Photodiodes have grown in popularity in

the IOT era due to their ability to

convert light into electrical currents

with high bandwidth capabilities.

While photodiodes are primarily used for

innocent tasks involving optical

measurements, they can pose a major

security risk when directed towards a

device's power LED.

>> [music]

>> Our work demonstrated optical traces

captured by a photodiode directed at a

device's power LED [music]

are strongly correlated with a device's

power consumption. This finding has

significant security implication as it

enables attackers that previously

required a physical connection to the

device's [music] power lines to be

carried out remotely using only a

photodiode.

>> [music]

>> Since the beginning of the IOT era, a

new reality has emerged.

>> [music]

>> While IOT CPU speeds remain limited to

ensure affordability, sensor sample

rates have improved significantly.

>> Now, consequentially, the traditional

performance gap between a device's CPU

rate [music] and a sensor sampling rate

has narrowed drastically over the last

decade.

This shift has created a new reality

where certain sensors can sample data at

the rate equal to or even greater than a

device's CPU processing speed.

>> This new reality poses unprecedented

risks to the confidentiality of

computing and the high bandwidth of

photodiodes can easily be exploited.

>> [music]

>> In our first experiment, we evaluated

the frequency response of an optical

trace captured by a photodiode at a

speaker's power LED.

>> Desktop speakers were placed on a table

and connected to a laptop.

An audio sample was then played on the

speakers at 70 decibels.

The photodiode was directed at the power

LED of the desktop [music] speaker via a

telescope and tested at distances of 15,

25, and 35 m.

>> You are not alone.

You are not alone.

>> We found that the optical signal

exhibits sufficient bandwidth to recover

intelligible speech.

>> [music]

>> In our second experiment, we evaluated

the ability to distinguish between

different CPU activities by analyzing

optical traces of a device's power LED.

We found that the timing of ECDSA

signing operations

>> [music]

>> can be accurately inferred from the

captured optical signal.

Consequentially, attackers can recover a

256-bit ECDSA key using a timing attack.

The growing availability and

affordability of photodiodes lowered the

barrier to entry for optical side

channel attacks. Consequentially,

LED-based side channel attacks may

become feasible for a larger population

of attackers, increasing the overall

threat landscape.

>> [music]

>> So, what can people do to prevent such

attacks?

>> Users can cover a device's LED with

opaque tape to block optical leakage. In

addition, manufacturers should ensure

that LED brightness does not correlate

with a device's power consumption,

thereby eliminating the side channel.

Moreover, users can create safety

perimeters by placing devices outside

the visual range of potential attackers.

For example, by moving them away from

nearby windows.

Although our study focuses on

photodiodes, the narrowing gap between

IoT device's CPU rates and sensor

sampling rates applies to many other

sensing technologies as well. As the

sampling rates of these sensors continue

to increase, they may enable the

recovery of an intelligible audio,

further expanding the attack surface for

sensor-based side channel [music]

attacks.

>> Learn more in the August 2026

Communications of the ACM in the

research article Illuminating Secrets:

Power LED-Based Side Channel Attacks for

Key Extraction and Eavesdropping.

[music]