Part 2 -Technical details and protection 🔧

Ethernet cables connect network devices such as workstations and servers, printers, cameras, routers, and switches within a local area network (LAN). 
A network cable consists of eight wires twisted into four pairs. Several categories (cat) of Ethernet cables determine parameters such as operating frequencies, shielding, and bandwidth. 

About cables
There are different cables:
Cat 5e,5 , operates at a maximum frequency of 100 MHz.
Cat 6 and 6a support bandwidth up to 1 Gbit/s. Cat 6a bandwidth up to 10 Gbit / s.
Cat 7 and Cat 7a cables support higher bandwidths up to 10-40 Gbps over a range of about 15 meters. Category 7 cables are shielded and contain
four individually shielded pairs within a common shield. They are made with a GG45 connector, which is also compatible with RJ45 Ethernet ports.
There are other cables besides these, but they are common

So what is the point?
Ethernet cables emit electromagnetic waves at 125 MHz and its harmonics (e.g. 250 MHz and 375 MHz).
Note that the emitted frequency bands are determined by the operating frequency of the cable (e.g. 0-250 MHz for Cat 6, 0-500 MHz for Cat 6a, and 0-700 MHz for Category 7 cables).

The adapter speed or on and off allows you to adjust the electromagnetic emission and its amplitude of activity of the data and link layers determine the current flow on the copper wires of the Ethernet cables. By sending raw UDP packets, we could initiate and regulate the transmission from the Ethernet cable at its operating frequency.🔭

In the article, the data from the air gap computer was transmitted over an Ethernet cable 200 cm apart. The exact bandwidth depends on the type of transmitting device. The base
frequencies are wrapped around 250 MHz with less than 0.1 MHz difference between them.

So how do you protect yourself? 💊

There are several defensive measures that can be taken by LANTENNA attacks.

For example, the most effective one is that any radio should be banned from the area of closed networks.

🙃

This is clear, but how can one detect such attacks ?

You can monitor the link activity of the NIC at the user and the kernel levels.

In our case, any change in link state should trigger an alert. For example, using ethtool to change the interface configuration should be checked. If the speed is switched for a short period of time, the activity should be blocked .
But it is possible to bypass this method with different malware🦠 .

So there is an approach where a hypervisor-level firewall

It checks for changes on the network interface and checks for UDP from the active virtual machine.
Irregular activities are logged and outgoing packets are blocked.
There are also several types of protection such as: signal monitoring or signal jamming
There is also a method such as cable shielding:
Metal shielding is a typical measure used to block or limit electromagnetic fields from interference or outgoing shielded wires.

This kind of hacking mostly takes place at the professional level. And in normal life are mostly available to all sorts of feds. 🔑
I suggest you read the article below where you can find more detailed information with code examples and illustrations.

Thank you for reading.❤️
And remember while you, follow the white rabbit the cheshire cat follows you🐰
#еtthernet #wireless_hacking #network #air_gap