Shandong University Researchers Achieve 8.1 Mbps Exfiltration via Video Cable Emanations on Air-Gapped Hosts

Researchers at Shandong University demonstrated TrojPix by altering pixel values on nine monitor brands and fifteen cable types without admin rights or hardware changes. The technique uses two concealment modes: one simulating a powered-off display and another embedding data in visible content. Throughput reached 8.1 Mbps in isolated tests while range hit 208 meters separately, enabling transfer of 100 MB files in under two minutes.

Evidence consists of controlled RF captures showing consistent demodulation across HDMI and DisplayPort links. This exceeds prior work such as TEMPEST-LoRa at 21.6 kbps and 87.5 meters, though differing receiver setups prevent direct comparison. No CVE or in-wild samples exist; the channel remains a post-compromise vector dependent on initial malware foothold.

Standard network defenses offer no protection because the signal originates from analog video cable emissions, a pattern consistent with decades of TEMPEST research yet rarely addressed in commercial air-gap guidance. Procurement records show continued copper video deployments in non-TEMPEST facilities, creating an under-reported exposure that PIXHELL sound channels and Ethernet implants also exploit.

Next steps include mandatory fiber-optic video mandates in new SCIF builds and updated emission testing for existing high-value air-gapped systems. Without these, any malware foothold converts into rapid bulk exfiltration once a receiver is positioned nearby.