By Tammy Waitt
When it comes to the threat of corporate espionage and eavesdropping, some organizations aren’t listening. The troublesome aspect of Chinese spy balloons is that they can potentially be outfitted with cameras, radars, and radio devices. These radio devices can be utilized to infiltrate organizations via a number of wireless protocols, potentially giving them access to sensitive information, critical discussions, and more. Radio-based attacks are a constant threat with something as small as a compromised cell phone able to wreak havoc in the enterprise, let alone a high-tech spy balloon.
When it comes to the threat of corporate espionage and eavesdropping, some organizations aren’t listening. The troublesome aspect of Chinese spy balloons is that they can potentially be outfitted with cameras, radars, and radio devices. These radio devices can be utilized to infiltrate organizations via a number of wireless protocols, potentially giving them access to sensitive information, critical discussions, and more. Radio-based attacks are a constant threat with something as small as a compromised cell phone able to wreak havoc in the enterprise, let alone a high-tech spy balloon.
Guest Editorial by Brett T. Walkenhorst, Ph.D., CTO, Bastille
From cell phones and Wi-Fi to wearables, peripherals, and IoT, the modern world is swimming in wireless devices, and their wireless data is constantly racing through the air all around us.
As an increasingly interconnected global society, we are incredibly reliant on wireless technologies for conducting many of our daily activities in our personal and professional lives.
Unfortunately, the wireless protocols we so often rely on are not completely secure. Over the last 20 years, we have seen exponential growth in wireless vulnerability disclosures. With over 2,000 wireless-based CVEs (common vulnerabilities and exposures), the wireless attack surface is becoming increasingly vulnerable to exploitation.
The impacts of such attacks can range from initial access to data exfiltration to code injection and owning a device/network. This poses risks to any environment but is especially dangerous for data centers, critical infrastructure providers, and government facilities hosting classified information.
(The head of the Pentagon’s programme looking into Unexplained Aerial Phenomena warned that his office now has 650 reports. The Pentagon said there is no sign of alien involvement, and could be spy drones that are able to surveil and attack American targets. Courtesy of NBC News and YouTube. Posted on Apr 19, 2023.)
Some examples of common wireless attack mechanisms include the following:
Smartphone spyware
Pegasus is a smartphone exploitation toolkit that can infect smartphones with zero user interaction
While the tool is meant to target terrorist and criminal organizations, it has been used against activists, journalists, politicians, and business executives around the world
Pegasus gives an attacker complete access to the phone’s resources including cameras, microphones, processing, and hardware/wireless interfaces
Impact ranges from data exfiltration to command and control, resulting in total lack of privacy for targeted users
Dozens of other spyware tools exist with varying levels of complexity and cost
Hacker cables
Hacker cables, such as the USB Ninja and O.MG cable are inexpensive, highly capable devices that allow an attacker to log keystrokes, exfiltrate data, and perform code injection through Wi-Fi or Bluetooth
In appearance, they are indistinguishable from standard charging cables, so the only way to reliably detect them is by monitoring their wireless emissions
All that is required to execute an attack is for an unsuspecting victim to plug the cable into their laptop or other device
The attacker can then remotely execute code on the device by sending commands using the wireless protocol
Rogue access points
Attackers can set up hotspots, Wi-Fi pineapples, and other similar devices (generally called rogue access points) to capture client devices through various means such as spoofing legitimate networks
The attacker can then map device behavior and network resources, implant malware, and steal data including credentials that an attacker could leverage to gain additional access
These devices don’t need to be inside of a target facility; they just need to be able to connect to something inside the facility
Bluetooth tethering
Bluetooth devices can be set up to transfer data in a way that’s similar to Wi-Fi connections (called Bluetooth tethering), enabling rapid data exfiltration
These connections are not reliably detectable using standard Wi-Fi security tools
Even among tools that can detect Bluetooth devices, the vast majority can’t detect devices when they’re paired
IoT worm
A worm has been developed and demonstrated to infect large numbers of IoT devices using a ZigBee wireless interface
Impacts can include unauthorized remote control, permanently disabled devices, and unwitting participation in wireless DDoS attacks
Use cases include smart homes, smart cities, and industrial control systems (e.g. critical infrastructure)
The examples above offer a small sample of attacks that can be executed wirelessly.
Some of these attacks can be conducted without cooperation from personnel or devices inside a secure facility, such as a data center.
Others require a small device to be implanted somewhere within the facility, likely connected to some network element or trusted end-user device.
Some delivery mechanisms are extremely creative, such as using Wi-Fi drones to conduct surveillance on a US-based financial firm in the summer of 2022.
(Learn about the Colonial Pipeline cyberattack which caused a major blow to the gasoline industry in the southern and eastern parts of the United States, but it also showed how vulnerable the US energy grid is to more attacks in the future. Courtesy of CNET and YouTube. Posted on May 14, 2021.)
These attacks can be conducted with little to no visibility, whatever the delivery mechanism.
Wireless signals travel at the speed of light, penetrate physical barriers, and are invisible to the eye. Attackers can leverage these invisible signals to conduct attacks in an increasingly large number of ways.
The first step in defending against these attacks is to bring visibility to the wireless domain. The next step is to use that visibility to detect anomalous and dangerous behavior.
Bastille provides continuous monitoring of wireless signals, including detection and localization of cellular, Wi-Fi, Bluetooth (including paired devices), and IoT.
By extracting metadata from the wireless packet headers, Bastille analyzes spatial, temporal, and behavioral patterns to identify anomalous behavior of wireless devices.
The combination of device detection, localization, and advanced analytics constitutes the world’s first Wireless Threat Intelligence Platform, giving customers real-time insights to help them defend their wireless infrastructure.
Wireless security is increasingly recognized as a critical gap in most organizations’ security posture for data centers, board rooms, secure computing facilities, classified areas, and more.
Continuous wireless monitoring and advanced analytics are key in mitigating the threats of the increasingly vulnerable wireless attack surface.
- Dr. Walkenhorst is the CTO of Bastille, where he leads R&D efforts to enhance product performance and add new capabilities.
