TrojPix Threatens Air‑Gapped Systems Via Video Cable Emissions

A team at Shandong University has unveiled **TrojPix**, an exfiltration technique that turns ordinary on‑screen pixels into covert transmitters of electromagnetic radiation. By subtly altering pixel values in ways invisible to the human eye, the method causes the video cable carrying the signal—typically DisplayPort or HDMI—to emit faint radio waves. Nearby receivers can decode these emissions, pulling data out of systems that are otherwise cut off from any network connection. The researchers demonstrated the approach could transfer up to 10 Mbps over a meter with sufficient encoding complexity, a rate comparable to early Wi‑Fi standards such as 802.11b¹.

The core vulnerability lies in how high‑speed digital buses use differential signaling to reduce noise by subtracting signal reflections from each wire pair. TrojPix leverages this leakage; earlier attempts using power line communications were slower and relied on encryption protocols, whereas pixel manipulation bypasses those protections entirely because it operates on visual output rather than transmitted digital signals used within computing systems themselves. Intrusion detection tools may fail against such attacks.

Experts note similar work was first reported by Columbia University in 2017 when researchers showed power line communications could exfiltrate data via electrical wiring. A specialist said differential signaling used in high speed digital buses like USB means signals are less susceptible but there's still leakage through cable radiation.

Given these findings, security analysts advise that air‑gapping alone is insufficient protection if adversaries can deploy TrojPix from nearby positions. Shielding cables or employing active jamming techniques may mitigate the risk, especially for critical infrastructure where unauthorized data transfer could have severe consequences.

In practice, an attacker would need access to a receiver capable of capturing radio emissions emitted by HDMI/DisplayPort cables and decoding the pixel‑based encoding scheme. While the exact decoding algorithm remains proprietary to Shandong University, the demonstration proves feasibility. Because the method uses standard hardware components and requires no specialized equipment beyond a typical wireless receiver, the barrier to entry is low.

The discovery underscores how even well‑shielded environments can be compromised when electromagnetic side channels are exploited. As more research surfaces on covert emission attacks, cybersecurity teams must reassess assumptions about isolation and consider shielding as part of comprehensive defense strategies.