Hot Downloads

Welcome, Guest
Username: Password: Remember me

TOPIC: UTP wiretapping

UTP wiretapping 11 years 8 months ago #6873

  • MezzUp
  • MezzUp's Avatar
  • Offline
  • Frequent Member
  • Posts: 75
  • Karma: 0
Hello everybody,

This is more of a hypothetical(correct spelling?) question, but I'm interested in everything networking related I was sure somebody here had the answear for me.

I was thinking about UTP cable wiretapping, and wether it is possible in practice.

One method would be stripping the insulation of the wire and physicly 'tap' into the wire. Perhaps one would have to use two NICs because both wire pairs would be 'recive'? Maybe there are then problems with signal strengh or crosstalk or something like that? Is this possibly in theory? What about in practice?

I know that one could simply cut the cable and put two RJ-45s on both ends, but again we are talking hypothetical.

Another method I though of was, and I know this is a stretch, EMI wiretapping.
I admit I don't know much about EMI, but I think it's basicly "electrical leakage" from a copper wire(electrical, data...) that is interfearing with another wire. Now, couldn't one use that "leakage" to listen to what is being said on the wire? Since were talking about digital waves it should be even easier, right? Given the right equipment, _should_ this be possible? And furthermore, _is_ it possible?


Later, MezzUp
The administrator has disabled public write access.

Re: UTP wiretapping 11 years 8 months ago #6888

  • sahirh
  • sahirh's Avatar
  • Offline
  • Honored Member
  • Posts: 1700
  • Karma: 0
Yep mate,
both can and have been done ;)


I have never seen the EMI tap before, but I know that it is around
Sahir Hidayatullah.
Firewall.cx Staff - Associate Editor & Security Advisor
tftfotw.blogspot.com
The administrator has disabled public write access.

Re: UTP wiretapping 11 years 8 months ago #6895

  • MezzUp
  • MezzUp's Avatar
  • Offline
  • Frequent Member
  • Posts: 75
  • Karma: 0
Cool! :D

Got any links and/or stories? :)

[Edit]
I forgot Google :oops:
The administrator has disabled public write access.

EMI Wiretap 11 years 8 months ago #6931

  • TheBishop
  • TheBishop's Avatar
  • Offline
  • Moderator
  • Posts: 1719
  • Thank you received: 8
  • Karma: 5
Interesting stuff. The EMI wiretap certainly can be done as the techniques of sniffing a bit of an RF signal off a wire are years old and not difficult. The tricky bit would be doing it without degrading the performance of the 'real' link in the process. Not that sniffing a bot of the signal would be noticeable, but UTP is carefully constructed with twists etc to minimise radiation of the signal from the cable and also reception of crud from the environment onto the cable. You'd probably have to untwist some of the cable to do it, which in practice probably means constructing a short cable with the sniffing strands built in then twisted back together. If you could stick that in-line without anybody noticing, you've cracked it.

I think this one will have to go onto my list of 'esoteric experiments to do once I get some time'. Who knows, perhaps I can think of a slogan for it to go on a T-Shirt?
The administrator has disabled public write access.

Re: EMI Wiretap 11 years 8 months ago #6945

  • MezzUp
  • MezzUp's Avatar
  • Offline
  • Frequent Member
  • Posts: 75
  • Karma: 0
You'd probably have to untwist some of the cable to do it, which in practice probably means constructing a short cable with the sniffing strands built in then twisted back together. If you could stick that in-line without anybody noticing, you've cracked it.
Then you might as well do a physical wiretapping(the first method I described), right?
The administrator has disabled public write access.

Wiretap 11 years 8 months ago #6962

  • TheBishop
  • TheBishop's Avatar
  • Offline
  • Moderator
  • Posts: 1719
  • Thank you received: 8
  • Karma: 5
Yes, although that would leave evidence that you'd done it if you did it to the original cable. I was just thinking of a pre-tapped 'espionage kit' that you could put in, use then remove so nobody would know after the event. As you rightly point out, you could do that with a physically tapped cable too.

I've been having a quick Google on this, and there are some commercial products. Have a look at:
www.wildpackets.com/elements/third_party...m_datasheet_taps.pdf
or www.netoptics.com/pdf/installation_guide/IGNET96430.pdf
for example
The administrator has disabled public write access.
Time to create page: 0.080 seconds

CCENT/CCNA

Cisco Routers

  • SSL WebVPN
  • Securing Routers
  • Policy Based Routing
  • Router on-a-Stick

VPN Security

  • Understand DMVPN
  • GRE/IPSec Configuration
  • Site-to-Site IPSec VPN
  • IPSec Modes

Cisco Help

  • VPN Client Windows 8
  • VPN Client Windows 7
  • CCP Display Problem
  • Cisco Support App.

Windows 2012

  • New Features
  • Licensing
  • Hyper-V / VDI
  • Install Hyper-V

Linux

  • File Permissions
  • Webmin
  • Groups - Users
  • Samba Setup