Covert Channel Awareness Lab
The same on/off keying that spells SOS on a lamp can quietly move data where no network monitor is watching — over a status LED, near-ultrasonic sound, packet timing, or the cadence of a console. This lab is a defender's view: pick a channel and see its realistic throughput, why it is hard to detect, and exactly which controls catch and limit it. It is threat awareness, not a how-to — no encoders, no payloads, no attack steps.
This is a defender's reference. It describes how low-bandwidth covert channels behave so you can detect and limit them. It contains no encoders, payloads or how-to steps — only the characteristics and the controls that counter each channel.
Pick a channel to study
Status / activity LED
Optical (light)An indicator LED (power, HDD, NIC) switched on and off over time — Morse-style keying a camera can read.
a few to a few hundred bits/sec
Line of sight to a camera or light sensor; defeated by any opaque barrier.
Higher = harder for defenders to spot.
Throughput in context (illustrative, log scale)
Covert channels are slow by nature — these are bits per second, not megabits. The risk is a patient trickle of small secrets (keys, coordinates), not bulk transfer.
What makes it hard to detect
- A blinking indicator looks like normal device activity, so the signal hides in expected behaviour.
- It needs no network connection at all, so network monitoring never sees it.
- Capture can be off-site (a camera through a window), leaving no trace on the host.
How defenders detect & limit it
- Physical controls: cover, tape over or remove non-essential indicator LEDs in sensitive areas.
- Enforce clean line-of-sight policy — no windows, cameras or reflective surfaces facing sensitive equipment.
- Host monitoring for processes that drive hardware indicators abnormally or at a steady cadence.
- Camera and recording-device controls in secure zones.
Defence pillars (apply to every channel)
Egress monitoring & filtering
Default-deny outbound. Allow only required destinations, ports and protocols, and alert on anything else — a covert channel still needs a way out.
Data loss prevention (DLP)
Classify and watch sensitive data at rest, in use and in motion so that even a slow leak of the right data trips a control.
Air-gap & physical controls
For the highest-value systems, remove the emitter entirely: no speakers, no spare LEDs, no cameras in line of sight, no personal devices in the room.
Anomaly & timing detection
Baseline what normal looks like per host and per flow, then alert on steady, machine-like cadence that humans and ordinary software do not produce.
Disable unneeded emitters
Every unused output is attack surface. Turn off or physically remove microphones, speakers, indicator lights and interfaces a system does not require.
What this lab is
- A free, defender-focused lab on low-bandwidth covert channels — including Morse-style on/off keying over light, sound, timing and interface cadence.
- Pick a channel (status LED, near-ultrasonic audio, packet timing, console cadence) and see its realistic bits-per-second, physical reach and why it is hard to detect.
- Every channel pairs with concrete defences: egress monitoring, DLP, air-gap and physical controls, timing/anomaly detection, and disabling unneeded emitters.
- Framed entirely as detection and defense — it is threat awareness, not a how-to. There are no encoders, payloads or exfiltration steps.
- Covert channels are slow by nature (bits, not megabits); the real risk is a patient trickle of small secrets, which is what the defences target.
Why this matters
Most security controls inspect the content of communications: firewalls, DLP on payloads, deep packet inspection. Covert channels sidestep all of that by hiding information in something the controls do not treat as a message at all — the blink pattern of a light, a tone above human hearing, the microscopic gaps between ordinary packets. Understanding that a carrier does not have to look like data is the first step to defending against it.
The defensive takeaway is concrete. Because these channels are slow, they are built for patience, not bulk — which is why timing and anomaly detection, strict egress control, DLP and physically removing unneeded emitters are so effective. On the highest-value systems the strongest control is the oldest one: if a machine has no speaker, no spare indicator light and nothing in line of sight, most of these channels simply have no carrier to use.
Frequently asked questions
What is a covert channel?
A covert channel is a way to move information using a mechanism that was not designed to carry data — for example modulating a status LED, emitting near-ultrasonic sound, or varying the timing between network packets. Because the carrier looks like ordinary activity, these channels can bypass controls that only inspect message contents. This lab explains how they behave so defenders can detect and limit them.
Is this a tool for exfiltrating data?
No. It is strictly a defensive awareness lab. It contains no encoders, no payloads and no step-by-step instructions for building a covert channel. Every channel is described only in terms of its realistic characteristics — throughput, reach, why it is hard to spot — and the controls that counter it. The goal is to help defenders recognise and shut down channels, not to create them.
How fast are covert channels really?
Slow. Depending on the carrier they range from under ten bits per second to at most a few hundred bits per second in favourable lab conditions — bits, not megabits. That is far too slow for bulk data theft, but more than enough to leak a cryptographic key, a password or coordinates a little at a time. That trickle profile is exactly what timing and anomaly detection are tuned to catch.
What defences actually work against them?
A layered set: default-deny egress filtering and monitoring so a channel has no easy way out; data loss prevention so even a slow leak of sensitive data trips a control; air-gap and physical controls that remove the emitter entirely on the highest-value systems; statistical anomaly and timing detection that flags steady, machine-like cadence; and disabling or removing unneeded emitters such as spare speakers, microphones and indicator LEDs.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.Educational — general guidance.