Categories: cyber securityHacks

New Attack Let Hackers Steal Data From Air-Gapped Networks Using Ethernet Cable

Internet is being used worldwide, and it is one of the most valuable assets in today’s generation. However, recently, it was being revealed that a data exfiltration mechanism uses the Ethernet cables as a source of “transmitting antenna” to hijack all highly sensitive data from air-gapped systems.

Whenever this type of attack occurs, the risk of leakage of data increases as this attack involves stealing all the sensitive data of an organization. 

After encountering such an attack, the organization generally moves to the air-gap isolation. Air-gapped computers are completely separated from external wide area networks (WAN) such as FTP, SSH, and SMTP.

The attack model

After investigating the attack, it was being detected that it comprises two main steps. And that’s why the major step that happens in this attack which makes it more dangerous, were mentioned below:-

  • Reconnaissance and Infection
  • Data Exfiltration

The data exfiltration is a part of the APT exfiltration phase, and in this, the threat actors the attacker might collect all the data from the compromised computers. 

The data that is mostly hijacked by the threat actors can be:- 

  • Documents
  • Databases
  • Access credentials
  • Encryption keys

It also has two parts, one is data transmission and another one is data reception, that we have mentioned below:-

Data transmission: In this part, after collecting all the data from the organizations the threat actors exfiltrate it just by using the covert channel. 

Data reception: In this part, any nearby radio receiver can obtain the covert transmission, after that it simply decodes it and send it to the threat actors.

Virtual Machines (VMs)

The security analysts initially checked if the covert channel can be launched from within virtual machines or not. It’s known by everyone that virtualization has become a standard nowadays in many IT environments.

There are many features that make virtualization one of the standard methods, one property of visualization technologies is the isolation of hardware resources.

The architecture of virtual machine networking generally utilizes the idea of virtual network adapters, and it is maintained by the hypervisor and is being exposed to the customer through kernel drivers.

Recommendations

Apart from this, it’s been cleared that there are various defensive measures that can be taken against the LANTENNA covert channel, and they are:-

  • Separation
  • Detection
  • Signal Monitoring
  • Signal Jamming
  • Cable Shielding

After encountering this attack, it’s been clear that the threat actors can exploit the Ethernet cables to exfiltrate data from air-gapped networks. 

And they have estimated this covert channel in terms of bandwidth and distance and impersonated a set of countermeasures that we have mentioned above.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Dell Wyse Management Suite Vulnerabilities Let Attackers Exploit Affected Systems Remotely

Dell Technologies has released a security update for its Wyse Management Suite (WMS) to address…

22 minutes ago

CISA Details Red Team Assessment Including TTPs & Network Defense

The Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment…

30 minutes ago

IBM Workload Scheduler Vulnerability Stores User Credentials in Plain Text

IBM has issued a security bulletin warning customers about a vulnerability in its Workload Scheduler…

55 minutes ago

Multiple Flaws With Android & Google Pixel Devices Let Attackers Elevate Privileges

Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of…

1 hour ago

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

17 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

17 hours ago