Eight Myths about Hacking Fiber Networks

---

When people think about hacking, they might picture the hooded individual locked away in their bedroom remotely entering passwords. Or perhaps the shady character on the street corner using a smartphone to access private Wi-Fi signals.

But what about physically hacking the fiber optics network itself? There are millions of miles of such cables snaking across the globe. Are these vulnerable to tampering? The answer might surprise you.

After all, aren’t fiber optics hidden deep underground, far out of reach? Even if hackers could access the physical fiber cables, wouldn’t they need special equipment? And surely these networks are closely monitored and a breach would be quickly spotted?

This article looks at these and other myths that lead us to believe the fiber network is more secure than it really is.

Myth 1. Hacking Optical Fiber Is a Myth

Some people simply don’t accept that hacking fiber networks happens outside of Hollywood. Citing many of the reasons below, they claim that it is an urban myth with no basis in fact.

That might help them to sleep easier at night, but it is important to be aware of threats before we can tackle them. The ability to hack fiber optic cables is not only possible – it has been clearly demonstrated in easily accessed videos online. There are also plenty of case studies available for anyone to carry out their own research.

Myth 2. Hacking Optical Fiber Requires Sophisticated Skills

Hackers are often portrayed as highly intelligent individuals with advanced technical knowhow. Many cybercriminals do fit this description, but the skills needed to hack a fiber network do not require such sophistication.

In fact, a cybercriminal would probably work more efficiently by training an accomplice to perform the manual fiber hacking while they focus on managing the software that makes sense of the stolen data.

Myth 3. Hackers Use Highly Specialized Equipment to Hack Fiber

The equipment required to hack an optical fiber network is just as basic as the knowledge. Adequate results can usually be obtained using just a clip-on coupler, some CAT 5 or 6 network cable and network analyzer software. In some, more advanced attacks, the cable may actually be severed and the ends connected via a hub, but this is probably the most advanced piece of kit a hacker will ever need.

Myth 4. Fiber-Hacking Tools Are Only Available Illegally

Following on from the previous myth, if you thought that the tools and software needed for a hack would have to be obtained via some clandestine area of the dark web, think again! Network analyzer software, such as Wireshark, is legitimately used by IT professionals, while couplers and cable are part of every cable installer’s toolkit.

Myth 5. Hackers Are Unable to Tap Fiber From Inside an Office

Could your company be at risk of insider cybercrime? Fiber optic junctions are widespread in large offices and consist of numerous cassettes housing fiber optic couplers. Placing a wiretap on the network isn’t as complicated as some might suggest as explained by well-known hacker Kevin Mitnick in this video.

Myth 6. External Fiber Optic Cables Are Hard to Detect and Reach

It would clearly be very difficult to dig up large sections of highway or sidewalk without attracting the attention of the authorities, but cable networks often pass through unpopulated, rural areas.

In fact, in some areas of the country, signposts have been erected to ensure people don’t accidentally damage cables.

Not even undersea cables are completely safe. Some submarines are designed with special apparatus for accessing and manipulating these for purposes of international espionage.

Myth 7. Businesses Would Be Aware of an Intrusion Through Signal Weakness

In the early days of fiber optic transmission this may have been the case, but networks are now so tolerant to light loss that an astonishing 8dB of information can leak out before the end user notices there is a problem. It is similar to a household plumbing system which can cope with quite a significant leak before the householder notices anything is amiss.

Even a basic fiber optic hack won’t come close to matching the general data loss that happens over the distance from source to destination. The most intricate equipment may only cause around 0.5dB data loss.

Although intrusion detection software is available, it may not be sensitive enough to pick up on a breach.

Myth 8. Hacking the Fiber Network Is Theoretically Possible But Never Happens

The history of hacking optical fiber makes for an interesting read. Since the 1990s there have been numerous examples of the practice:

• Countries such as France and North Korea have been caught hacking the network for purposes of industrial espionage
• Al-Qaeda has eavesdropped in on conversations between the U.S. and embassies
• In 2000, Deutsche Telekom’s three main trunk lines were breached
• In 2003, Verizon’s optical network was accessed by a device believed to have been used for accessing sensitive financial data

Two Things Businesses Can Do About Fiber Hacking

Although it is virtually impossible to protect cable networks from hacking, it is fairly simple, in most cases, to make hacking your data stream pointless. IT and cloud consulting services can help businesses to put robust encryption in place so that data is protected ‘in-flight’ rather than just when stored on servers and devices. Whereas a standard email message using POP3 can be easily read via a network analyzer, an encrypted message will deliver useless gibberish to the hacker.

If you operate in certain locations, you may also be able to invest in ownership of your fiber optic supply, giving you the option to physically secure and closely monitor your data stream.

Due to the surplus of fiber, particularly in major cities, many businesses are now customizing their own physically secure, managed networks via so-called dark fiber procurement. Specialist companies can act as brokers to help businesses take complete control over the design of their network.

As emphasized in the STOP. THINK. CONNECT.™ campaign, personal information is like money and should be treated as such. Since businesses deal with other people’s data, they should be doing all they can to protect it while ensuring their eyes are continually open to all types of security threat.