Esoteric Exfiltration
Willa Cassandra Riggins and abyssknight demonstrate unconventional data exfiltration methods that bypass strict enterprise egress controls using novel covert channels.
Summary
Architecture and Background
When the machines rise up and take away our freedom to communicate we're going to need a way out. Exfiltration of data across trust boundaries will be our only means of communication.
Vulnerability Analysis
How do we do that when the infrastructure we built to defend ourselves is the very boundary we must defeat? We use the same pathways we used to, but bend the rules to meet our needs.
Exploitation and Demonstrations
Whether its breaking protocol, attaching payloads, or pirating the airwaves we'll find a way. We'll cover using a custom server application to accept 'benign' traffic, using social and file sharing to hide messages, as well as demo some long range mesh RF hardware you can drop at a target for maximum covert ops.
Remediation and Defensive Strategies
Willa Cassandra Riggins is a penetration tester at Veracode, and was previously part of the Lockheed Martin CIS Red Team. She started her career as a developer and pivoted into security to help fight the pandemic that is developer apathy. Her background spans the software development lifecycle, but her heart is in root shells and crown jewels. She can be found making things at FamiLAB in Orlando, hacking at the local DC407 meet-ups, staffing the socials at BSides Orlando, and marketing all the things at OWASP Orlando.
Related talks
Main Stage·37 min
Saqib A. Khan
Saqib A. Khan explores stealth data dispersal: icmp moon-bounce at DEF CON 10, examining icmp and practical defenses.
Main Stage·49 min
I)ruidm
I)ruidm details i)ruidm: Real-time Steganography with RTP Real-time Transfer Protocol (RTP) is used almost ubiquitously by Voice over IP technologies to provide an audio channel for calls.
Main Stage·1 hr 3 min
Bennett Haselton
Bennett Haselton explores a protocol using steganography to circumvent censorship at DEF CON 8, examining steganography and practical defenses.


