2

I recently watched this YouTube video about capturing webcam image traffic using Wireshark. Although the technique used in the video is not applicable to my question (because it is about a MITM situation), it shows how image data, such as from webcams, is sent across a network.

What I am mainly interested in is blocking screen shots taken by malware and similar code.

Question: Is it feasible to have a hardware firewall device to keep an eye on packet data and remove packets that contain images, or is this sort of low-level analysis typically too taxing for a consumer-grade devices?

  • 3
    If I have something in my network exfiltrating data, my priority would be to detect and nuke it; not filter the images in the specific format that it may or may not be sending. – Ghedipunk Aug 20 at 17:52
6

Deep packet analysis or similar would be able to detect the transfer of images in general if the attacker does it in a stupid way, i.e. just as a HTTP post or similar and without any attempt to hide it (even a simple XOR with a fixed value or swapping of bytes or similar would likely be enough to be hidden). But even then it would be hard to impossible to distinguish a screen shot send by malware from an image send by the user, especially since the user might post screen shots too. Apart from that consumer.grade devices usually don't do the necessary deeper payload analysis but look mainly at IP and port.

In other words: I doubt that any firewall does this and if it claims to do this an attacker could likely easily bypass this. It is probably more useful to look at other properties of the communication instead, like unusual user agents, unusual behavior (i.e. does not look like normal browsing), suspicious communication targets etc. None of this provides reliably detection without false positives but it can point some analyst to the suspicious things to take a closer look.

  • Agree final paragraph. Investigate root cause of what is exfiltrating rogue/unauthorised data to start with. Better to head of the problem at root, rather than further down the path. – ISMSDEV Aug 21 at 4:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.