Ghost Tunnel 2.0: Blue Ghost
summary
GhostTunnel 2.0 implements a covert Bluetooth channel that embeds data in BLE advertising/scan frames using a manufacturer-specific AD field and a custom protocol to establish multiple parallel tunnels for commands and file exfiltration. A Windows server and agent exist in C/C++; tests show roughly 12–20 packets per second, yielding only a few bytes/sec for large transfers, zero observed packet errors at close range, but frequent disconnects as distance increases. Code release on GitHub is planned.
AI-written summary · about
chapters (8)
- 0:00Introduction to Ghost Tunnel
- 1:05Air-gapped networks overview
- 2:33Historical air-gap attacks
- 7:02Ghost Tunnel 1.0 recap
- 8:38Ghost Tunnel 2.0 features
- 14:29BLE implementation details
- 20:24Demo and limitations
- 23:15Q&A on speed and reliability
related talks
40mGattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool
31mD1T1 - Covert Data Exfiltration Channel
48mCreating a Bluetooth Toolbox
16mTracking You from a Thousand Miles Away! Turning a Bluetooth Device into...
11mTurbo Tunnel, a good way to design censorship circumvention protocols
22mProbabilistic Spying on Encrypted Tunnels
29mMalware Development: Asynchronous Backdoor Built on Public APIs
25mBadTunnel: How Do I Get Big Brother Power?