Cypherpunk-Grade Covert Network Channels

Presented at DEF CON 9 (2001), July 13, 2001, 11 a.m. (50 minutes).

Two parties, both operating in hostile network territory, need to communicate covertly via an internetwork. They need to do so in a manner such that a well-resourced attacker cannot gain knowledge of the content of their transactions, nor even gain evidence beyond plausible deniability that discrete communication is taking place. The assumptions made are extreme; it is understood that lives may be at stake.

Is the creation of such a clandestine network mechanism technically feasible? Absolutely. Should you be concerned about the implications of undetectable traffic? Most definitely.

An initial r+d implementation in library form as well as proof-of-concept code built upon it will be presented. By taking advantage of peculiarities in many fielded protocols, steganographic techniques applied to the network layers, and using dynamic polymorphism based on local traffic patterns and cryptographic control, the channel is effectively able to resist detection and attack. Discussion concerning the theory, implementation, and political ramifications is welcomed.


Presenters:

  • Jason Peel
    Jason Peel (jsyn@nthought.com) is a Senior Network Architect with Network Thought Co. Recent research+development efforts have covered wireless infrastructure auditing (including marsupial-in-the-middle attacks), PKI, anti-promisc-detection, managed enterprise lockdowns, and IPv6 vulnerabilities.

Links: