Near-Source Attack for Isolated Networks with Covert Channel Transmission

This paper investigates a new attack method called "near-source attack". It leverages the broadcast frames of the 802.11 protocol to establish a hidden tunnel and bypass physical isolation networks or air-gapped networks. We first analyze and implement a common technology known as Ghost Tunnel, which allows the attacker to control the target host and transmit information without being detected. However, this method suffers from frame loss, repeated frame, and attack transparency. We then propose an improved solution to deliver malicious programs to the target host using a modified BadUSB hardware device. Once the attackers successfully get in the isolated networks, they can bypass security protection devices and exploit vulnerabilities of communication protocols, so that they can remote control of target devices and hidden data transmission. We further conducted experiments to verify the feasibility and effectiveness of this attack scheme. The results indicate that the attack logic is capable of inducing the target host to engage in covert communication. Finally, we give some defense measures for such attacks.