Fiber Tapping - Monitoring Fiber Optic Connections

[@minecrafter9099]

I also work in telecom. Two main problems with tapping (at least for "normal internet consumers"), first the ONT (the terminal device that sits in the customer house) will most likely break the connection because the signal is weak (in portugal we usually have near -25dbm reaching the client, but the limit where the ONT will go up is like -26 or so, almost on the limit...), then with that poor signal (from the tap) you will get a lot of noise, i doubt that you can get anything useful from it. Even then there is the second problem, GPON as the name implies is a passive network, which contains splitters, if you would like to get some kind of information either you go as near the central as you can (but even there are some splitters, so you will never get a signal for a full PON of clients), ideally you would need to catch the uplink on the customer end and the downlink on the central end (to get a minimally useful signal) also, GPON (and also EPON IIRC) has encryption on the downlink communication, so you would not get anything really useful that easily.

[@GajoFanatico]

Finally, somebody that understands something about communications. Props from another telecom technician

[@brandonstevens6886]

@@tuuretarvainen6757 I think it is just a proof of concept, that it **is** possible to do non necessarily practical **yet**

[@tomassimoes7808]

Boa observação:)

[@josealfredfernandes]

@@GajoFanatico hey, i seek to encrypt my connection, so that the spying can be avoided, any idea, what to do, how to do? kindly guide me through

[@josealfredfernandes]

hey, i seek to encrypt my connection, so that the spying can be avoided, any idea, what to do, how to do? kindly guide me through

[@apenasmeucanal5984]

dude you know what i like the most about your videos? you’re always as excited as a child on christmas morning, which makes your content so much more lighter and engaging! it can clearly be seen that you love what you do; and that makes me happy for you. much love from brazil!

[@KastanDay]

love this comment. I feel that too.

[@Arti9m]

1:56 I'm now reading a book on Assembly programming that describes how branch prediction works in CPUs since Intel Pentium Pro. And it clearly says that wrong prediction causes pipeline reset, which takes time. The time delay makes possible to detect what kind of data was executed/used previosly. The book from 1998 essentially describes the basis for Spectre vulnerability :)

[@nagitokomaeda3237]

That's nice.

[@Arti9m]

@NamedKitten Book name: "Assembler. Учебник для вузов." by Юров В.И., pages ~32-36, hope you understand Russian! ^_^

[@eikenope1008]

Actually, Spectre does not use the timing of a pipeline reset at all. A wrong branch prediction is provoked (by training the predictor in a specific way) and the privileged memory is accessed in the wrong branch before the pipeline is discarded. The value read from privileged memory is used as an index to load a cache line and after the pipeline reset happened, you run through all possibly indexed cache lines and find the one that is loaded the fastest (because it was accessed before). So the side channel Spectre uses is actually the memory / cache access time, not the time it takes to reset the pipeline. The problem that enables this attack is, that privilege checks themselves are just conditional branches and if you can fool the predictor into executing a privileged access and use the result before the pipeline is discarded, you can acquire the data using side channels like cache timing.

[@Arti9m]

Thank you for this information. I believed that Spectre referes to a family of vulnerablities that are based on the observeable effects of branch prediction stuff and my book very clearly described how pipeline reset happens and that it takes time, therefore I made the wrong conclusion that Spectre uses pipeline reset time. Hopefully my original comment still has some weight in a sense that people knew well enough how a CPU worked back in 98 (and maybe earlier) and had the knowledge to predict (and possibly prevent) such vulnerabilities.

[@eikenope1008]

@@Arti9m Of course your original comment still matters. As you say, branch prediction is a pretty old idea, but the idea to exploit it like in Spectre/Meltdown is fairly new. Side channel attacks are often very counter intuitive and because of this, take a long time to be discovered. I think branch prediction was not considered a security threat before, because, as you say, the pipeline is "reset" and in an ideal model, this would mean everything is, as if the wrong code never had been executed. The cache latency as a side channel is a really creative way to extract data from these discarded operations. Most of the speculative execution (branch prediction) based attacks in these last few years probably wouldn't have been discovered for a long time if it wasn't for this one creative idea.

[@xspager]

They talk about tapping 19 years ago because they were already doing it many years before that

[@alexisfrjp]

And that's why this technology became mainstream.

[@J-o-h-m]

@@alexisfrjp sure -that's definitely it - that's the only reason

[@ShainAndrews]

We tested long haul fiber with this method over a decade before this document came out. Basic stuff just to verify what carrier was on which fiber. Been rolling out encryption for the past six or so years. Encrypted traffic encapsulated inside encrypted fiber.

[@ShainAndrews]

@@alexisfrjp Right... because copper can handle 100 Gbps, and is clearly more secure. SMH

[@alexisfrjp]

@@ShainAndrews weight, price, power consumption, losses.. I don't believe copper is more secure. In the end, IMHO there is no security without encryption of the data going through the medium.

[@anuragkashyap8026]

Hope to see a satelite someday in you channel. You are growing exponentially 👏❤️

[@Lillfot]

Awesome! Really hammers home the lesson that security is all about access.

[@riqve198]

of course he got it from Russia

[@Airman..]

James Comey ain't surprised

[@user-pe3yl9kz8p]

RiqVe yes, its from Is74.ru)

[@CielMC]

you mean WE got it?

[@brandoncejacruz218]

It would be interesting seeing a video of this device implemented with Wireshark and try to get some data or something more practical. I love the theory behind it, but practice it's always cooler. Btw nice work with your daily videos! :)

[@christopherestewart]

“Fraction of the signal”, but a 3 dB of loss is 1/2 of the power. Yes, 1/2 is still a fraction.

[@anunayy]

O really, wow.

[@rishav4343]

db loss? do you mean dBm?

[@claritytreinamentos]

@@rishav4343 dB loss. Loss and gain are measured in dB. dBm is the actual power. 5 dBm - 3 dB = 2 dBm

[@mario982010]

@@claritytreinamentos So, every 1db loss on fiber what percentage of power loss represent in general?

[@claritytreinamentos]

@@mario982010 1 dB loss means 21% loss on power

[@katesaikishore8155]

Please make more viedo's on hardware security. It will be more awesome and make this chaneel unique.

[@AdityaTripathi]

I have that yellow fiber wire straight to my house, it was pretty cool to see it install.

[@dasistallesmisthier]

So, someone could just slowly close the case over several days and it would look like a normal disturbance?

[@gabiold]

If the link power is logged long-term, the you just have to change the time span of the graph and see the notch just as good. 😉

[@circuit10]

@@gabiold That might happen normally though

[@gabiold]

@@circuit10 Why? This isn't a radio link. This is a closed optical system, mostly fixed for years, what could cause sudden disturbace?

[@circuit10]

@@gabiold Close it over a few years? I don't know, I'm just guessing

[@gabiold]

@@circuit10 We comparing "several days" over something. Even if it is just there for 6 months, I don't think that the power should change normally this much as just moving the cable probably barely changes the loss, as opposed to what that excessive bend cause. So I think it is pretty stable over it's lifespan, and that loss could be seen on a graph.

[@berkeguzel5979]

It's almost 2020 and I'm still running off of DSL that runs at 10 Mbit at its best

[@zentrobi1548]

come on, no one uses that today ...

[@hastiamazing5468]

believe me i live in north africa Tunisia to be exact and i really i m running on dsl actually to be a ble to get a fiber connection a medium to above income worker by todays stander needs at least his hole income for a year to be able to do it

[@afrugaltechchannel1360]

10 Mb/s gang

[@zentrobi1548]

@@hastiamazing5468 you kidding me right? A whole years income?! And here i find myself unable to grt a places wich dosn't already have the fiber digged in and in most cases its the only awailebel.

[@hastiamazing5468]

@@zentrobi1548 yeah bro thats the stuff we gotta deal with as a 3rd world country also if thats weird let me tell u that if u are able to get fiber in my country it will not be great because since the goverment has a law about installing the main wires in the streets and having servers basically the goverment is the only one that is allowed to do that that s why the private sector cant have their own server facilities they have to rent the goverment ones and since our goverment likes cutting corners even if i have the money to get fiber its gonna be shit

[@Time4Technology]

I would love to see an extended version of this. Not just a proof of concept, but actually analyzing the tapped signal and decoding it to human readable data.

[@hrgwea]

The exercise is trivial. It's like adding a "T" connection to the wire. You receive everything exactly as it was sent. No need to decode anything. Of course, in a real scenario that's still useless because most data communications nowadays are encrypted. So there's little chance to get anything useful out of it.

[@CrusherFTW]

@@hrgwea Good luck doing that on an PON network

[@Raemien]

Remember: don’t let any fiber-optic cables bend.

[@ElizabethBeaver]

it's still fascinating to me that a glass line like that has *any* flexibility at all!

[@hrgwea]

It's not crystallized glass, so it's not brittle like the glass of a window.

[@dominikgrudzinski5563]

To be honest its not that easy to break a single fibre optic cable, sure if you roll over it with a chair the thing is done, but for example its more prone to connector damage than bending, in my place we have more splicing(fiber welding) to do mostly because connectors have scratches/cracks while fibres themselves don't break as often, ofc you get more loss on the bend part so you wanna avoid any bending to limit the light loss. Edit: also look how he's using 10mW red light laser while my facility uses 1mW for normal use xD

[@retr0.1337]

AllWave has probably the best fibers ever, you can literally bend them, they are from special material

[@1996BRECHT]

I'm pretty sure they have repeaters/amplifiers on long lines so the signal strength gets "corrected" on the way again, so unless these repeaters somehow also send their received signal strength back to the endpoint I guess it's going to be harder for the operator to detect?

[@steefant]

I would think so - it's necessary in cases of problems... you don't want to dig up tenths or even more of cable to find a problem.

[@1996BRECHT]

@@steefant fair point!

[@eikenope1008]

Amplifiers usually just amplify (multiply) the signal by a certain factor. So if your input signal strength decreases by 10%, your amplified output does so as well. Even if they had an automatic gain (adjust the amplification according to input signal strength), they'd have to measure the input signal strength and and then changes like a MitM attack would be reported from there.

[@steefant]

I googled a bit: usually the repeaters are capable of returning signal quality via a "supervisory signal" that is basically just a reflection of the input channel into the reverse path (cf. C-OTDR)

[@Nope24072]

Yes, they are using repeaters, which can feedback the Signal. Imagine the repeater would be the tapping device, no one would ever know

[@henno13]

You can buy physical optical taps on their own as well. Tapping your own network can be beneficial from a security perspective.

[@notdan]

What's the tap tool from Russia called?

[@lauej]

Honestly, you can do the same with regular wires (and always has been able to) , and this is one of the reasons that unencrypted connections are considered unsafe.

[@user-vn7ce5ig1z]

But the drop in signal strength would only be noticeable on the receiving end, at the sender. This tapping-detection would only be practical for closed-systems (mainly the military), not for general Internet customers. :-/

[@rkan2]

The operator usually provides the gear anyway, so it wouldn't be that difficult to implement.

[@lmaoroflcopter]

Signal strength is definitely a metric you can view on commercial network kit. That said... If you're actually monitoring that metric, you're going to be a certain type of customer.

[@guiAI]

So tapping the military isn't concerning?

[@lmaoroflcopter]

@@guiAI it's a known tactic (there are public designs of russian submarines that demonstrate under sea cable interception capabilities) but is of little concern considering all military communications are encrypted and all sides are at it. In other news. Your WiFi network traffic can be captured... and it's using considerably weaker encryption. Fibre for as "easy" as it is to use a microbend device to monitor the signal, I would still consider it more effort for a would be attacker to tap it. One requires you to delicately strip a glass fibre, bend it such that it leaks but doesn't break and monitor the signal using specialist kit that's capable of monitoring a signal waaaaaay below what a normal fibre transceiver module would work with. The other, requires a network hub.

[@guiAI]

@@lmaoroflcopter Interesting, the point of my comment was that tapping the military seems a bit more concerning than tapping a random house, but of course both are awful

[@gabiold]

I just understood why those splice boxes used. To quality control the links, make it deterministic how it behaves. No dangling fibers and undetermined bends that disturb the power.

[@eTzTheGamer]

Reallyloved this video, super fascinating! Would love to see more stuff like this in the future :)

[@smpolymen]

There are ways to explain that drop in power from the tap. If you tap in one place and "accidentally" cause a fiber cut in another, (like with a backhoe) the loss would probably be explained away as loss from the repair splicing.

[@claritytreinamentos]

This tapping would also work with the newer bend insensitive single-mode fiber?

[@Kocken87]

Still works, the loss of light or leak would be lower/require a more aggressive bend

[@TOAOGG]

Is there a reason for looping the cable inside the black boxes? Is it to limit their lenght or is there another reason?

[@tibuuso]

How would you capture the traffic on fiber?

[@vladomaimun]

So if an attacker wants to hide their eavesdropping they would tap some fibers and somehow bend all other fibers as well? To the operators this would look like someone simply bent the entire cable.

[@satibel]

You still see a sudden drop, unless you use a mechanism that closes slowly.

[@longnamedude3947]

@@satibel exactly, just close it VERY slowly, although I'm sure theres ways of calculating where along the cable the tapping/drop is occurring, and with that information you could easily find and removing the device trying to infiltrate the network.

[@gabiold]

@@longnamedude3947 Since it is probably possible, with those expensive test equipments shown, but I doubt that you can measure that on an operational link. You couldn't do on twisted-pair cables either, no built-in functionality in any device. The power drop, if logged long-term is still detectable, even is it is span few days. If you view a time series data, and change the time span of the view, you would certainly see the long term drop. Probably these cables moved very occasionally, it is expected that the link power is near constant, and I am pretty sure you will see a 4dB drop on otherwise nearly flat line.

[@longnamedude3947]

@@gabiold Yeah the drop long term would be noticable for sure. So an alternate method of interception would be needed in order to actually be of any use/purpose. I'm pretty sure these are things that someone somewhere has already thought about and has a potential method to.

[@minecrafter9099]

@@longnamedude3947 You can see where (exactly) there is a tap on the fiber quite easily, but the equipment (OTDR's) is not really that cheap, and i really doubt ISPs would even care about it

[@Veso266]

But can you the send a dhcp request to actually get a bit hugher level or is the signal that you send from your sfp module too weak?

[@goblinlordx6108]

I would be curious if the tap showed up on a time domain reflectometer.

[@MLGJuggernautgaming]

Don’t forget that the signal gets boosted over these undersea cables. They would only notice if they had hardware specifically checking for strength at points along it.

[@breakznenta]

They do

[@FalcoGer]

So typically how much data is transferred over such a fiber? I imagine those measuring instruments are highly specialized to deal with that data rate, and that only to show the presence of data. Probably using some sort of ASIC or FPGA. Typically on the other end of those fibers are massive datacenters to deal with the sheer volume. It's not like you can roll out to some field with your laptop and read out the fiber with some usb dongle with a 20MB/s throughput, or even if you have some sort of high speed capture device you'd rapidly fill up memory with traffic. In just a few seconds you'd have your ram full of gigabytes of data for you to analyze.

[@nusch_pl]

what's the name of fiber taping device ?

[@hikaru-live]

I wonder if you can try this: connect a computer to Internet using a stretch of fiber, then tap the fiber and hook that tap to another computer with Wireshark. This can demo how fiber tapping can be used to sniff network traffic.

[@nowaymuller6643]

Well first you have to put the light into Data...

[@synchro505]

Makes me wonder if the tapping device can also be made to boost the signal as well. Such a device (if it exists) would probably be very expensive.

[@Kocken87]

There are amplifiers that add energy to the light passing through, search for EDFA for interest. Erbium Doped Fibre Amplifier.

[@iBeFapping]

America in 2000: "Grow Rapidly in popularity over the next serveral years" Australia 2020: Laughs in Copper * I know we got nbn but majority is copper to the premises *

[@vrgpy]

You should had shown the effect in a OTDR as this a common tool in most networks.

[@MrNoobed]

My power meter has a little dish you can push the fiber into to find your tone. That would have shown it too. I kept expecting the otdr shot

[@Sipeari95]

He was using an OTDR that is what the EXFO device was.

[@MrNoobed]

@@Sipeari95 negative. That was a full bandwidth loss from a continuous wave source. See it measures the x axis in Thz, not ft or meters. If the exfo machine had an OTDR function available he didn't use it.

[@MrNoobed]

@@Sipeari95 the otdr would have been very useful here. With a launch cable and good cleaning you could get a good view of the exact position of the bend/device, and illustrate its effect on the signal in real time. Bends also show as attenuations of the otdr, not reflections. Maybe it's a health and safety thing

[@Sipeari95]

​@@MrNoobed No it would likely not. Most manufactures recommends a minimum length of 100m when measuring with an OTDR, at least all the EXFO OTDR modules compatible with the unit he uses in the video has 100m as their minimum range. A launch cable is used to get rid of the initial launch deadsone and is a must on any OTDR measurement, it will not help you get better results on short stretches of cables as it has nothing to do with why you would not get a good result. The reason for this is partly the deadsone you get with and OTDR pulse, even with shorter pulse-widths like 10ns the deadsone would still be 2 meters, if you have multiple events within the deadsone it will not be able to distinguish the different events from one another and will just add them together into one single event. In the video it looks like the cable he uses is around 5-10 meters so the OTDR would likely have trouble separating the events and would just add them together. There would also be ghosting when the signal bounces back in the cable, on such a short stretch it would likely bounce back through the entire cable multiple times and cause several ghosts to appear and would make it difficult to determine which events are real and which are not. It's true that good cleaning and an index matching fluid could help reduce the effects of the ghosting, but on such a short stretch it would likely still be a problem. Furthermore you would not be able to get a good view of what happens in real-time as running an active OTDR test relies upon averaging multiple pulses within a time-frame of typically 10-30 seconds and as such you would have to run one test before and one test after the device was attached. Yes, this would still show the difference the device makes but it would not do it in a way that is particularly suited for a video like this as you would just get a static screen with the results before and after You are correct that bends show up as an increased attenuation in the cable (typically measured in db/km), you should also remember that all OTDR measurements are done using the reflections from the initial pulse and so all measurements on an OTDR are of reflections. Again, the wiretapper would simply show up as a slightly higher db/km and would not really make for a good demonstration of how to check if one is installed. Edit: Just a side note here, i am not trying to say that he could not have used a active OTDR test here at all, he could for example have used two cables of 50m each between the wiretapper and then used a active OTDR test in the video. I'm just noting that the setup he has in the video would not work with an OTDR and that i think the setup used in the video provides better results for the purpose of this video. An active OTDR test is a great tool for troubleshooting cables, it is however not a tool that represents the data the ISPs would get from their active links in a good manner, i think that using a real-time signal as he does in the video is a much better way of demonstrating the effects of the wiretapper because any ISP would also just be dealing with received and sent power on active links. Sorry if i was a little unclear on what i was trying to get across here :)

[@merijn9342]

So you showed us how to tap it can you also explain how you read the data sounds very interesting!

[@vnikolayev]

Love it! Nice vid!

[@kanguruster]

"Such an old paper..." hahahahhahahah. Oh, you sweet summer child. This technique for tapping and associated countermeasures has been discussed since at least the mid-1980s.

[@LiveOverflow]

Ok boomer

[@kanguruster]

@@LiveOverflow Aw, you're just so precious! Such a joy for your parents, no doubt

[@tuke3541]

Isnt everything contained in that cable encrypted following the AES tho? So whats the point?

[@spoon_bomb]

"everything" ? Duh ...

[@knockhello2604]

@Ilham Ramadan is this just stealing Internet

[@tomsite2901uk]

What on earth gave you this idea?

[@tuke3541]

@Ilham Ramadan Ahh So Downloads are encrypted but uploads arent? Ok. Does this work the same way everywhere?

[@w4mb0-xoxo]

So, isn't traffic usually being encrypted between fiber-connected endpoints?

[@LiveOverflow]

It’s a service that some places offer. And banking regulations requires it. But it’s not typical. But of course higher layers of protocol such as HTTPS are encrypted.

[@geordish]

There exists things like MACSEC which will do that, however it requires specialised hardware, and may have an impact on performance of your router.

[@lcrazy8l]

These days yes. Relatively recent change though, for the most part everything was in the clear before Snowden happened.

[@vannilesoep]

Edit: I stand corrected, read the replies to this comment :) Soooo here's the cool thing about this. This is called 'evanescent coupling' . Massively oversimplified & in a nutshell, laser propagation through a fiber has a small portion traveling along the fiber, but outside of it, not in the fiber core itself. This portion of the light is called the evanescent wave. And if conditions are right and you place another fiber alongside, this light will couple into that fiber. If you wanna learn more about this, look for research papers or literature about optical coupling, fiber coupling, evanescent coupling, directional waveguide couplers etc. Now the cool thing about this? It works both ways. So I can imagine you 'tap' the signal, but you can just as easily introduce energie back into the fiber at the same wavelength. Energy-wise you could "feed" the sytem energy, which you just took away by tapping into it. This way you could migitate the drop in power. Not sure what would happen to the information send through the fiber though, whether you'd completely drown out the original signal, or if it would just be perceived as noise and the data could still be extracted, making it more obscured that there's an attack. I guess that mostly depends on networking protocols, which I'm definitely not an expert in :D Used to do research with this very phenomenon, except that we didn't try to do data-manipulation or stealing, but use the phenomenon to develop incredibly accurate sensors, by investigaging how changes in the environment of optical waveguides altered the properties of the transmitted signals.

[@bluerendar2194]

That's not actually the effect demonstrated here; this is a much more simple case of distorting the waveguide (fiber) enough that you get *real* waves now exiting out of it (using a bend), which is then recaptured as the "tapping" If it was evanescent coupling, there would be no light leaking out at the tap, only light leaking to the adjacent fiber

[@eikenope1008]

@@bluerendar2194 I don't think vanillesoep was suggesting that the demonstrated effect was evanescent coupling. Just that evanescent coupling could be an interesting alternative for the lossy tap demonstrated here. Physics sure is fascinating.

[@bluerendar2194]

@@eikenope1008 You're right in that it's a really interesting alternative, and also poses an in-built security risk due to crosstalk if isolation isn't properly done. However, his comment says: "here's the cool thing about this. This is called 'evanescent coupling' ." Which is not the case for the demonstration (although crosstalk from evanescent coupling is one of the headings in the article at the start)

[@vannilesoep]

@@bluerendar2194 You're completely right, not sure why I mixed up the two and rambled on about evanescent coupling. Thanks for correcting me. Point still stands that you can introduce a signal into the fiber that you're tapping into, whether by evanescent coupling or other methods.

[@사이보그-i6p]

How does it matter? The transportation is considered unsafe anyways, thats why u encrypt the traffic, or am i wrong?

[@PetWanties]

Awesome video!

[@sudorm-rf9032]

End cards don't seem to show up on this video...

[@ashleybyrd2015]

For me, end cards haven't been showing up on any of his videos for the past year.

[@alimohammadi1148]

Nice tapping

[@ericbower2256]

Cool, well done!

[@davidarchuletajr.498]

The place where the string is output at the end of the fiber cable (where it is just a strand and he connects the Russian tap device) - is that just for example purposes? So in real life wherever the cable is going would always be fully protected/wired right? Just curious because I don't know much about fiber. So to implement an attack like this you would pretty much always have to cut it open or use the split ends in the black box

[@niter43]

>the cable is going would always be fully protected/wired right? You can't fully protect a cable. Not like you're going to buy all land where it's laid, fence it and put security/cameras all over it, lol. >The place where the string is output at the end of the fiber cable (where it is just a strand and he connects the Russian tap device) As showed at 3:20 there's always boxes that contain bare strands. For what I know that's because you have to weld fibers together to make good passive (=> cheap) connection. After welding you're left with bare strands that are very fragile, so you coil them up (there's always some reserve lenght in case you would need to reweld them for some reason) and put in some box.

[@MrNoobed]

The cable is in one of the big black cases he indicated towards the beginning. Its physically protected from the elements, not from this sort of wire tapping.

[@GuyMassicotte]

In 1994 when I studied fiber optic and laser. Laser was bottleneck in speed. Its was more complicated to do fusion of tue optic to.

[@alexisfrjp]

It's even easier with copper, just need to touch them. Anyway, TLS/HTTPS is widely used.

[@davidunderdown8100]

.1 Decibels over a milliwat should set off an alarm and the OTDR knows the distance to the bend.

[@mrizkic]

Thats quite a lot of loss. The receiver might getting not enough signal. That easily make it suspicious. In dark fiber with long range this became more pronounced. But if it for short range it might not being detected. Thats why both end usually use enough signal power to transmit between two ends. So if some thing like this happens. We can use spare core to otdr the core if its being bended or not. If the spare core was fine they Usually will swap the core. But its tricky because it need both ends to swap. And the tapping became pointless.

[@mrizkic]

And for closed loop system this is pretty much a useless method. Because you will only triggrer operational maintenance people to check anyway

[@eyluismi168]

Really Interesting!

[@jamess1787]

Signal level would drop on a strand: any software monitoring the transceiver would report the anomaly. ... And I should have waited until the end of the video.

[@yumiwatanabe440]

there might be tap with amplifier which would require much less bending. so have fun try to detect those

[@christopherestewart]

You’d have to know what the original signal strength was. There are devices that can monitor the fiber and detect any tampering such as digging near the fiber cable or someone accessing the splice box/tray. The good ones can tell you where it is happening so you can dispatch police or security. Encryption is available to everyone and is highly recommended for sensitive information that you send or receive.

[@jamess1787]

@@christopherestewart AFAIK all optical transceivers support reporting of transmitted and received power levels. If (RxPWR.10111 < RXPWR. Then you likely have a problem.10111.avg(6m)*0.10)... 10

[@jamess1787]

@@yumiwatanabe440 good luck getting an amplifier in the circuit without disrupting the connection. Plus, the iridium doping and amplification should be on the far ends of the link... Not anywhere between.

[@foxrumor]

@@jamess1787 he was referring to amplifying the captured signal, not the signal in the line. Basically, this would allow for less of a bend and create a less noticeable power drop.

[@smyaknti]

I thought this would have some other sorts of physical attack vectors dicsussed instead of this simple physics phenomenon. Like what sort of stuff comes next? Cause injection is kind of impossible, can we obtain any other information?

[@MrNoobed]

You would probably want two taps to capture send and receive fibers but you could then watch the whole tcp/ip connection then. Injection would be pretty tough. A laser powerful enough to get in through the -34db would just burn the cladding off.

[@mattfowler6504]

It doesn't seem very likely an attack like this would happen. Is there any documentation of one of these attacks?

[@soundscrispy]

www.theatlantic.com/international/archive/2013/07/the-creepy-long-standing-practice-of-undersea-cable-tapping/277855/

[@mattfowler6504]

SoundsLikeCrisps that's pretty insane

[@Airman..]

Cool tech thanks for sharing

[@hussienfaour2066]

cool, thnx for those informations u shared!

[@jimothyus]

Superb video.

[@BDBD16]

Had a client build cabinetry around an exposed fiber run. The pinch/bend was a bitch to find as it was behind the wood.....

[@Stoney_Eagle]

The cables that are being layed a few years ago in the Netherlands are in fact empty tubes. When you are the first subscriber of FTTH in that house your ISP sends a guy from the company that owners the fiber network and they will shoot a fiber to your home trough the hollow tube that is assigned to your home.

[@ThorNado77]

That's only true for some parts of the country. (Amersfoort, Nijmegen, and Rotterdam are a few that I know of) The system you're describing is called FlashNet (exists in both optical and electrical variants) In other parts of the country complete fiber lines were put into the home, pre-populated and spliced, and when you got a subscription, someone from the fiber company showed up and just placed the NTU (the fiber converter) in your house, and activated the line in their central office. (KPN did this a lot, a lot of fibers were even connected to active equipment, but just turned off)

[@Stoney_Eagle]

@@ThorNado77 The previous resident of my current and pervious home did not allow for the installation of the fiber. The guy welding the fiber told me that without a pending subscription there is only a hollow tube to safe money but still allowes for one day installation. The owner of the fiber network was Reggefiber but is now owned by the ISP KPN... (Good thing we have a no monopoly law) I think you mean FTU (Fiber Termination Unit)

[@ThorNado77]

@@Stoney_Eagle indeed, I meant the FTU, that was put into my home, but complete with fiber, in my hometown there are no hollow pipes, they are all laid with fiber in it, and the FTU mounted with an empty cover. When you subscribe to a fiber service, they remove the empty cover on the FTU, and mount a NTU (network termination unit) on top of the FTU, which converts the optical network to electrical. (RJ45 jack, in the early years combined with a coax output for TV, but nowadays they omit the coax output, and use IPTV.

[@retr0.1337]

hah we've got the same otdr as he do in school, funny thing about this is you are not going for fraction of light, the ligh is disperzered from the bending which is causing literally the same signal witch is being transfered, its so called listening, cuz the bending literally cause the fiber to expose the infrared signals for monitoring, also, don't look at your optics if the light is coming out, you can lose ability to see with one eye, or more.

[@hshhsjhahsvs7728]

NSA has joined the chat

[@Rhys_Beer]

What does Dbm stand for?

[@MrNoobed]

Decibels metallic. It can be converted to watts of laser power. If you have a +7dbM source, and it goes through a cable of some unknown length and loss, and you measure it on the other end at 0db with the same setup, then the cable caused a loss of 7db.

[@patricksullivan9951]

Mr Noobed hasn't got a clue, I've been certified and installing fiber for last 20 years. dBm stands for decibel milliwatts. dBm can be used in radio, microwave, and fiber-optical networks as a measure of absolute power because of its capability to express both very large and very small values in short form. The closer the number is to 0, the better off your signal strength is

[@GG-ec5eg]

a dichroic beam splitter will help anyone that is sick of the peeping tom , putting a delay on it also helps , or have some fun and route to a slave setup that is pre configured in a way that time scale shows the future but hard to detect but once found the peeping tom would somehow manifest he or she has jumped time a bit just make sure the slave setup has many baits to promote that theory and would need to back the time delay into a stutter , for full effect . lol i gotta get a hobby but hey this sounds fun a bit

[@ashleybyrd2015]

I swear I must be tired as heck or you're speaking Español.

[@Pocketninjanight]

that's crazy I had no idea how vulnerable fiber is

[@NathanM229]

Hi LiveOverflow, these cables contain millions of active connections. What protocols are used to carry this amount of data? I understand TCP/UDP, I don't understand how one cable can carry so many of these connections without some sort of master protocol. Thanks Maybe you could try intercepting a live video feed over UDP, that would be a great proof on concept

[@red13emerald]

FKM For every connection you just use a different frequency of light.

[@SuperSpecies]

These days it is just ethernet protocol. In the old days sonet/sdh were used

[@kolliden]

When is the 8 Bit Computer gonna be finnished?

[@FalcoGer]

Wow. A metal ring, a case and a spring to bend a fiber cable and push it up against some manner of optics to direct leaking light into another fiber. Clearly something you'd pay 2000 bucks for. WTF?! That seems like something that costs 20 bucks maybe. And that only because it's special equipment and wouldn't be made in bulk. Why is it so expensive?

[@alexsinclair2012]

Precision manufacturing, And niche market. People will pay that kind of money for a tool like this. Wild how Russia and other eastern European countries manage to make these devices for a lower cost. Russia is also quite on top of data recovery as well

[@sandipndev.personal]

What if the tapping device senses the brightness of the input, taps it and amplifies it to the same level? The tapping would go unnoticed then.

[@jameslowell9656]

Match something perfectly moving at the speed of light? Best way would be to make very sensitive tap that would need very little light bled off so the drop in intensity would not be noticeable or to relay the signal after capturing it but this would have some lag and would probably be detectable.

[@sandipndev.personal]

The lag will be only once, first time. We can get the brightness and set the amplifier accordingly. After that, all the data could be tapped.

[@jameslowell9656]

@@sandipndev.personal you arent amplifying it then. You are merely repeating the signal.....

[@sandipndev.personal]

@@jameslowell9656 can't I just tap the signal and amplify it, realtime?

[@jameslowell9656]

@@sandipndev.personal its moving at the speed of light ? So no you definitely cannot just add in the light you took out to the native signal instantly. There will always be lag trying to do that. We just don't normally care about a few milliseconds of lag in the vast majority of applications amplification is used. But here they would be able to ping the line and know the signal is being delayed. If it wasnt something that was being actively monitored that would be fine , otherwise you would need to use minimally invasive passthrough capture like in the video.

[@Burnstation3D]

this is not tapping like a landline (copper), this just a exfo OTDR reading light waves for testing fiber links(with an accessories)...common gear in fiber splicing world

[@JoelBergmark]

2002... At that time we had 10Mbit symmetrical FTTH in North of Sweden, just because Germany and US is sooo far behind on optics does not mean others are/were...

[@koreanG6]

Naisu content

[@justicesportsman6020]

Why is that taping device so expensive? Isn't it just a mechanical device? I wonder if this can be 3d printed. I think it would be smart to bend the fiber less and make the taping active with some amplification. It'd cause a smaller drop in signal strength on the other end so would be much harder to detect. Fiber output boosters are expensive but I'm sure a simple circuit with a high frequency vacuum tube might work, if not maybe a garnet laser for amplification.

[@DawnnDusk-k4n]

Come on bro. Its Jan 17/2020 Could you post a video please?

[@ramzi-sah]

amazing !

[@salahmunasar4686]

What is this device is cost for 300$ Also should you share with me some concept of that device

[@krass76]

couldn't you make a powered tapping device with a sensor and a laser that just adds the lost light back in? surely you could calculate for the given radius how strong the laser would need to be...

[@MrNoobed]

You cant inject more light because the laser you would need to do that would be so powerful it would destroy the fiber. If the light they get out is -34db, then it's doing to take at least +40 db to get a signal in. That's a 10 watt laser. The cladding around the fiber would burn away under a few seconds of that, then the link would go down as if the fiber was cut.

[@krass76]

had no idea the lasers used were so strong... maybe an external coupling made of glass could overcome the "resistance" due to refraction to get a signal back in? maybe with a very transparent glue for air-gap-elimination? but then you'd also have to worry about the exact frequency and phase of the laser, making it more complicated..

[@MrNoobed]

@@krass76 the fiber had a coating on it that keeps the original laser it. It's fine at a normal power level. But getting through from the outside, I cant imagine a good way to couple back in to the fiber. Even if you encase the bend in a resin matched the index of refraction... I doubt it. Would love to see the NSAs papers about it though

[@MrNoobed]

@@krass76 and rather, the normal laser is like +12 db or something, but that's okay because it's got a proper connector on it and its pointed down the fiber the right way. You would only need the 10 watt laser if you were trying to go back through the tap they got set up

[@krass76]

thanks man, fascinating stuff! would of been strange if "some random guys in the youtube comments" could solve this :D

[@bap9394]

This is why you always keep Fiber Space Layout Randomization enabled 😂

[@turretjust6426]

it sound okey but decrypting is harder . there is no hardware solution to understand transfered data ,.even if you record it and put it in “same model modem” , you wont be able to capture login interface log of modem(decryptor) . only information getting from it is ; if user using it or not , do network camera going out or not . when you return home , can you try decryting your own internet data between computer and modem ?( by putting another device between your computer and modem ) ( or using network device , copying internet module id ) have a nice day , i like your videos ;) edit: Leonardo D. i personaly know that there is no proccesing power that can decrypt the data that changes pppoe interface every milisecond with ppp access key (most cases user name and password hex blup .) . if it transfers regular data format , you could capture and save that data . but it is not :) . best option you can do is truing to get ppp key and emulate that modem’s secure connection . cutting electric connection of modem and capturing first login of modem many times and compare these would be fastest way ... edit2: cryptology is big hobby of mine . I would like to talk and share it ;) my discord thebot#9942

[@gabiold]

Please rephrase that YOU don't have hardware solution. 😉 Do you think that anybody about to carry out this kind of attack hasn't prepared a device already? I am not this kind of an engineer, probably many of us isn't, but if someone dig into this field, I am certainly sure that he could get the data stream out of it. And it would be interesting to know, how much low level encryption is used on these links. Probably not too much. The end user's SSL connections are still encrypted, but a lot of auxiliary traffic isn't, I guess.

[@lddutra]

There is no hardware YET. Don't doubt about the infosec hardware manufacturers xD

[@satibel]

Afaik optical fiber uses the same atm protocol as regular dsl, so once you turn back to an electrical signal, you should be able to use it the same way (extract the 48bit payloads an stitch them to get the pppoe data, which in turn can be converted to ip.) I'm not 100% sure stuff still works like that, but I'm pretty sure that works similarly, maybe with different protocols but I don't think any of the civilian grade stuff is encrypted below the tcp/ip layer. Still, seeing it done might make a fun video.

[@gabiold]

@@lddutra Boys, this info is new only for us. Don't you think that russian tapping tool is exists for a reason? And it is sold to a civilian? This attack is probably known since fiber optics invented and probably tools already available. 😉

[@siteking4289]

@@lddutra You don't need "that special not yet developed" hardware. You only need software as the tap device already puts out the same signal going through the cable..

[@runforitman]

Hey! You forgot to put your end cards on!

[@CODDKP]

dunno where were you, but for high speed with fiber, you shouldn't bend it more than 45 degree and i see a lot of 90/180 degree bend .....

[@MrNoobed]

That's why it's a 3 db loss

[@pierredonias8940]

Wouldn't a device be able to slightly increase the amount of light behind it to hide itself?

[@ashleybyrd2015]

I'd assume so, It'd probably increase the delay though.

[@eikenope1008]

@@ashleybyrd2015 Yes, optical amplification usually needs about 30m of erbium doped fiber that introduces about 150ns of latency. This would definitely be noticeable the moment you introduce your device. I don't know if it would be noticeable afterwards, if you can't use test equipment that interrupts service.

[@geekofia]

This was a rich content :)

[@deadboy7337]

Can this type of attack even be possible to steal internet?

[@seanwagner6870]

"stealing internet" as in getting internet free free?

[@geeemmz4823]

@@seanwagner6870 i think, yeah

[@geeemmz4823]

@@seanwagner6870 i think, yeah

[@synack_]

No. You’re not injecting any of your own network traffic, you’re only monitoring someone else’s traffic.

[@deadboy7337]

@@synack_ no I mean some isp provide internet through fiber optic can someone splice and split the connections going to their modem and 1 going to the owners

[@rsnilssen]

If someone tapped our fibers in this manner, we would notice, a drop of 3dB is huge

[@MeaNDeropph]

to be fair this taping device was most likely produced before the NSA article was published .. nowerdays there is no need to bend the wire as much as this device did..

[@rsnilssen]

@@MeaNDeropph Agreed. Practical experience shows that there's a huge number of reasons for loss in longer fiber circuits, ranging from patches being touched/moved, work in spliceboxes leading to bends, pinches and sometimes even damage, stretching/bending/squeesing of trunk-cables and much more. Usually we would not care about a change (predominately increased) in loss of 0.5dB or less, unless we're on a tight signal budget.

[@grubzer1369]

The fact that they got 2000$ wiretapping device from russia for 300$ and the fact that we have some laws that are being made to isolate our internet sector amd analyze any outcoming traffic are kind of terrifying

[@satibel]

And I could probably 3d print one for 2 bucks.

[@DarkIzo]

@@satibel you could print the case, but not the stuff thats worth 295$

[@satibel]

@@DarkIzo you could print the bending part, and have a working one, but you'll probably be getting bigger losses, there's a prism which costs the price, but you could just use the output fiber pressed directly against the tapped fiber with some index matching paste.

[@90hijacked]

Better than reselling krokodil don't you think?

[@franmajdak4069]

Nice

[@WhiteMatrix1]

The tumbnail looked like a The 8-Bit Guy's video :)

[@Verrisin]

Why should I mind someone can tap fiber? Don't get me wrong, it's interesting, but: I implicitly assume that all packets transmitted over public networks are visible to anyone. ... hmm... I guess it could be important for LAN I trust... but I've never seen in practice LAN that needed optic fiber... although...

[@Verrisin]

but, yeah: I never knew you can tap an optic fiber like this, very interesting - Very surprising was how much the signal strength dropped...

[@Verrisin]

oooh, the military.... - That didn't even occur to me: I just read it in another comment.... - And obviously, other such networks...

[@nowaymuller6643]

I use Fiber Cable in our House just for Galvanic Isolation.

[@Verrisin]

@@nowaymuller6643 Another interesting use... but I guess that's just somewhere inside, and hard to access to tap (unlike some station/cable outside)

[@nowaymuller6643]

@@Verrisin sure. Its just my major use for the Glas Fiber Cable. I also use USB over Glas Fiber.

[@blakryptonite1]

Would using a VPN and regularly changing the location make tapping useless?

[@privateger]

You'd just be shifting the problem from your fiber to the fiber the server is on. It might even increase the risk.

[@blakryptonite1]

@@privateger yea but could they break the encryption? And if I change the VPN location every few hours or so, would they go ahead and tap all those locations in time?

[@privateger]

@@blakryptonite1 You misunderstand my comment. All a VPN truly does is take your packages, put them into a box, encrypt that box with a key and send it to the server. The server decrypts it, forwards your packages and replies with more boxes of responses. You're shifting security issues from your connection to the servers connection. VPN encryption is **never** end to end, it's only as secure as the weakest link. Well, your second question depends entirely on whether you are truly an important target. If you are, you can bet three letter agencies *will* find a way to get your data.

[@eikenope1008]

Depends on the protocols used for all of your communications. Some ISPs encrypt fiber traffic, so regardless of using HTTP vs HTTPS or a VPN, this attack does not work. If your ISP doesn't encrypt the traffic through the fiber, HTTPS prevents sniffing/MitM. If you don't use HTTPS, but have an encrypted connection to your VPN, that traffic is safe, but the traffic from your VPN to the Server is not.

[@synack_]

You seem to have a misunderstanding. From your comments it seems you think that if someone wanted to tap your connection he would pack his tapping gear up and travel to the physical servers that these VPNs use to route your traffic. From there he would listen in on your connection. But that’s not what would happen. Regularly changing the VPN location would have zero effect because if someone wants to listen in on your connection, they will listen in somewhere along the path between you and your ISP. Using a VPN does not cut out this essential first part of the journey. All of your home network internet traffic will go to your ISP first for routing; Using a VPN will only change where that traffic is initially routed to.

[@elukok]

Well since all of the communication running through the wire should be encrypted anyway, this would probably not help you that much to get to something sensitive.

[@VagabondGFG]

From Russia with love.

[@prakharmishra3000]

Here in India, these wires and boxes are hung up on poles, not underground...

[@Dev_skoll]

Loose some of those patches, those take away a little at each.

[@lmaoroflcopter]

Ah....memories of playing with rather expensive optical only switching systems.

[@shangolkhaniannian4649]

great vid but wish it was a a bit less complex than this

[@RandoYoutubeViewer]

Ganging uou with NOC guy :P

[@Davi-c4q]

Next step: create a tapper device that detects the original strength and corrects it after tapping.

[@hyronharrison8127]

Heavens that would be extremely difficult without delay...

[@justicesportsman6020]

It would be impossible to detect the original strength without cutting the wire and causing disruption to the network. Also you'd need to know the length from the tapping point to the termination point.

[@TheMBernhard]

@@justicesportsman6020 I don't think that is correct, but please correct me if I don't get physics well enough. You can probably test your tapping device before you deploy it. Say your original signal has 100%. After you install your tapping device, the output is 60%. That means you need to boost the signal by 40%, to receive the full 100% at the end again. You can get how much light that is equal to, by measuring the intensity in the tapping device itself. In this case you measure 40% in the tap that you need to boost the signal by. But like I said CMIIW.

[@justicesportsman6020]

@@TheMBernhard ​ Well, let's first ignore the fact that you would need to detect the signal, produce one that matches at the proper amplitude and pipe it in before the photons whiz by. There's a lot of variables that need to be accounted for. If the taping device is consistent (which it's not, it reduced the signal differently both times they tested it) and always reduces the signal by the exact same % for all frequencies, amplitudes, and for both multi mode and single mode fiber it could work. You can also test the device with each type of cable/frequencies and make a table that could help. In the end even if you could get the same exact signal strength without adding latency after the taping this could still be detected with this method (I believe). The signal comes dispersed (modal distortion) bending the cable pulls out the highest order modes, which could be detected. I'm interested on your take on my other comment though. This link will highlight my comment kzbin.info/www/bejne/hpPMoZicrsuehLs&lc=Ugx4pCzivKZb2qfpNUZ4AaABAg

[@TheMBernhard]

@@justicesportsman6020 sorry, I am on mobile. Will try to check it out tomorrow. If it is the bending less approach, i am all for it. I was also thinking about total reflexion by bending the cable even more. Then you could extract the signal, boost it and feed it back into the cable. This way, the spectrum should look identical and only the point until total reflexion kicks in could be detected. But since most systems are erroneous, I guess noone would even care about a single fibre showing problems in a log. Why the taping reduced the signal differently each time, I don't know, but since parts of the cable are fully exposed and they had to change connections, I am not really surprised, either.

[@dylonparsons2197]

Hello, You are using Fiber optic. I actually work on cellular towers. Fiber optic is used for 4G-5G

[@dylonparsons2197]

The fibers are actually glass as well. Break easy.

[@dylonparsons2197]

And the Exfo gear is not cheap! We use that to test before we turn the site up.