Jacek Lipkowski's Etherify, "Bringing the Ether Back to Ethernet," Exfiltrates Data Wirelessly
Taking advantage of radiated signals, Etherify requires no unusual binaries yet can exfiltrate data via Morse code.
Radio amateur and security enthusiast Jacek Lipkowski has released of a novel variant on the TEMPEST attack, allowing data to be exfiltrated from an otherwise secured computer by listening to radio waves emitted on its Ethernet cable — complete with proof-of-concept code suitable for running on a Raspberry Pi.
"Leaking data via out of unconnected devices (both connected and unconnected) is a very interesting topic, often called 'soft TEMPEST,'" Lipkoswki explains. "Often this is the realm of absurdly costly lab equipment, source code isn’t published etc. Here I would like to demonstrate this using the simplest equipment and means, and make it very easy to reproduce."
"Signals can be modulated using different methods. Here i will use Morse code for simplicity. This also allows one to judge the signal to noise ratio by just listening. It is also possible to decode it by ear without additional devices if one knows Morse code, if not there is a lot of software that can do it (although usually with much worse performance than an experienced human operator.) Transmission is implemented via very simple shell scripts. Only bash, ethtool and ping is needed. This enables the script to be used easily on embedded devices and other platforms where shipping binaries, installing a Python environment etc might be a problem."
In experimentation with Raspberry Pi single-board computers, Lipkowski was able to exfiltrate data wirelessly using two approaches — both of which transmitted signals at 125MHz. The first was to repeatedly switch the device's Ethernet port from 10-base-T to 100-base-T connectivity; the second was to transmit data between two devices at 1Gb/s. Both were easily discernable at a 30m (around 100') distance — though Lipkowski warns that it depends heavily on nearby signals at the same frequency.
Lipkowski's full write-up is available on his blog; the proof-of-concept scripts are up on GitHub under the GNU General Public License 3.0.
