Feeds

Hidden messages buried in VoIP chatter

Skype covert channel confounds snoops

Website security in corporate America

Polish researchers have revealed the many ways you can hide messages within the bit stream of Voip phone calls.

If secret policemen didn't like Skype and its IP telephony cousins before, they'll really hate it now.

Burying hidden message in internet phone calls represents the latest evolution of steganography. Steganographic techniques for hiding messages have been around for as long as cryptography and have evolved with technology. Steganography once included messages hidden in wax tablets by the ancient Greeks and invisible ink and microdots on paper. Now it involves concealing messages within digitally transmitted images or sound files.

The advantage of steganography over simply scrambling messages using cryptographic techniques is that potential eavesdroppers don't know what to listen to. Subtle changes to images, the content of spam messages or a little extra noise in voice over IP communications are hard to detect and impossible to decipher without knowing that a message is there and applying appropriate unbundling and deciphering software.

The possibility of dropping hidden messages within the lowest bits of noisy sound files is not new in itself. Wojciech Mazurczyk and Krzysztof Szczypiorski, security researchers at Warsaw University of Technology, Poland, have extended this work to show how steganography techniques might be used to create a covert communications channel within VoIP streams.

In particular the researchers have developed two new techniques that exploit the fact that VoIP systems tolerate packet loss and have built-in redundancy. One approach exploits unused fields in the RTCP (Real-Time Control Protocol) and RTP (Real-Time Transport Protocol) protocols to transmit hidden messages. Another technique used delayed audio packets to hide covert communications. Mazurczyk and Szczypiorski's paper also goes through many other possible techniques for VoIP steganography.

In an experiment the researchers were able to covertly transmit more than 1.3 Mbits of data in one direction during a VoIP call lasting nine minutes, the average time for such calls. Mazurczyk and Szczypiorski found that protocol steganography was by far the quickest way to transmit covert messages.

Law enforcement officials have expressed frustration about the difficulty of deciphering VoIP messages made by suspected terrorists using Skype. Leaked documents suggest German cops have commissioned the development of software to intercept Skype VoIP communications and SSL transmissions.

This difficulties exist because of the cryptography natively employed by Skype without even considering the complicating factor of steganography.

Mazurczyk and Szczypiorski's paper on Steganography of VoIP Streams can be found here (pdf).

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.