We are new to Information security and we have a question that we can not figure out how to solve.

We can assume that:

  • The malware is deployed on an infected laptop that is connected to a network, wirelessly

  • The attacker is equipped with only a standard laptop (no additional hardware is being used)

  • The attacker's laptop is not connected to the infected laptop's network

  • The attacker applies external interception to the infected network.

The question: What is the maximum effective distance from the infected network, that the attacker's laptop can be located? What challenges may arise from locating the attacker's laptop too far from the infected network? Will it damage the extracted message?

Our thought: We can't find a numeric answer to this question, maybe we didn't understand the question. We think the attacker needs to be as close as he/she can, because he/she will sniff packets that have traveled the least amount of routers and therefore it's more reliable.

Could someone please clarify for us how we should approach this question? Where is the mistake?

  • you need to define your terms: what is "external interception"? – schroeder Mar 26 '18 at 21:19
  • Did the attacker deploy the malware? What is a "standard laptop"? – schroeder Mar 26 '18 at 21:20

What makes you think that distance is a factor at all? It isn't.

Malware running within a network with unrestricted Internet access can exfiltrate data to a host on the public Internet. This could be as simple as uploading data to an FTP server or to a file sharing site like Dropbox, or could be arbitrarily complex. Either way, the location of the attacker is irrelevant -- as the data is exfiltrated, it can be sent anywhere it's needed.

Malware can also give a remote attacker access to the network, e.g. through a VPN, or simply by allowing them to remotely control the infected machine. Again, the location of the attacker doesn't matter.

In none of these situations is "packet sniffing" a necessary part of the attack. There are some esoteric methods of exfiltration which could sniff outbound traffic from the targeted network to avoid detection, but this isn't a crucial part of an attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.