Introduction
This passage discusses network bridging, a technique attackers use to bypass security controls and gain unauthorized access to a network.
What is Network Bridging?
In cybersecurity, a bridge connects two separate network segments, allowing devices on each segment to communicate with each other. However, unlike traditional network devices, bridges operate at a lower level, potentially bypassing security controls like firewalls.
Dangers of Bridging
- Data Exfiltration: Attackers can use bridges to steal sensitive data from a network.
- Malicious Code Injection: Bridges can be used to introduce malware onto a network.
- Security Control Bypass: Bridges can render firewalls and other security measures ineffective.
Traditional Bridging Techniques
- Disabled Network Bridging: Leaving network bridging enabled on devices like wireless cards can create vulnerabilities.
- Multiple Network Interfaces: Systems with two or more active network interfaces can be exploited for bridging.
Advanced Bridging Techniques (Research/Lab Environments)
- LED Covert Communication: Manipulating system LEDs to transmit data via light signals.
- FM Frequency Exploitation: Using FM radio frequencies to communicate with nearby devices (e.g., AirHopper exploit).
- Acoustic Data Transmission: Controlling fans to send data through sound waves (e.g., BitWhisper exploit).
- Power Line Communication: Exploiting the power grid to transmit data (Ethernet over Power - EOP).
- VoIP Spying: Hijacking VoIP phone microphones and speakers for audio eavesdropping.
Low-Tech Bridging Techniques
- Physical Network Splicing: Gaining physical access to network cables to inject unauthorized devices.
- Sneakernet: Manually transferring data on removable media, bypassing network controls.
- Hidden Management Networks: Exploiting the internal network used to manage routers and firewalls for unauthorized access.
- Split Tunneling: VPN connections that allow data leakage between networks.
Mitigating Bridging Risks
- Identify Critical Assets: Locate and prioritize the most sensitive data within your network.
- Data Flow Mapping: Create a detailed model of how data moves within your network to identify potential bridging points.
- Implement Bridge Countermeasures:
- TEMPEST Controls: Shielding sensitive systems (Faraday cages) to block covert signal-based bridging.
- Device Authentication: Enforce authentication protocols before allowing devices to connect to your network.
- Threat Modeling: Identify potential bridging threats and implement targeted safeguards.
Best Practices
- Network Boundary Protection: Implement controls to prevent unauthorized devices and networks from accessing your internal network.
- Wireless Security: Enforce strong wireless access controls to detect and block unauthorized wireless signals.
- Network Access Audits: Regularly audit network connections to identify potential bridging points.
- Portable Media Policy: Implement strict policies for using portable media devices on your network, requiring authentication before connection.
- TEMPEST Testing: Conduct regular testing to identify potential information leakage through electromagnetic signals.
Conclusion
Network bridging poses a serious threat to network security. By understanding the different bridging techniques and implementing a layered approach that combines preventative measures, detection strategies, and ongoing vigilance, organizations can significantly reduce their bridging risks.