A Stealth or Tunneling Virus is designed specifically to evade detection by antivirus software and system monitoring tools. These viruses work by intercepting and modifying the operating system's service call interrupts (such as INT 13h and INT 21h in DOS systems), which are used to access files or system services.
By hooking into these interrupts, the virus can return clean or forged data to antivirus scanners, thus hiding its malicious presence from detection tools.
Tunneling viruses may also operate at a lower level to evade even more advanced antivirus detection methods, making them particularly dangerous and hard to detect.
Reference - CEH v13 Official Study Guide:
Module 6: Malware Threats
Section: Types of Viruses
Quote:
"Tunneling viruses attempt to avoid detection by antivirus programs by installing themselves in the interrupt handler chain. These viruses intercept operating system calls to conceal their activities." Incorrect Options Explained:
A). Macro viruses target applications like Microsoft Word/Excel and use embedded macros, but do not alter service call interrupts.
C). Cavity viruses insert code into empty spaces in files without changing the file size but do not modify interrupts.
D). Polymorphic viruses mutate their code to avoid signature-based detection but do not typically interfere with system interrupts directly.

The attack reconstructs audio by analyzing motion sensor data (such as accelerometer readings) while the loudspeaker is active, allowing eavesdropping without using the microphone. This technique is known as the Spearphone attack.

Side-channel attacks, as explained in CEH v13 OT and SCADA Security, extract sensitive information by observing physical characteristics of a system rather than exploiting software flaws directly. These characteristics may include power consumption, electromagnetic emissions, timing variations, or thermal output.
In SCADA environments, side-channel attacks are especially dangerous because they bypass traditional network defenses. The most reliable way to confirm such an attack is by analyzing hardware-level anomalies
-such as unexpected power usage spikes or irregular signal emissions during normal device operations.
Option B directly aligns with CEH v13 guidance.
Options A, C, and D focus on software, cryptography, or network behavior, which are not primary indicators of side-channel exploitation.
Therefore, Option B is correct.

The action described involves actively sending deauthentication packets to force clients to reconnect and generate a new handshake. This functionality is provided by Aireplay-ng, which is used to inject packets and trigger reconnections for handshake capture.