RF power meters have proven to be a surprisingly useful and inexpensive tool to identify inappropriate network activity of _many_ varieties on compromised hosts once baselined. Two pictured are a couple of my favorite ones. Recommended for your toolkit.
2
5
21
Cheaper than the $9.4mm spent by DARPA on CAMELIA.
1
1
In general though the approach is sound, IMHO, dunno about their project specifics. I’ve only been playing with these RF monitoring tools a short time, and easily recognize a wealth of useful information and signatures there. It begs for more sophisticated defensive analysis.
1
Replying to @dragosr
I was joking about DARPA, but the end goal for this tech will be a separate but onboard meter that provides the same functionality without needing an external meter, allowing devices to self-detect compromise.

Aug 17, 2018 · 1:36 PM UTC

1
Replying to @bilcorry
Will they explode then? Release the attack droids? Because detecting compromise on a compromised box is difficult to do something with even with an unpredictable human operator at the controls, never mind an easily neutralized automatic response.
1
That’s an open problem, but self-healing is one theoretical approach.