A technical analysis from researchers at Shandong University says a new air-gap attack called TrojPix can leak data from isolated computers by modulating screen pixels in ways that are invisible to users. In tests, the method reached 8.1 Mbps and a separate maximum range of 208 meters.
KEY FACTS
- Attack method TrojPix uses imperceptible pixel changes to make a video cable emit a radio signal.
- Access needed The technique requires malware already on the target machine, but no administrator rights or hardware changes.
- Measured results The report says the peak throughput was 8.1 Mbps and the maximum range was 208 meters, measured separately.
- Compatibility The team said it worked across nine monitor brands and 15 video cables.
The disclosure says the channel can hide traffic in two ways. One method simulates a powered-off display while still transmitting. The other blends the signal into content already shown on the screen.
Researchers said the approach is part of a longer line of studies on compromising emanations, including TEMPEST-style attacks. They also compared TrojPix with earlier work such as TEMPEST-LoRa, which used video cable emissions to reach LoRa radios at lower speeds and shorter range.
The report also noted that related lab demonstrations have included PIXHELL, which used a display to emit sound, and a hardware implant that could pull data from Ethernet. The article said those kinds of channels show what is possible, not what has been seen in the wild.
Suggested defenses include using fiber-optic video links instead of copper, shielding cables and rooms, and preventing malware from gaining a foothold in the first place. Without malware on the machine, TrojPix has nothing to transmit.
WHY IT MATTERS
The findings suggest that an isolated computer can still leak large amounts of data if an attacker is already inside the system. The practical limits depend on real-world noise, walls and shielding, but the measured speed shows that air-gap defenses can be bypassed with a fast covert channel.