ShadowCat: Bridging the Air Gap with Browser-Based QR File Transfer

The challenge of moving data between two devices without a shared network, a functioning Bluetooth stack, or a physical cable is a classic problem in computing. While we often take for granted the seamless nature of modern cloud transfers, there are scenarios—ranging from broken hardware to high-security air-gapped environments—where traditional communication protocols fail.

Enter ShadowCat, a minimalistic, browser-based tool designed to facilitate file transfers using a sequence of QR codes. By leveraging the visual medium of a screen and a camera, ShadowCat turns a browser into a data transmitter and receiver, effectively creating a visual bridge for data.

How ShadowCat Works

At its core, ShadowCat is a single-page application that converts files into a stream of QR codes. The process is straightforward but effective:

  1. Chunking: The sending device loads a file, which is then broken down into smaller, manageable chunks.
  2. Transmission: These chunks are encoded into a series of QR codes that flash rapidly on the screen.
  3. Reception: The receiving device uses its camera to scan the sequence of codes.
  4. Reassembly: The receiver collects the chunks, discards duplicates, and uses a Cyclic Redundancy Check (CRC) to ensure the integrity of the reassembled file.

This approach allows for a "one-way" data transfer that requires no network handshake, making it particularly useful for devices with compromised communication hardware. As the author, @unprovable, noted, the project was born out of a need to recover data from an old phone with broken communications after it took a "swimming lesson in a coffee mug."

Technical Considerations and Limitations

While the concept is elegant, transferring files via visual codes introduces specific technical hurdles. Users have reported "code length overflow" when attempting to send larger text blocks, indicating that there are upper limits to the amount of data a single session can handle without further optimization.

The Bandwidth Bottleneck

One of the primary constraints is the speed of transmission. Compared to Wi-Fi or Bluetooth, QR streams are slow. However, for small files or critical text, the trade-off is acceptable. Some community members have suggested moving toward binary data insertion rather than Base64 encoding to reduce the number of frames required for the same amount of data.

Improving Reliability with Erasure Coding

A recurring theme in the Hacker News discussion was the use of Fountain Codes (such as RaptorQ or Luby Transform codes). Unlike standard sequential chunking, where missing a single frame can corrupt the entire file, erasure coding allows a receiver to reconstruct the original file once they have received any sufficient number of packets, regardless of which specific packets were missed.

As noted by @kig, who is developing a similar project called qr-send.com, the integration of Wirehair FEC (Forward Error Correction) can make the process "magically assemble" the source file even if some QR codes are skipped during the scan.

Use Cases: From Data Exfiltration to Air-Gapped Security

The versatility of a visual data transfer method opens up several intriguing possibilities beyond simple hardware recovery:

Air-Gapped Communication

For those obsessed with reducing the attack surface, this method is a goldmine. One user, @MattCruikshank, envisioned a system where encrypted bytes are flashed as QR codes from an air-gapped device to a phone, which then acts as a courier to transmit the data to another air-gapped device. Combined with one-time pads and public-key cryptography, this creates a highly secure, physically isolated communication channel.

Data Exfiltration

From a cybersecurity perspective, this is a powerful tool for exfiltration. As @thedougd pointed out, hosting such software on a popular CDN or GitHub Pages makes it a "very difficult to block method" for motivated actors to move data out of a secure environment.

Hardware Longevity

Beyond security, there is a philosophical value in this approach. By removing the dependency on cloud services or specific proprietary drivers, tools like ShadowCat promote hardware longevity. It allows users to breathe new life into old devices that would otherwise be e-waste due to a failed network chip.

Conclusion

ShadowCat demonstrates that sometimes the most effective solution is the most minimalistic one. By returning to the basics of visual data transmission, it provides a critical utility for those operating in the fringes of connectivity—whether they are recovering data from a coffee-soaked phone or securing a secret message in an air-gapped vault.

Sources