Stego Using TCP Retransmissions

Follow the title link to an article that describes steganographic techniques using TCP ACK packets. Remember, these are the packets that are designed to either positively acknowledge how many bytes are received and even negatively acknowledge which byte is expected next. The article claims how the researchers can smuggle data as a covert channel in ACK to circumvent filtering and censorship.

If you HEARD my SCALE 7X presentation Custom FileSystems (slides), you would have heard how I described injecting spoofed ACKs to create an ACK storm that actually sustains a filesystem until the storm subsides. To create a sustainable filesystem, you would only need to create mirrors or parity storms ala RAID to give you a chance to restart the fallen one.

The reasons this is particularly more attractive than an alternative:

1) Transport layer--nobody knows you are using their webserver to bounce bytes off of unless they are looking at the transport layer.
2) Spoofable--you can spoof the ACK, ignore the resets, which allows you bounce the filesystem around a little and potentially avoid detection.
3) Troubleshooting ACK storms (if they are even noticed) usually involve part swapping network hardware--which won't affect the filesystem.

The next month is very busy, so I don't know if I'll have a chance to roll out a hello-world for this, but since I promissed it in February, I'll try to make it happen while stuck on a a long flight or two.

Audio Watermarking for Triangulation

This is an interesting thing that uses practical steganographic techniques to pinpoint the location where a recording device is in a movie theatre. It's not entireably unbelievable that this is possible, given that we have surround sound. I imagine the accuracy varies, though, not all theatres are equal and you may have the folks disapproately located.

The ways around this seem obvious to me: heavily convert the audio, and record from multiple locations, mixing it down. Of course, that likely affects the sound quality of the final bootleg product, but it would do the job. Or the bootlegger could mix in interesting signals that would skew the triangulation (like my previous post about how a certain sine wave prevents youtube.com from compressing the audio in a video).

Not to wave-off their work, but we really need to be moving forward and not lateral right now, like most security issues--it's an arms race.

The past week was good, enjoyed speaking at SecureIT. This week I'll be at TUG U2U then Charleston, NC for SANS Sec 504, see http://bluenotch.com/events for more info.