CyberRidge shows fiber clip-on attack can copy encrypted traffic

CyberRidge on Sept. 1 demonstrated how a low-cost optical coupler can silently tap a live fiber line and capture all of its traffic without triggering alarms. The company used the demo to argue that encryption alone does not stop harvest-now-decrypt-later risk and to pitch its Carmel platform as a physical-layer defense.

Why it matters: - CyberRidge is trying to show that encrypted data in transit can still be stolen in full if an attacker can physically tap the fiber. - The demonstration is meant to underline harvest-now-decrypt-later risk, where encrypted traffic is copied today and decrypted later if keys are exposed or quantum computers mature. - CyberRidge says its Carmel platform removes the recordable signal at the physical layer, aiming to block that attack path before data can be captured.

What happened: - CyberRidge released a demonstration on Sept. 1 showing a commercially available clip-on optical coupler capturing a live fiber-optic data stream. - A CyberRidge engineer attached the coupler to a standard fiber cable carrying traffic between two endpoints. - The link stayed active, no fiber was cut, and no alarms triggered. - The sender and receiver continued exchanging data normally while the attacker retained a real-time copy of the packet stream. - CyberRidge said the coupler used in the demo costs a few hundred dollars and can be bought online.

The details: - The captured traffic remained encrypted ciphertext. - CyberRidge said the coupler propagated out a fraction of the light, enough to extract every bit of the digitally encrypted data stream. - Prof. Dan Sadot, founder and CEO of CyberRidge, said the demo challenges the idea that encryption alone makes data-in-transit safe. - Sadot said a person with basic technical skills and a low-cost device could physically tap a live fiber link and exfiltrate all traffic without detection. - CyberRidge said HNDL stands for Harvest Now Decrypt Later. - CyberRidge cited Gartner as estimating a 75% chance of a cryptographically relevant quantum computer arriving by 2030. - The company said its Carmel platform uses photonic-layer security to turn data-in-transit into physical optical noise at Layer 1. - CyberRidge said Carmel is a drop-in replacement for existing line cards. - CyberRidge said Carmel adds zero latency and has no link length limits. - CyberRidge said the platform is designed for wide infrastructure networks already carrying live traffic. - The company said the full demonstration video is available here if needed.

Between the lines: - The demo is a marketing and security message at the same time: physical interception can be easier than many operators assume, even when encryption is working as designed. - CyberRidge is positioning physics-based protection as a complement or alternative to stronger cryptography, not as a software patch. - The emphasis on “silent” capture is meant to move the threat from theory to a practical operational risk for fiber networks.

What's next: - CyberRidge is pushing Carmel as a rapid-deployment option for existing DWDM infrastructure. - The company is likely to use the demo to support broader adoption arguments around post-quantum and harvest-proof security. - CyberRidge’s public social channels remain available at LinkedIn, YouTube, and X.