D1T1 - Covert Data Exfiltration Channel
summary
Claims a USB HID delivers a first-stage payload then a removable covert Wi‑Fi C2 uses Ghost Tunnel built on 802.11 management frames to exfiltrate and command without associating to APs. Implementation embeds data in SSID/IE fields of 802.11 probe request/response, uses modified hostapd and OS Wi‑Fi APIs, and supports Windows 7–10 and macOS within ~50 m. Prototype handles up to 256 clients, bypasses firewalls, and demos a working remote shell after HID drop.
AI-written summary · about
chapters (17)
- 0:00Introduction and team overview
- 1:52Air-gapped networks explained
- 3:43Famous air-gap attack cases
- 5:15Previous air-gap research
- 7:50GoSkoC overview and attack steps
- 10:23Wi-Fi protocol basics
- 13:25Probe request/response covert channel
- 14:31802.11 frame structure details
- 17:32Wi-Fi modes and limitations
- 18:42OS-specific Wi-Fi APIs
- 19:28Windows Wi-Fi implementation
- 21:44Retrieving network information
- 23:08Mac OS Wi-Fi implementation
- 24:12Linux Wi-Fi setup
- 25:04Payload delivery and demo
- 26:59Acknowledgments and related work
- 27:24Q&A session
related talks
38mHiding A Secret Distributed Chat System In 802.11 Management Frames
21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets
27mWIFI-Important Remote Attack Surface: Threat is Expanding
33mWi-Fi Brokering
22mWhat really happens when you connect to public Wi-Fi?
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
13mUnmasking the Black Box: Eduardo Montovani on Wi-Fi Security, AI, and Affordable Hacking
52mWi-Fi Hacking for Web Pentesters