Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?

I'm not sure how difficult this is considering that there are many different formal signal types that have been created:

  • Home Plug
  • UPA
  • HD-PLC
  • G.hn
share|improve this question
    
I don't think you have to worry about them if you're in an isolated building as they cannot go beyond the local circuit. Users would be able to set up a LAN but they wouldn't be able to hook it up to your network or to company devices if they're configured properly. –  Inverted Llama Dec 3 '12 at 13:31
    
Depends what the local circuit is? I use homeplug at home and that includes about 8 houses on my street. I haven't proven it yet, but I'm pretty sure that the simple passwd system they use is not very strong and easily brute forceable. –  Callum Wilson Dec 3 '12 at 16:08
add comment

4 Answers

up vote 3 down vote accepted

The simple answer is that you can't. Power lines are physical cables that interconnect machines in your office, as well as between offices. It's just not possible to identify the use of these kinds of communications without resorting to measuring noise on those lines, or (as Lucas said) buying a bunch of hardware that uses those communications technologies and hooking them up. Even then, you're going to have problems of cross-talk and interference, and a user could probably just unplug them from the socket when you're not looking. It's not feasible in the slightest.

If you want to prevent someone from using one of these ethernet-over-power technologies to communicate with sensitive equipment, install a UPS on that equipment that has conditioned output. These UPS units take an incoming AC power source, regulate it to DC via a switch-mode power supply (SMPS) and then use a large power transistor (e.g. FET or IGBT) to "step" the output power, either directly (by driving a 50/60Hz signal) or indirectly (charge pump into a capacitor). Part of this usually involves a feedback step, which allows very precise changes in output voltage to be made in order to maintain a perfect signal. The main reason for doing this is that load (i.e. the amount of current being pulled by devices on the UPS) will often alter the performance of the UPS, especially when load spikes occur. The feedback allows the UPS to maintain phase and voltage at all times. The overall process entirely removes any noise from the input supply, and makes the use of power-communications technologies nearly impossible on that circuit.

The fact is, though, that a determined person will always find a way. They could use WiFi, Bluetooth, XBee, ethernet cables, USB drives, FireWire, etc. to defeat any kind of air-gap you have installed. You need to prioritise your protection to sensitive areas, and mandate strong security practices elsewhere via policy.

share|improve this answer
add comment

mmm not sure if this might work but:

  • Buy all of these devices
  • Plug them into your powersockets
  • Plug the ethernet into a computer
  • Install wireshark and make it listen onto that ethernet interface

See any traffic, then someone is using your powerlines for communication.

share|improve this answer
add comment

Isolation transformers are supposed to be effective at blocking extra signals over power lines. This is useful when trying to prevent unintentional leakage (it makes sense only when the computers themselves are in a Faraday cage). Some UPS are also isolation transformers.

If the users themselves are intent on establishing covert communications, and are able to plug devices of their own, then there is very little you can do to prevent that, unless in specific scenario. For instance, if the users have access to windows, then they can use laser beams.

To detect most low-grade attackers, who use consumer products, do as @Lucas suggests: buy the same products, to "spy on the line".

share|improve this answer
    
The first part of this answer is incorrect. An isolation transformer blocks DC on the line, which can be a source of ground loop issues. The DC component on the line is usually troublesome for devices that contain signal transformers, such as speakers. However, signals on the power line are AC waveforms, which will be passed on by the transformer. As such, an isolation transformer will do nothing to protect you from that kind of interference. The same goes for simple UPSes that don't condition their output. What you need is a UPS with conditioned output, which actively regulates the output. –  Polynomial Dec 2 '12 at 23:55
add comment

Commercial devices like Home Plug are designed to be reliable not covert. Their waveforms sit 10's of dB above the noise floor, and are quite visible on a spectrum analyzer. Let a certified operator from your calibration and measurements department do the testing (do not just hook up you spec-an to the 120 VAC line.) Examples of the signal waveforms for the various devices are available in detailed data sheets for the respective vendors.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.