Informational Wi-Fi traffic can be used as covert communication channel for malware

A security researcher has developed a tool to demonstrate how the unauthenticated data packets in the 802.11 wireless LAN protocol can be used as a covert channel to control malware on an infected computer.

The protocol relies on clients and access points exchanging informational data packets before they authenticate or associate with each other, and this traffic is not typically monitored by network security devices. Tom Neaves, a managing consultant at Trustwave, developed a proof-of-concept tool called Smuggler that leverages these packets, known as wireless management frames, to communicate with malware.

Companies invest a lot of money in intrusion detection systems, firewalls, data loss prevention systems and other security devices to detect and block suspicious Internet traffic in and out of their networks. That’s because blocking malware programs from communicating with attackers is just as important as preventing end-point systems from becoming infected in the first place, which is increasingly hard to do these days with all the potential attack vectors and people using the same devices at home and work.

To read this article in full or to leave a comment, please click here