Polish researchers have proposed a new method of network steganography based on the operational characteristics of the widely used TCP transport protocol. The authors of the study believe that their scheme, for example, can be used to send hidden messages in totalitarian countries that impose strict internet censorship. Let's try to understand what the innovation actually consists of and how useful it really is.
First, we need to define what steganography is. Steganography is the science of hidden message transmission. In other words, using its methods, parties attempt to conceal the very fact of transmission. This is what distinguishes this science from cryptography, which attempts to make the content of the message unreadable. It is worth noting that the professional community of cryptographers harbors a certain disdain for steganography due to its ideology being close to the principle of 'Security through obscurity'. This principle, for example, is utilized by Skype Inc., where the source code of the popular calling application is closed and no one really knows how data encryption is performed. Recently, this was lamented by the NSA, as mentioned by the well-known specialist Bruce Schneier on his blog.
Returning to steganography, let's answer the question of why it is necessary at all if we have cryptography. Indeed, one can encrypt a message using some modern algorithm and with a sufficiently long key, no one will be able to read it unless you wish otherwise. Nevertheless, sometimes it is more beneficial to hide the very fact of secret transmission. For example, if the relevant authorities intercept your encrypted message, they may not be able to decrypt it, but if they really want to, there are non-computer methods of influence and information extraction. It sounds dystopian, but let's agree that such a scenario is theoretically possible. Therefore, it would be better to ensure that those who are not meant to know are completely unaware that a transmission took place. Polish researchers have proposed such a method. Moreover, they suggest doing this using a protocol that every internet user utilizes a thousand times a day.
Here we have closely approached the Transmission Control Protocol (TCP). It's not worth explaining all its details — it's long and boring; those who need to know already do. In brief, TCP is a transport layer protocol (meaning it operates 'above' IP and 'below' application layer protocols like HTTP, FTP, or SMTP) that ensures reliable delivery of data from sender to receiver. Reliable delivery means that if a packet is lost or arrives altered, TCP will take care of retransmitting that packet. It's important to note that alterations in a packet refer not to intentional data distortion, but to transmission errors that occur at the physical level. For instance, as a packet travels over copper wires, a couple of bits may change their value to the opposite or may get lost in noise (for Ethernet, the Bit Error Rate is typically considered to be around 10^-8). Packet loss during transmission is also a relatively common occurrence on the internet. It can happen due to router congestion, which leads to buffer overflow and consequently discards all newly incoming packets. Usually, the proportion of lost packets is about 0.1%, but when it reaches a couple of percent, TCP starts to malfunction — users will experience significant lag.
Thus, we see that packet retransmission is a common and necessary phenomenon for TCP. So why not use it for steganography, especially since TCP, as noted earlier, is widely used (various estimates suggest that TCP accounts for 80-95% of internet traffic today)? The essence of the proposed method is to send not the data from the original packet in the transmitted message, but the information we are trying to conceal. Detecting such a substitution is not that easy. After all, you need to know where to look — the number of simultaneous TCP connections passing through a provider is simply enormous. If one knows the approximate level of retransmission in the network, one can adjust the steganographic transmission mechanism so that your connection is indistinguishable from others.
Of course, this method is not without its flaws. For instance, from a practical standpoint, implementing it will not be so straightforward — it will require changes to the network stack in operating systems, although there is nothing prohibitively difficult about it. Moreover, with sufficient resources, it is still possible to detect "hidden" packets, as this requires inspecting and analyzing every packet in the network. However, this is typically nearly impossible, so usually, one looks for packets and connections that stand out, and the proposed method makes your connection unremarkable. Additionally, there is nothing stopping you from encrypting sensitive data just in case. The connection itself can remain unencrypted to arouse less suspicion.
The authors of the work (by the way, for those interested, they) at the simulation level demonstrated that the proposed method works as intended. Perhaps in the future, someone will take on the implementation of their idea in practice. And then, hopefully, there will be a bit less censorship on the internet.
Source: habr.com
