  It has previously been shown that the gated detectors of two commercially
available quantum key distribution (QKD) systems are blindable and controllable
by an eavesdropper using continuous-wave illumination and short bright trigger
pulses, manipulating voltages in the circuit [L. Lydersen et al., Nat.
Photonics DOI:10.1038/nphoton.2010.214]. This allows for an attack
eavesdropping the full raw and secret key without increasing the quantum bit
error rate (QBER). Here we show how thermal effects in detectors under bright
illumination can lead to the same outcome. We demonstrate that the detectors in
a commercial QKD system Clavis2 can be blinded by heating the avalanche photo
diodes (APDs) using bright illumination, so-called thermal blinding. Further,
the detectors can be triggered using short bright pulses once they are blind.
For systems with pauses between packet transmission such as the plug-and-play
systems, thermal inertia enables Eve to apply the bright blinding illumination
before eavesdropping, making her more difficult to catch.
