Testing Non-traditional Data Transport via RF
In high-security environments, standard data transport over common network protocols is often monitored by sophisticated EDR and DLP systems. Mycelium provides a novel way to test these systems: transmitting data over low-profile RF bands using in-memory obfuscation to evaluate a network's true electromagnetic visibility.
The Strategy: RF-Based Transport Channel
We will build a tool that listens on a local TCP port for data from a test system, applies a basic XOR obfuscation layer, adds a decoy header, and transmits it via a low-power ISM transmitter.
Step 1: Ingesting Data
We use the TCP_Receive action to pull data into Mycelium's internal buffer.
Step 2: In-Memory Obfuscation
To prevent the signal from being easily decoded by a standard SDR scanner, we apply an XOR mask to the entire buffer. This happens entirely in memory before the data ever hits the airwaves.
Step 3: Decoy Header Injection
To further hide the nature of the transmission, we'll prepend a fake header that makes the packet look like a standard, unencrypted industrial sensor broadcast.
Step 4: Silent Transmission
Finally, we tune the SDR to a quiet part of the 915 MHz ISM band and transmit the payload.
The Receiving End
The receiving Mycelium instance simply reverses the process: strips the 4-byte decoy header, applies the same XOR mask, and outputs the clean data.
Conclusion
Mycelium’s ability to manipulate data buffers on the fly makes it an invaluable tool for testing non-traditional data transport paths. By combining network ingestion with RF physical layer control, security teams can evaluate their organization's true visibility into the electromagnetic domain.
← Back to Blog