to the machine AND either tearing down and soldering photoresistors to the keyboard on it or bringing a pre-modded keyboard and plugging it in.
I love a good hack as much as the next girl, I’m just confused about the lack of narrative in the article to help explain why this one is either needed in this case (as opposed to any number of other approaches with physical access) or if it has any broader relevance? If it’s just a fun proof of convoluted concept that’s fine!
Hackers often wipe logs on the systems they target so that investigators have less clues. But this little data diode can transfer logs to an offline laptop stripped of its WiFi, so the logs will be safe. And although it’s slow, you can transfer the rare suspicious log entries. Because as we have seen before, hackers revisit their target but are much more prepared than when they first visited, making logs of their first visits valuable.
This is easily DIY-able and robust. Compare this to those unaffordable laser things you have to trust and break so that they’re unidirectional… I should probably look into it…
If the point is a sustained and constrained unidirectional connection with minimal hardware that’s easy for anyone, where having software loaded on both systems isn’t an issue, the first very off the shelf thoughts that come to mind are either speakers + microphone, or encoded video (even just qr codes) and a cheap cam or video input.
Otherwise two cheap usb microcontrollers and a unidirectional optocoupler (pc817/etc) would probably be both easier to DIY reliably and more robust, and can also avoid having the input into the airgapped machine be over a keyboard that way, even if it’s one that shouldn’t be able to send any problem keycodes.
I think you are right. The only place I can see this being useful are scenarios where the secure machine is behind some sort of extender or KVM that provides peripheral-only access. Those HDMI extensions have “USB” sockets that only work with a keyboard/mouse combo.
But as you said, in those situations the monitor, or audio over HDMI would be much higher bandwidth. ¯_(ツ)_/¯
This does remind me of when I used to gut old keyboards to drive little robotic things as a kid. The bandwidth to those LEDs was just enough to have some fun with.
If write out-only is the goal, it seems UART would be infinitely easier.
Of course. But this is targeting locked down systems. I worked at a place that had their PCs set up to disallow any USB devices other than mouse & keyboard. Flashdrives and USB to TTL devices just wouldn’t work.
Now if the target PC just lets you plug any old usb keyboard HID device in, you could program a rp2040 or similar to spoof a keyboard and convert the “caps lock” LED to a low baud UART. No need for real LEDs & photo-resistors.
If the target PC allows any HID device at all, then you could spoof a braille HID device. Those allow writing 8-dot braille out. This would be a much faster way to extract data.
Two things:
1) It’s a way to prevent a ‘Chelsea Manning’-style attack where the attacker has legitimate physical access but the device has basic security against just plugging in an USB drive. A far easier way to do this is to use a device that emulates an USB keyboard but can store the caps lock and scroll lock states and sequences in memory. Of course, the attacker needs to be able to run the program that serializes the data and sends it out as state-changes on caps and scroll lock.
2) ‘Hacker culture’ thrives on making simple gizmos then crafting intricate narratives about counterculture and taking down the government with LED blinkers, it’s basically like the life-story that’s added in front of a recipe on a cooking blog.
That’s just it, even without getting into spoofing vendor and device IDs on something like an esp32 with native USB (like an s2), at least identifying as USB HID is something most microcontrollers with a USB controller can do. Sooo…
It’s mostly that just reading the article here lacks the narrative for why this got more convoluted than even makes sense except in hypothetical situations where… if someone had unmonitored time to mod an attached keyboard to this degree, and needing to have components and tools to do so, they could have done some simpler things instead in most cases.
As a lifelong hacker and convoluted solutions due to awkward constraints expert, what you pointed out is basically my actual disappointment: without at least a hint at a narrative, this is just an awkwardly convoluted optical serial connection, and I’m left wondering why I’d bother clicking through instead of interested in hearing more. Having it titled as an “attack vector” really doesn’t help when it feels like that’s blowing it out of proportion to what’s described: my initial thought was maybe someone figured out a way to use the minimal led reverse photovoltaic effect to somehow affect a keyboard, which would have been pretty head turning.
yeah that was my thought too! data into an airgapped machine via keyboard LEDs would be cool, but if you can hook modded stuff to it it’s hardly “airgapped.” Honestly a decent typist could just type it faster probably XD
Manning had plenty of access to the system, you would not be able to transfer such amounts of data with some keyboard LED. Manning uses CD-RW labeled Lady Gaga to smuggle it out to a private laptop then transferred it to a SD card in a camera.
Half a million documents and some videos too, good luck with your keyboard LED. We’d still be waiting for the data :)
Also it wasn’t ‘Chelsea’ at that time.
I imagine the throughput isn’t very high on this. There are better ways to get all of those secret files.
Tactical messages don’t need high bandwitdh. 1 bit/s can be plenty.
I am reminded of some Neil Stephenson book where a developer with interface access and privileges, on a machine that was airgapped when he was using it, was imprisoned in order to force him to write something. He somehow set up a secondary headless development environment that he hid on the machine. Its output was morse code flashing on the scroll lock LED. At least I think that’s the story, it has been a very long time since I read whatever it was.
The basic idea was that he would be working on the machine, appearing to do what they want, while building some set of tools in the headless environment. It was neat, but felt like impossible James Bond bullshit.
The book was Cryptonimicon. The protagonist Randy Waterhouse wanted to decrypt an encoded set of coordinates for buried treasure such that his captors saw a plausible location on his screen while he got the real location via Morse code on the LEDs.
Why use LDRs? They are slow as molasses …
Slow yeah, but not too slow for how fast HID can blink a keyboard LED I bet.
Had a similar idea with this project: https://hackaday.com/2026/02/07/when-clever-hardware-hacks-bite-back-a-password-keeper-device-autopsy/
Actually one of the few things that worked decently.