🔬 applied physics

Reflecthernet: Exfiltrating 100BASE-TX Ethernet Traffic Using a Retroreflector Hardware Trojan

This paper demonstrates the feasibility of exfiltrating 100BASE-TX Fast Ethernet traffic by designing and implementing a compact, passive hardware Trojan that uses radio-frequency retroreflection to covertly modulate and recover MLT-3 encoded signals without emitting its own signals.

Original authors: Pierre Granier, Matthieu Davy, Philippe Besnier, François Sarrazin

Published 2026-05-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Pierre Granier, Matthieu Davy, Philippe Besnier, François Sarrazin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: The "Silent Spy" in Your Network Cable

Imagine you have a secret conversation happening inside a room. Usually, to listen in, you need to be very close, have a super-sensitive microphone, and hope the walls are thin enough to hear through. This is how traditional "eavesdropping" works on computer networks: hackers try to catch the faint, accidental radio waves that leak out of cables.

But what if you could install a tiny, invisible device in the cable that doesn't speak at all? Instead, it acts like a mirror.

This paper introduces a new type of spy gadget called a Retroreflector Hardware Trojan. Think of it not as a radio transmitter, but as a smart mirror hidden inside your Ethernet cable.

How the Attack Works: The Flashlight and the Mirror

The paper describes a three-part game of "Flashlight Tag" between the attacker and the target:

The Flashlight (The Attacker): The attacker stands outside the room with a powerful radio "flashlight" (a signal generator). They shine this invisible light at the target's computer cable.
The Smart Mirror (The Implant): Inside the cable, there is a tiny, battery-free device (the Trojan) made of just two tiny diodes and a couple of resistors. It's so small it fits inside the cable's shielding without anyone noticing.
- When the computer sends a "0" or a "1" through the cable, this device instantly changes how it reflects the attacker's flashlight.
- It's like a mirror that tilts slightly left for a "0" and slightly right for a "1." It doesn't make its own noise; it just bounces the attacker's light back in a pattern that matches the secret data.
The Catch (The Receiver): The attacker catches the reflected light with a special receiver. By analyzing how the light bounced back, they can reconstruct the secret data that was traveling through the cable.

The Challenge: Speeding Up the Mirror

Previous versions of this "mirror" attack worked well on slow things like old keyboards or video cables. But this paper tackles Fast Ethernet (100BASE-TX), which is much faster and uses a complex language called MLT-3.

The Analogy: Imagine a normal cable uses a simple "On/Off" light switch (like a Morse code dot or dash). The old mirrors could easily copy that.
The Problem: Fast Ethernet uses a three-step dance: High, Medium, Low. It's like a traffic light changing colors. If you just put a simple mirror there, it would get confused and lose the message.
The Solution: The researchers built a new "mirror" that looks at the difference between the wires. It effectively turns the complex three-step dance into a simple "Is it moving or not?" signal, allowing the mirror to keep up with the high speed.

The Decoder: Fixing the Static

Because the signal has to travel through the air, bounce off a tiny mirror, and come back, it gets messy (like trying to hear a whisper in a windy storm). The paper describes a sophisticated software pipeline to clean up the noise:

Finding the Pattern: The software knows that computers send specific "idle" patterns when they aren't talking. It uses these known patterns to synchronize its clock, like a conductor finding the beat of a song.
The "Hotspot" Map: The software looks at the incoming signal and groups the data points into two "crowds" (one for 0s, one for 1s). Even if the data is blurry, it can tell which crowd a point belongs to.
Error Correction: The system knows the rules of the Ethernet language (4B/5B encoding). If it sees a word that doesn't exist in the dictionary (an invalid code), it guesses the most likely correct word based on the surrounding data, much like autocorrect fixing a typo.

The Results: How Far Can They See?

The researchers tested this in two places:

A Soundproof Room (Anechoic Chamber): Here, they proved the concept works perfectly with high power.
A Real Office: They set up a laptop and a Raspberry Pi on office tables. Standing 3 meters (about 10 feet) away, they successfully intercepted the data flowing between them.

They calculated that if they used a much stronger "flashlight" (more power), they could likely extend this range significantly, though they noted that too much power might blind their own receiver.

Why This Matters (According to the Paper)

The paper argues that while we encrypt our internet traffic (like using HTTPS), many internal networks (like those in offices or factories) still send unencrypted data. This attack proves that even if a cable looks secure and shielded, a tiny, invisible "mirror" can be planted inside it to steal data from a distance, without ever needing to plug into the network or power the device.

In short: They built a tiny, passive mirror that can be hidden in a network cable, allowing an attacker to "read" the data flowing through it by shining a radio beam at it from a few meters away, even on high-speed connections.

Technical Summary: Reflecthernet

Problem Statement
Electromagnetic eavesdropping (TEMPEST) is a known threat, yet passive attacks are often limited by weak, noisy signals and environmental dependencies. While Hardware Trojans (HTs) offer a more controlled exfiltration vector, active implants require power and are easily detectable. Radio Frequency Retroreflector Attacks (RFRAs) address this by using passive, unpowered implants that modulate the backscattering of an external signal based on target data. However, prior academic demonstrations of RFRAs have been restricted to analog interfaces (e.g., VGA) or low-speed digital links (e.g., USB, PS/2, 10BASE-T) with simple binary encodings and symbol rates generally below 50 MBd. High-speed digital links, specifically 100BASE-TX Ethernet (Fast Ethernet), which utilize complex Multi-Level Transmit-3 (MLT-3) encoding and higher symbol rates, have not been successfully targeted by this technique.

Methodology
The authors present "Reflecthernet," a framework designed to exfiltrate 100BASE-TX Ethernet traffic using a custom retroreflector HT and a high-speed interrogation pipeline.

Implant Architecture:
- The HT is a passive implant embedded within the differential pair of a Cat-5 (or higher) Ethernet cable.
- Unlike previous binary-targeting implants, this design addresses the three-level MLT-3 encoding (–1, 0, +1). It employs two Schottky diodes (BAT63-02V) of opposite polarity connected to the differential lines ( $D+$ and $D-$ ) via series resistors (620 $\Omega$ ).
- This configuration allows the implant to conduct when $|D+ - D-| \neq 0$ , effectively converting the three-level MLT-3 signal into a binary impedance change (conducting vs. non-conducting) that modulates the reflection coefficient of the cable's shielding (used as an improvised dipole antenna).
- The implant is physically small (approx. 2mm x 0.9mm x 1.25mm for the diode package) and can be hidden within the cable shielding.
Interrogation Setup:
- The attack utilizes an RF System-on-Chip (RFSoC) evaluation board (ZCU111) capable of gigasample-per-second (GSa/s) rates, overcoming the bandwidth limitations of standard Software-Defined Radios (SDRs).
- The setup includes a high-power transmitter path (up to ~17 dBm) and a sensitive receiver path with low-noise amplifiers (LNAs) and high-pass filtering to suppress carrier leakage.
- Illumination and reception occur at frequencies between 300 MHz and 1 GHz, with a sampling rate of 1.6 Gsp/s to capture the 125 MBd symbol rate of the target link.
Data Recovery Pipeline:
- Demodulation: The system recovers the absolute differential voltage $|D+ - D-|$ by analyzing the distance of received samples to "hotspots" in the complex plane (using Gaussian Kernel Density Estimation) or via a trained Support Vector Classifier (SVC).
- Synchronization: A Linear Feedback Shift Register (LFSR) sequence (polynomial $x^{11} - x^9 - 1$ ) is used for scrambling. The authors synchronize the receiver by exploiting the known "IDLE" state (continuous '1's) transmitted during inter-packet gaps (IPG) to reconstruct the scrambler state.
- Decoding: The pipeline reverses the MLT-3 encoding, descrambles the bitstream, and applies 4B/5B decoding.
- Error Correction: A custom pipeline detects invalid 4B/5B codes (which occur due to radio channel noise) and attempts to correct them by mapping them to the nearest valid neighbor based on confidence metrics derived from the sample distances.

Key Contributions

First RFRA on Ethernet: This work demonstrates the first successful retroreflector attack on a 100BASE-TX Ethernet link, extending the applicability of RFRAs to a 125 MBd symbol rate—an order of magnitude higher than previous digital link attacks.
Novel HT Architecture: The design of a two-diode structure capable of discriminating and modulating MLT-3 signaling without requiring power or complex logic.
High-Bandwidth Interrogation: The use of an RFSoC platform to support the high sampling rates required for Fast Ethernet, moving beyond the capabilities of typical SDRs used in prior literature.
Protocol-Aware Error Correction: The development of a demodulation and decoding pipeline that leverages the specific structure of the 100BASE-TX protocol (4B/5B encoding and IDLE patterns) to reconstruct the scrambler state and correct bit errors, enabling reliable data recovery despite radio channel noise.

Results

Performance: In a controlled anechoic chamber environment, the system achieved near-complete data recovery at a distance of 4 meters with transmitted powers up to 17 dBm.
Real-World Validation: The attack was successfully replicated in a standard office environment at a distance of 3 meters with 13 dBm illumination power. Under these conditions, the Bit Error Rate (BER) was maintained below 0.1.
Data Recovery: The pipeline successfully reconstructed full MAC-layer Ethernet frames, including IP headers and payloads (demonstrated using ICMP echo requests with specific padding). While some byte-level errors remained, essential information such as MAC addresses, IP addresses, and payload patterns were clearly readable.
Range Estimation: Using the radar equation, the authors estimate that doubling the range from 3 meters to 6 meters would require a 12 dB increase in transmitted power (approx. 25 dBm), limited primarily by receiver dynamic range and saturation.

Significance
The paper asserts that Reflecthernet demonstrates the viability of retroreflector attacks against high-speed, complex digital links previously considered resistant to such techniques. By successfully targeting 100BASE-TX, the work highlights that even modern, high-speed network interfaces are vulnerable to passive, unpowered hardware implants if physical access (e.g., supply chain compromise or "evil maid" attacks) is possible. The authors note that while encryption (TLS, MACsec) protects payload content, unencrypted legacy protocols (e.g., HTTP, NFS, DNS) and lower-layer metadata remain exposed. The study concludes that the combination of widespread Ethernet deployment and the ability to exfiltrate data at 125 MBd significantly expands the attack surface for RFRA, necessitating a re-evaluation of physical security assumptions for network infrastructure.