Skip to content

Stealth Data Dispersal: ICMP Moon-Bounce

Saqib A. Khan

Saqib A. Khan explores stealth data dispersal: icmp moon-bounce at DEF CON 10, examining icmp and practical defenses.

Summary

Architecture and Background

- Stealth Data Dispersal: ICMP Moon-Bounce This research is targeted at demonstrating that small amounts of data can be dispersed over IP based networks, utilizing the data payloads of existing protocols. Such data is expected to be kept alive on the ether until one chooses to retrieve it. The crux of the scheme is the fact that this type of data dispersal is expected to be extremely difficult to detect.

Vulnerability Analysis

Such a scheme also raises some very interesting aspects regarding using Internet traffic itself as virtual mass storage system, etc. As an example, a specific technique created by the author, the "ICMP Moon-Bounce", will be presented that accomplishes our data dispersal goal. Khan is the Founder and CEO of SecurityV, Inc.

Exploitation and Demonstrations

a cutting edge Network Security Auditing startup. Previous to SecurityV, Khan founded and ran Secure Networks Corporation, a succesful network security integration firm w/ offices in Harvard Square, Cambridge, MA. Prior to Secure Networks, Khan performed brief consulting stints at MIT, Sun, Checkpoint, and Lucent(INS) on multiple security and programming projects.

Remediation and Defensive Strategies

Khan's primary interests lie in Network Protocol Vulnerabilities, Artificial Intelligence, and Cosmology. Nowadays, Khan resides in Miami Beach and spends equal time on partying and Network Security research. Khan has previously presented 5 techincal papers in various professional conferences. Khan has a Masters in Computer Engineering and a Bachelors in Electrical Engineering from Auburn University, AL.

Related talks

Main Stage·19 min

  • DEF CON
  • Red Team
  • Date: Aug 2016
  • Location: Las Vegas

Willa Cassandra Riggins · abyssknight

Willa Cassandra Riggins and abyssknight demonstrate unconventional data exfiltration methods that bypass strict enterprise egress controls using novel covert channels.

data-exfiltrationcovert-channelssteganography+2

Main Stage·46 min

  • DEF CON
  • Red Team
  • Date: Aug 2015
  • Location: Las Vegas

Daniel Crowley · Damon Smith

Daniel Crowley and Damon Smith reveal techniques for embedding covert web bugs and beacons within common document formats to leak recipient IP and environment data.

document-trackingweb-bugsexfiltration+2