TY - CHAP A1 - Zillien, Sebastian A1 - Schmidbauer, Tobias A1 - Kubek, Mario A1 - Keller, Joerg A1 - Wendzel, Steffen T1 - Look What’s There! Utilizing the Internet’s Existing Data for Censorship Circumvention with OPPRESSION T2 - Proceedings of the 19th ACM Asia Conference on Computer and Communications Security N2 - An ongoing challenge in censorship circumvention is optimizing the stealthiness of communications, enabled by covert channels. Recently, a new variant called history covert channels has been proposed. Instead of modifying or mimicking legitimate data, such channels solely point to observed data matching secret information. This approach reduces the amount of secret data a sender explicitly must transfer and thus limits detectability. However, the only published history channel is only suitable for special scenarios due to severe limitations in terms of bandwidth. We propose a significant performance enhancement of history covert channels that allows their use in real-world scenarios through utilizing the content of online social media and online archives. Our approach, which we call OPPRESSION (Open-knowledge Compression), takes advantage of the massive amounts of textual data on the Internet that can be referenced by short pointer messages. Broadly, OPPRESSION can be considered a novel encoding strategy for censorship circumvention. We further present and evaluate our open source proof-of-concept implementation of OPPRESSION that can transfer secret data by pointing to popular online media, such as Twitter (now “X”), news websites, Wikipedia entries, and online books. The pointer itself is transmitted through existing censorship circumvention systems. Our approach minimizes the amount of traffic to be concealed in comparison to existing works, even in comparison to compression. Y1 - 2024 U6 - https://doi.org/10.1145/3634737.3637676 SP - 80 EP - 95 PB - ACM CY - New York, NY, USA ER - TY - CHAP A1 - Strachanski, Fabian A1 - Petrov, Denis A1 - Schmidbauer, Tobias A1 - Wendzel, Steffen T1 - A Comprehensive Pattern-based Overview of Stegomalware T2 - Proceedings of the 19th International Conference on Availability, Reliability and Security N2 - In recent years, malware increasingly applies steganography methods to remain undetected as long as possible. Such malware is called stegomalware. Stegomalware not only covers its tracks on the infected system, but also hides its communication with adversary infrastructure. This paper reviews 106 stegomalware cases on the basis of 133 reports, including digital media (audio, video, images), text, and network steganography. For this purpose, the steganography methods used by the malware are categorized and introduced using a pattern-based approach. Our survey reveals that solely a small set of patterns are employed by known malware samples. We also analyzed the commonalities of media-, text-, and network-based stegomalware. We show that only a small variation of network protocols, media types and hiding methods are utilized by stegomalware. For this reason, research may focus on these to counter malicious activities covered by steganography. KW - information hiding, steganography, steganalysis, detection tech niques, malware, threat intelligence Y1 - 2024 U6 - https://doi.org/10.1145/3664476.3670886 SP - 1 EP - 10 PB - ACM CY - New York, NY, USA ER - TY - CHAP A1 - Schymiczek, Jeff A1 - Schmidbauer, Tobias A1 - Wendzel, Steffen T1 - A Case Study on the Detection of Hash-Chain-based Covert Channels Using Heuristics and Machine Learning N2 - Reversible network covert channels restore the original carrier object before forwarding it to the overt receiver, drawing them a security threat hard to detect. Some of these covert channels utilize computational intensive operations, such as the calculation of cryptographic hashes. This paper proposes utilizing shape analysis of packet runtime distributions to detect such computational intensive covert channels. To this end, we simulated the latency of covert channel-modified traffic by adding mock hash-reconstruction delays to runtimes of legitimate ping traffic. After qualitatively observ- ing the changes in the empirical probability distribution between modified and natural traffic, we investigated machine learning algorithms for their ability to detect such covert channels. Our results show that a decision tree-based AdaBoost classifier and a CNN using the investigated statistical measures as input vector are able to classify sets of 50 ping measurements with high accuracy. Our approach is superior over previous work on the detection of computational intensive covert channels as it requires smaller sampling window sizes, achieves significantly higher detection rates, and thus draws detection more reliable with fewer preparation. Y1 - 2024 U6 - https://doi.org/10.1145/3664476.3670877 SP - 1 EP - 10 PB - ACM CY - New York, NY, USA ER -