Internet is being used worldwide, and it is one of the most valuable assets in today’s generation. However, recently, it was being revealed that a data exfiltration mechanism uses the Ethernet cables as a source of “transmitting antenna” to hijack all highly sensitive data from air-gapped systems.
Whenever this type of attack occurs, the risk of leakage of data increases as this attack involves stealing all the sensitive data of an organization.
After encountering such an attack, the organization generally moves to the air-gap isolation. Air-gapped computers are completely separated from external wide area networks (WAN) such as FTP, SSH, and SMTP.
After investigating the attack, it was being detected that it comprises two main steps. And that’s why the major step that happens in this attack which makes it more dangerous, were mentioned below:-
The data exfiltration is a part of the APT exfiltration phase, and in this, the threat actors the attacker might collect all the data from the compromised computers.
The data that is mostly hijacked by the threat actors can be:-
It also has two parts, one is data transmission and another one is data reception, that we have mentioned below:-
Data transmission: In this part, after collecting all the data from the organizations the threat actors exfiltrate it just by using the covert channel.
Data reception: In this part, any nearby radio receiver can obtain the covert transmission, after that it simply decodes it and send it to the threat actors.
The security analysts initially checked if the covert channel can be launched from within virtual machines or not. It’s known by everyone that virtualization has become a standard nowadays in many IT environments.
There are many features that make virtualization one of the standard methods, one property of visualization technologies is the isolation of hardware resources.
The architecture of virtual machine networking generally utilizes the idea of virtual network adapters, and it is maintained by the hypervisor and is being exposed to the customer through kernel drivers.
Apart from this, it’s been cleared that there are various defensive measures that can be taken against the LANTENNA covert channel, and they are:-
After encountering this attack, it’s been clear that the threat actors can exploit the Ethernet cables to exfiltrate data from air-gapped networks.
And they have estimated this covert channel in terms of bandwidth and distance and impersonated a set of countermeasures that we have mentioned above.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.
Dell Technologies has released a security update for its Wyse Management Suite (WMS) to address…
The Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment…
IBM has issued a security bulletin warning customers about a vulnerability in its Workload Scheduler…
Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of…
Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…
The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…