2

I remember reading a couple of years ago (I believe it was during the Egyptian Revolution) that hackers managed to bypass government filters by making their traffic appear as another protocol. If memory serves me right they were masking their "forbidden" content and making it appear as online video game traffic (which supposedly wasn't filtered at the ISP level).

Is there a name for this practice? Are there resources I can read about it?

I'm considering doing this as my next semester's project but I'm unable to find much resources about it on the net, probably because I don't know what it would be called.

I guess it's some form of steganography?

  • Slightly off-topic: one of my friends has previously done the DNS trick where you request a CNAME record for {base64}.mydomain.com, and get the response embedded in the CNAME text. Since some WiFi networks don't block DNS requests even for unregistered users, you can (inefficiently) get connectivity pretty much anywhere. :p – cloudfeet Oct 29 '14 at 11:57
2

Sending one type of network traffic over another protocol is called network tunneling or covert channeling. This is quite easy to do, and with some experience, you can send plaintext data over port 443 (to make it appear encrypted to the untrained eye) or send IM messaging traffic over port 80...the opportunities are endless.

The method of sending data over a covert channel is not encrypting the data, but avoiding detection that the data is being sent in the first place.

Here are some resources for you to read up on covert channeling as well as a couple of programs that can help you do this.

Resources

  1. SANS Covert Channels article: Really awesome and contains lots of detailed info: http://www.sans.org/reading-room/whitepapers/detection/covert-channels-33413

  2. InfoSec Institute article: Some hands on examples using Kali Linux: http://resources.infosecinstitute.com/creating-covert-channels/

Tools

  1. 6 packet crafting tools from sectools.org: http://sectools.org/tag/packet-crafters/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.