Visible-Spectrum Optical Covert Channels in Commodity Smart Lighting

1. Introduction

• A smart bulb is both a networked command receiver and a light source, raising the question of whether its emitted light can become a communication channel.The core decoding challenge is separating camera-readable binary states while keeping their difference small to a human observer.Source: §1 · pp. 1–2
• The receiver uses two nearby color or brightness states for binary symbols and refreshes its references with known states to track camera color drift.A feedback procedure also measures the optical separation actually observed by the camera.Source: §1 · p. 2

1.1 Contributions

• The color channel recovered a short message at ΔE = 0.5 with 99% raw bit accuracy and a valid integrity check; brightness remained decodable at settings 56 and 54.The brightness result was 96.2% mean raw bit accuracy across two runs.Source: §1.1 · p. 2

2. Background

• Table 1 surveys optical TEMPEST and related covert-channel systems, including the infrared smart-bulb channel Light Ears and this study’s visible-light approach.Light Ears used infrared because its authors expected visible color changes to be noticed.Source: Table 1 · p. 3, §2 · p. 3
• Prior lighting-security work mainly examined gaining device control, whereas this study examines information carried out through emitted light.Other systems may require software on a target computer or use infrared outside normal human vision.Source: §2 · p. 3
• The receiver addresses small signals that camera drift can overwhelm by refreshing known-symbol references and measuring the bulb’s actual optical separation.This avoids assuming that a commanded numerical change produces the same change at the camera.Source: §2 · p. 4

3. WiZ Protocol Modalities

• The WiZ 8285 module receives JSON lighting commands over UDP on port 38899, and commands in the tested configuration did not require authentication.Commands can set color, brightness, color temperature, or a predefined scene.Source: §3 · p. 4
• The bulb’s separate PWM channels control red, green, blue, warm-white, and cool-white LED elements.The WiZ A19 uses a Wi-Fi module based on the ESP8285 microcontroller.Source: §3 · p. 4
• Only coordinated RGB color changes and brightness changes were tested as data channels; the other listed protocol controls are proposed extensions, not experimental results.Table 2 lists the WiZ protocol parameters that can change optical output.Source: §3 · p. 4, Table 2 · p. 4

4.1 Hardware

• The bulb smooths color transitions over roughly half a second, so each transmitted bit was given 750 ms to avoid blending successive states.The camera controls reduce, but do not eliminate, automatic white balance and exposure effects.Source: §4.1 · pp. 4–5

4.2 Color Axis Channel

• Color symbols move in opposite directions along the a* coordinate, and the tested ΔE = 0.5 states are visually indistinguishable in the figure.The color distance is measured in CIE L*a*b*, where smaller ΔE values indicate colors that are harder to distinguish.Source: §4.2 · p. 5, Figure 2 · p. 5

4.3 Dimming OOK Channel

• The brightness channel keeps color fixed and encodes bits using nearby dimming settings; swing=2 means settings 56 and 54 around center setting 55.The two-unit difference is the smallest nonzero setting difference tested, not a direct measure of perceived brightness.Source: §4.3 · p. 6

4.4 Interleaved Recalibration

• A 16-bit alternating preamble establishes references, then known [0, 1, 0, 1] pilot symbols after each four payload bits refresh them during transmission.In the ΔE = 0.5 color run, drift within a six-second calibration interval was about 0.7 RGB units, versus nominal symbol separation of about 1.4 RGB units.Source: §4.4 · pp. 6–7

4.5 Forward Error Correction

• The color experiments use Hamming(7,4) correction, while brightness uses threefold repetition; CRC-32 checks whether the reconstructed message matches the transmitted data.Hamming(7,4) can repair one erroneous bit per seven-bit codeword.Source: §4.5 · p. 7

4.6 Closed-Loop Optimizer

• The feedback optimizer alternates candidate states, averages camera frames after the bulb settles, and measures their observed separation to guide modulation settings.For color it can shift the starting RGB command; for brightness it progressively reduces the difference between dimming settings.Source: §4.6 · p. 7

5.1 Color Axis Channel

• At JND = 5, 10, and 30, all three color transmissions achieved 100% wire accuracy with calibration drift below 2 RGB units.At JND = 30, the color change was visually obvious and separation was approximately 122 RGB units.Source: §5.1 · p. 8
• JND = 2 with fixed calibration yielded 56% wire accuracy, whereas JND = 1 with interleaved recalibration yielded 100% with 4.0 RGB separation and 2.2 RGB drift.At JND = 2, AWB drift accumulated approximately 10 RGB units over 160 seconds and displaced the fixed reference past the signal.Source: §5.1 · pp. 8–9
• At JND = 0.5, “hi” reached 99% wire accuracy with exact CRC; 21 of 25 calibration blocks fell below the 1.0 RGB noise floor and decoded correctly.The complete color experiment passed its integrity check.Source: Table 4 · p. 8, §5.1 · p. 9
• The 17-byte “we attack at dawn” transmission failed at 92.5% wire accuracy; about four of 44 Hamming codewords were expected to exceed the code’s correction limit.The decoder aborted with a corrupted length field despite normal channel behavior.Source: §5.1 · pp. 9–10
• Calibration overhead (50%) and FEC efficiency (4/7) were the dominant losses in the color channel’s effective payload rate.Figure 6 breaks down wire-frame composition and the efficiency cascade from raw symbol rate to effective payload rate.Source: Figure 6 · p. 10
• “SOS Help” achieved 79.1% wire accuracy; its block-10 separation spike to 11.30 RGB units was consistent with a sudden ambient-light change.A nearby computer screen turned off during the six-second calibration window, changing ambient light and room color balance.Source: Figure 5 · p. 9, §5.1 · p. 10

5.2 Dimming OOK Channel

• At swing=2 (dim=56 vs dim=54), dimming achieved 96.2% mean wire accuracy; accuracy stayed between 94 and 99% down to swing=2, then fell to 54.9% at swing=0.Swing=0 assigns identical dimming to both symbols and serves as the null control.Source: §5.2 · pp. 10–11

6.1 Comparison with Prior Work

• LED-it-GO (4,000 bit/s) and xLED (1,000 bit/s) are faster but require host code execution, whereas LightComm needs WiFi adjacency to the bulb subnet.The threat models differ: Guri-style channels exfiltrate from already-compromised hosts, while LightComm creates a channel from the network without touching the monitored machine.Source: §6.1 · pp. 11–12
• The 8-byte run underperformed the 17-byte run because of environmental failure, while Hamming(7,4) faced a correction cliff at 92.5% accuracy over 44 codewords.The figure attributes the length-related failure to environmental conditions and the correction cliff to the code’s inability to repair multiple errors.Source: Figure 7 · p. 11
• BRIGHTNESS is the closest below-visual-threshold comparator, but it requires code execution on the display-driving machine; LightComm’s swing=2 power variation is below Light Auditor’s detection resolution.BRIGHTNESS modulates screen brightness at sub-perceptual amplitudes without IR hardware.Source: §6.1 · p. 12

6.2 Throughput

• 0.44 data bit/s for dimming OOK versus 0.24 data bit/s for color at 750 ms; the 500 ms smoothing floor, calibration, and FEC constrain rates.Observed RGB separation also rises linearly with dimming swing at 0.96 RGB units per dimming unit (Figure 8).Source: §6.2 · p. 12, Figure 8 · p. 12

6.3 Detectability

• The setPilot commands at 750 ms intervals resemble a user cycling through WiZ app presets, and standard IoT monitoring is blind to photonic output content by design.Source: §6.3 · p. 13

6.4 Limitations

• Every Table 3 and Table 5 row rests on only one or two runs, so the claimed 96.2% wire accuracy at swing=2 may reflect favorable sampling.The discussion calls for at least five runs per condition, reporting mean and standard deviation.Source: §6.4 · p. 13
• Warm-bulb gamut clipping collapses color separation, while swing=2 brightness modulation has not been shown undetectable and requires an ABX observer study.The color-axis channel’s requested states can clip to the same output; the brightness change is approximately 3.6% at center setting 55, near but not below the stated photopic JND range.Source: §6.4 · pp. 13–14

6.5 Future Work on Axis Selection and Real-Time Optimization

• Future optimization could select among a*, b*, L*, and dimming using measured separation, while modeling separation-versus-swing curves could reduce setup time from about 20 minutes to under 3.The current optimizer evaluates one modulation axis at a time and searches swing sequentially; automatic selection could avoid warm-bulb gamut clipping.Source: §6.5 · p. 14

• The color channel transmitted at JND = 0.5, below the human color discrimination threshold, while dimming OOK operated at a 2-unit swing near the typical indoor luminance threshold.Source: §7 · p. 14
• Interleaved pilot symbols let the color receiver track AWB drift, while dimming OOK avoids both AWB drift and warm-bulb gamut clipping.The conclusion identifies dimming OOK as more practical for bulbs below approximately 3500K color temperature.Source: §7 · p. 14
• A closed-loop optimizer measures optical separation through the camera to find a minimum viable operating point without manual calibration.It was used to diagnose warm-bulb gamut clipping and redirect the investigation to dimming.Source: §7 · p. 14
• Detection requires temporal variance analysis of camera video aimed at the lamp; network monitoring, power analysis, and visual inspection do not detect either channel.The paper also describes six additional WiZ protocol modalities and a smart-plug variant that transfers the on/off channel to a conventional lamp.Source: §7 · p. 14

• Figure 9 shows the “hi” frame’s color states, bit encoding, calibration blocks, and 214-wire-bit, 160.5-second structure.Source: Figure 9 · p. 17