Mobile VoIP Steganography From Framework to Implementation Marcus - PowerPoint PPT Presentation

Mobile VoIP Steganography From Framework to Implementation Marcus Nutzinger Rainer Poisel Jürgen Wurzer Institute of IT Security Research St. Pölten University of Applied Sciences DeepSec 2010 November 25 th 2010

Mobile VoIP Steganography – From Framework to Implementation Introduction Us, Ourselves, and We Studied “Telecommunications and Media” Employed at the Institute for IT Security Research at St. Pölten University of Applied Sciences Project StegIT-2 Digital Forensics November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Introduction Cryptology, Cryptography and Steganography Cryptography Steganography Study and practice of hiding Science of covert information communication Protection of secret data Conceals the existence of secret information Data transfer obvious Cryptology Science that incorporates both cryptography and cryptanalysis. November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Introduction Cryptology, Cryptography and Steganography Cryptography Steganography Study and practice of hiding Science of covert information communication Protection of secret data Conceals the existence of secret information Data transfer obvious Cryptology Science that incorporates both cryptography and cryptanalysis. November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Introduction Cryptology, Cryptography and Steganography Cryptography Steganography Study and practice of hiding Science of covert information communication Protection of secret data Conceals the existence of secret information Data transfer obvious Cryptology Science that incorporates both cryptography and cryptanalysis. November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Introduction Filtering of internet services and applications Suspected Pervasive Substantial Selective No evidence Figure: Worldmap of internet filtering (Source: OpenNet Initiative, 2010) November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Introduction Steganography in Brief Stego Object Cover Encoder Image Key Decoder Communications Channel Original Cover Figure: Generic procedure of steganography November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Functional Overview – The Framework GUI secret message A from Alice for Bob Chat StegIT-2 framework micro original modified from Alice embedding (cover) (stego object) Alice modified from Bob extraction (stego object) speaker secret message B from Bob Figure: Principle of the StegIT-2 Framework November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Functional Overview – VoIP Internet VoIP VoIP Client Client Linux router (e.g. OpenWrt) Linux router (e.g. OpenWrt) Figure: Using the framework for VoIP-Steganography November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Functional Overview – VoIP framework framework embedding embedding extraction extraction RTP packets RTP packets RTP packets RTP packets netfilter-queue netfilter-queue Internet VoIP VoIP Client Client Linux router (e.g. OpenWrt) Linux router (e.g. OpenWrt) Figure: Using the framework for VoIP-Steganography November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Functional Overview – GSM mobile mobile PC with StegIT-2 PC with StegIT-2 phone phone framework framework micro micro embedding embedding Alice Bob modified modified extraction extraction handsfree set handsfree set adapter adapter speaker speaker soundcard for soundcard for audio input (line in / mic) audio input (line in / mic) and audio output (line out) and audio output (line out) Figure: Using the framework for Steganography in GSM-calls November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Outlining the Components Components Protocol for data flow handling Integrity check of embedded data Segmentation of data for transmission Unification of secret data and cover medium Management of component instantiation Interfaces for third party software November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Layered Approach 6 Secret Data Secret Data Bytes 5 Protocol Protocol Bits 4 Presentation Presentation Chips 3 Embedding Embedding Samples 2 Synchronization Synchronization Samples 1 Transmission Transmission Frame transmission (e.g. RTP) Alice Bob Figure: Steganographic data exchange as a layered model November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Software-Architecture I IEmbeddingEngine +embedIntoSamples() +extractFromSamples() 1 1 CStegCallHandle +getEmbeddingEngine() 1 1 CSamplesPreprocessor +createStegoObject() +extractFromStegoObject() 1 1 main 1 1 ISampleIO +read() +write() CAlsaIO CRoutingIO CSocketIO COriginalModifiedIO 1 CPulseAudioIO CWaveIO CDeinterlaceIO CCombinationIO 1 1 1 2 2 ISampleIO Figure: Architecture for IO-components November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Software-Architecture II Start Init framework: io, samles preprocessor, embedding engine io->read() true Copy audio samples into EOF 1 a ring buffer for extraction false =EMBED =EXTRACT Action extract thread: createStegoObject() extractFromStegoObject() Wait for extraction, Extract secret data io->write() Wait for 1 extract thread Destroy framework End Figure: Flowchart of the main-routine November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Software-Architecture III Spatial Domain Transform Domain Analogue representation Digital representation Echo Hiding Codec-specific Spread Spectrum e. g. LSB Hiding Phase Coding November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Software-Architecture III Spatial Domain Transform Domain Analogue representation Digital representation Echo Hiding Codec-specific Spread Spectrum e. g. LSB Hiding Phase Coding November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Software-Architecture III Start embedOrExtract() For decoded "analog" For format specific =ORIGINAL =DECODE Representation embedding / extraction embedding / extraction Decode =EMBED =EXTRACT =EMBED =EXTRACT Action Action embedIntoSamples() extractFromSamples() embedIntoSamples() extractFromSamples() Embed into Extract from Embed into Extract from encoded audio data encoded audio data decoded audio samples decoded audio samples Encode End embedOrExtract() Figure: Different modes for Samples-Handling November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Software-Architecture IV CSimpleFileProtocolEngine CDummyProtocolEngine CFileProtocolEngine CGuiProtocolEngine 1 1 IStegIO +read() +write() 1 1 1 CStreamBuilder IPacketSource CDatagramBuilder +getPacket() +putPacket() 1 1 CPacketBuilder IExtendedBitSource +getBit() +putBit() 1 1 1 CByteBuilder IBitSource CFrameBuilder +getBit() +putBit() 1 1 1 CDynamicSSEE CDefenseEmbeddingEngine 1 1 CEchoEmbeddingEngine CRandLsbEmbeddingEngine IEmbeddingEngine +embedIntoSamples() +extractFromSamples() Figure: Architecture for embedding components November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Platforms - Commodity Hardware Mipsel OpenWrt SDK: Adaptions Asus WL-500g Premium v1, Support for NFQUEUE based on Broadcom 4704 Additional packages added (modified) OpenWrt SDK Customized firewall settings Port to other platforms: Customized start scripts Routing-Interface Audio-Interface November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Platforms - Commodity Hardware Mipsel OpenWrt SDK: Adaptions Asus WL-500g Premium v1, Support for NFQUEUE based on Broadcom 4704 Additional packages added (modified) OpenWrt SDK Customized firewall settings Port to other platforms: Customized start scripts Routing-Interface Audio-Interface November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Platforms - Mobile- and Smartphones Possibly usage on smartphones Scenarios VoIP currently only Linux based phones considered Raw Voice-Data e. g. Android powered smartphones NDK allows for reuse of our C++ codebase November 25 th 2010 DeepSec 2010

Mobile VoIP Steganography – From Framework to Implementation Technical Details Platforms - Mobile- and Smartphones Possibly usage on smartphones Scenarios VoIP currently only Linux based phones considered Raw Voice-Data e. g. Android powered smartphones NDK allows for reuse of our C++ codebase November 25 th 2010 DeepSec 2010