Re:Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
by viraptor on Saturday July 14, 2018 @07:48AM
(#17529943)
> If they achieve access to a target, it's likely they control a path to it.
Without specific, documented cases this is speculation of course. But I don't see why they'd use a link level protocol. 1. It requires patching multiple networking devices in the path, which is not very quiet. 2. It sticks out in any monitoring (via mirror ports) more than a UDP packet to a random host. DNS or ntp as a transport would be much simpler to hide.
Re:Air Gapping a MacBook Air: The Great BCM15700A2 Mystery
by amoshi on Sunday July 15, 2018 @02:15PM
(#17536313)
And what exactly would be the problem for the NSA with patching networking devices? They even mention how it's useful specifically for these hard targets
>"some of the most productive operations in TAO because they pre-position access points into hard target networks around the world."
https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
If the target is a wifi device, the custom protocol becomes doubly effective: Exfiltration is a matter of having a receiver anywhere in the vicinity. And that receiver can amplify the signal to blast it a few miles. There are tools to sweep the EM spectrum looking for anomalies like this, but they seem to be rare, for the moment.