Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to hide any traffic an application makes on the local network, make it look like the network is completely quiet to the system and other monitoring software.

Is this doable? How would I achieve this?

share|improve this question
3  
Unless you have access to the all of other machines monitoring you, no you can't do that. –  Adnan Apr 9 '13 at 20:34
    
It's just for my machine, hide traffic from the system and other applications. –  Kesarion Apr 9 '13 at 20:42
    
If possible you can always encrypt your traffic, or tunnel it to make it less obvious. Usually traffic is not much important compared to content which needs to protected. If you are more worried about someone accessing app traffic, try configuring your network with properly defined management interfaces at firewall levels that segregate (sensitive vs non-sensitive) traffic. –  Saladin Apr 9 '13 at 21:11
    
So you want to hide an application's traffic from yourself? May I ask why you want to do that? There might be other ways to achieve your goal. –  Adnan Apr 9 '13 at 22:05
    
Kesarion i dont want to sound too critical but it seems you are now having hard time solving or picking the right answer some solutions are most costly then the problem you faces. Revise i suggest –  Saladin Apr 10 '13 at 4:24
add comment

3 Answers

up vote 2 down vote accepted

In a typical operating system, low-level sending and receiving of ethernet frames is done by a specific driver, and another layer of the OS can give a copy of each incoming and outgoing frame to any (privileged) application which asks for them. Monitoring software is that kind of application. So, if you want to be able to send and receive frames without locally installed monitoring software to become aware of it, you have to hook your code deep inside the OS kernel, either as a custom driver for the ethernet interface, or in the layer immediately above it.

Of course, if you can do that, then you have complete control of the machine, which begs the question: why don't you just deactivate or uninstall the monitoring software in that case ?

Also, handling incoming frames can be complex: you would have to recognize which frames are for your own application, and not for other applications in the machine. If you want to handle anything as complex as a TCP connection, you would soon end up with implementing your own TCP/IP stack in your custom driver. That's a very pedagogical programming exercise...


This is for avoiding detection by local monitoring applications. For remote applications, running on other machines, you cannot avoid their seeing your packets. You can make the packets opaque through encryption: monitoring software would see fishy-looking packets, but would not be able to pierce their contents.

To make your communications really inconspicuous, you would have to do steganography: masquerade your data as innocent-looking data. For instance, you could open an HTTPS connection to https://www.google.com/: that's innocent enough, everybody does that all day long. Since that's HTTPS, connections to Google's server begins with a SSL handshake; and a SSL handshake begins with a ClientHello message which includes 28 random bytes from the client (that's part of the SSL/TLS protocol). Your application could replace these 28 random bytes by the encryption of a 28-byte message; an accomplice, spying on the Internet connection, would see these 28 bytes (the ClientHello is sent in the clear) and decrypt the message. Monitoring software, and Google's server, would just see 28 seemingly random bytes at a place where 28 random bytes are expected.

Bandwidth offered by steganography is almost always abysmally low; and it is hard to do well.

share|improve this answer
    
Wow, that's a really interesting approach, the second one. Although that specific solution would have few applications, the idea of masquerading data as something else and sending it to a well known server sounds pretty good. I do believe yours is the best answer, not only an answer to my question, but a different approach as well. Thank you! –  Kesarion Apr 10 '13 at 13:27
add comment

You would need a kernel level driver that could subvert the network stack. Practically, it's going to be pretty difficult to do. It would effectively require a rootkit since generally the IP stack on your computer (part of the OS) handles all traffic on behalf of apps and you would have to bypass this.

share|improve this answer
    
A rootkit and a custom driver? Sounds like a titanic task, but thank you for the answer. –  Kesarion Apr 9 '13 at 20:46
    
@Kesarion - technically most rootkits are custom drivers. They are simply making the kernel itself behave in a way that it doesn't normally. Normally, the IP stack can be monitored by any applications. Making it not allow that requires very low level efforts. –  AJ Henderson Apr 9 '13 at 22:31
    
Where would I start if I were to do this? –  Kesarion Apr 9 '13 at 23:38
    
Would this be modifying how the Ethernet level frames are output? Would you still be able to get those signals through routers/switches, or would they just hear noise? Is your suggestion to rootkit the two stations or every other station on the network? –  Eric G Apr 9 '13 at 23:54
    
@EricG - no, the original question was just to hide it from the host. As I understand it, he wants application ABC to be able to communicate with the outside world without any other programs running on the computer being able to see it. This would just require direct control of the NIC without providing the information to any other applications, but that would take a root kit since every OS I know of has some provision to allow a sufficiently elevated process to monitor the IP stack. –  AJ Henderson Apr 10 '13 at 18:26
show 1 more comment

Do you have to use existing wires and equipment, or do you have the freedom to instal custom hardware between the two endpoints, or avoid the network?

For example, you could run 900mhz wireless equipment, which is slower than most common 802.11a/b/g/n wifi, but barely anyone uses this anymore so it will be less likely to be intercepted. You could also run Ethernet over electrical wires (powerline Ethernet / homeplug) or even run network connections over phone wires with the right hardware.

If you are trying to do something on two stations which are already part of an ethernet network, your best bet would be to use some type of covert/hidden channel in normal communications, such as timing, or putting messages into headers.

If you just want to hide network activity from the local station (e.g., a botnet hiding its presence, but not caring about network traffic) then you would use a rootkit to block the process and connections being reported by the OS, or you could just try to replace key programs like netstat and lsof which report on network activity.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.