LANTENNA: Exfiltrating Data from Air-Gapped Networks via Ethernet Cables
Mordechai Guri

TL;DR
LANTENNA demonstrates a novel electromagnetic attack that enables data exfiltration from air-gapped networks via Ethernet cables acting as antennas, even from virtual machines, over several meters.
Contribution
This paper introduces a new electromagnetic covert channel exploiting Ethernet cables for data exfiltration from air-gapped systems, with implementation and countermeasures.
Findings
Data can be exfiltrated over several meters.
Malicious code operates in user-mode and virtual machines.
Effective countermeasures are discussed.
Abstract
Air-gapped networks are wired with Ethernet cables since wireless connections are strictly prohibited. In this paper we present LANTENNA - a new type of electromagnetic attack allowing adversaries to leak sensitive data from isolated, air-gapped networks. Malicious code in air-gapped computers gathers sensitive data and then encodes it over radio waves emanating from the Ethernet cables, using them as antennas. A nearby receiving device can intercept the signals wirelessly, decode the data, and send it to the attacker. We discuss the exfiltration techniques, examine the covert channel characteristics, and provide implementation details. Notably, the malicious code can run in an ordinary user-mode process and successfully operate from within a virtual machine. We evaluate the covert channel in different scenarios and present a set of countermeasures. Our experiments show that with the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
