Researchers from Ben-Gurion University have recently developed an attack that allows for eavesdropping on conversations via power indicator LEDs. How does the Glowworm attack work, how close is it to becoming a real threat, and how can engineers prevent this?

How does the Glowworm attack work?

Recently, researchers from Ben-Gurion University demonstrated how a power LED on a product can be used to listen in to conversations. This attack relies on the fact that rapid changes in power consumption can cause voltage fluctuations, and these voltage fluctuations cause variations in LED brightness.

Speakers for computers and laptops often have a power indicator when they are on. Playing audio through speakers typically results in brightness variations of the power indicator (easily seen at high volumes). Therefore, by recording the brightness of an LED over time, the original audio can be recreated.

The researchers demonstrated this by recreating audio signals from 35 meters away using a telescope aimed at a power LED indicator on a USB device. While the signals created by the researchers were single tone sine waves, they were still clearly able to detect these at a great distance without being able to see the monitor or hear the sound.

Is Glowworm really a threat?

To demonstrate the ability of glowworm to present a threat, the research team were also able to recover spoken audio that was intelligible enough to be understood. Meaning that, in theory, glowworm could be used to eavesdrop in conversations today, but the attack poses a few limitations.

Firstly, the attack can only detect audio being played from an electronic device. While an attacker could hear the conversations of others on an online meeting, a user physically in the room would not be heard. Secondly, the attack requires a direct line of sight, meaning that any objects in the way will make the attack unusable.

However, what makes this attack particularly dangerous is that it is purely passive. Unlike other attacks, which require an attacker to be either physically present at the location or have some noticeable presence (i.e. stray EM radiation or interference), no one would determine if the glowworm attack occurred. The simple application of a telescope and photodiode enables an attacker to be far away and only record the light levels from the power indicator.

How can Glowworm be mitigated?

Glowworm is unlikely to be a significant concern of all attacks possible due to its impracticality and need for line of sight. However, those who are paranoid enough to protect against this have several different methods for protection.

The first is to block any and all power indicators. Blocking power indicators can be done by physically standing in-between a speaker's power indicator and an attacker, placing an object in-between, or removing the LED. Another method involves placing objects in an environment where power indicators are not pointing towards exterior locations such as windows and doorways.

Glowworm can be solved from the hardware perspective by utilising circuitry that prevents the dimming of LEDs during speaker operation. One method would be to use a microcontroller as the power provider for the LED; such a power signal can also be superimposed with PWM signals to confuse attackers. Another method would include using filter components to ensure that the voltage being supplied to an LED is kept constant (such as a regulator).

Overall, Glowworm has proven that audio can be recovered, but it is an improbable attack as attacks go. Furthermore, an attacker would only recover audio from a speaker and not audio in the surrounding room, meaning that any physical conversation cannot be recorded.