Feeds

Optical link hacking unsheathed

Tripping up the light fantastic

Mobile application security vulnerability report

Optical links are not as secure as might be assumed. Techniques for extracting data flowing over fibre optic links are evolving to make the technique easier to apply.

Instead of breaking a fibre and installing a device (splicing), an approach that might easily be detected, off-the shelf equipment makes it possible to extract data from an optical link without breaking a connection.

Splitter or coupler methods rely on bending the glass of a fibre-optic cable. If this bend is beyond a particular radius, a small amount of light leaks out. With modern receivers, only a small amount of light needs to be captured (0.1dB of the optical rating is enough) to extract the data from an optical link.

A simple clip-on device - such as the FCD-10B bend coupler from Canadian firm Exfo - is enough to achieve the job.

Infoguard demonstrates optical hacking

At the Infosecurity show in London, Swiss encryption appliance firm Infoguard demonstrated the use of optical tapping to intercept a Voice over IP call travelling across an optical link (picture above). There was no noise on the line while the tap was in progress. A PC connected to the optical link via a media recorder was able to recover the unencrypted data flowing over the link.

The scenario of optical hacking might appear like the fodder from Hollywood hacksploitation flicks rather than a practical threat. However, Infoguard said that in 2003 an illegal eavesdropping device was found attached to Verizon's network. Investigators probing the hack reckoned it was motivated by an attempt to access the quarterly statements of a mutual fund company. The perps were never identified.

Infoguard staged the demo in order to illustrate the point that firms need to encrypt data traveling over optical links, using devices such as its 10Gbps EtherGuard appliances. ®

Bridging the IT gap between rising business demands and ageing tools

More from The Register

next story
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
FLAPE – the next BIG THING in storage
Find cold data with flash, transmit it from tape
Seagate chances ARM with NAS boxes for the SOHO crowd
There's an Atom-powered offering, too
THUD! WD plonks down SIX TERABYTE 'consumer NAS' fatboy
Now that's a LOT of porn or pirated movies. Or, you know, other consumer stuff
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.