Stealth Data Dispersal: ICMP Moon-Bounce
Saqib A. Khan explores stealth data dispersal: icmp moon-bounce at DEF CON 10, examining icmp and practical defenses.
Summary
Architecture and Background
- Stealth Data Dispersal: ICMP Moon-Bounce This research is targeted at demonstrating that small amounts of data can be dispersed over IP based networks, utilizing the data payloads of existing protocols. Such data is expected to be kept alive on the ether until one chooses to retrieve it. The crux of the scheme is the fact that this type of data dispersal is expected to be extremely difficult to detect.
Vulnerability Analysis
Such a scheme also raises some very interesting aspects regarding using Internet traffic itself as virtual mass storage system, etc. As an example, a specific technique created by the author, the "ICMP Moon-Bounce", will be presented that accomplishes our data dispersal goal. Khan is the Founder and CEO of SecurityV, Inc.
Exploitation and Demonstrations
a cutting edge Network Security Auditing startup. Previous to SecurityV, Khan founded and ran Secure Networks Corporation, a succesful network security integration firm w/ offices in Harvard Square, Cambridge, MA. Prior to Secure Networks, Khan performed brief consulting stints at MIT, Sun, Checkpoint, and Lucent(INS) on multiple security and programming projects.
Remediation and Defensive Strategies
Khan's primary interests lie in Network Protocol Vulnerabilities, Artificial Intelligence, and Cosmology. Nowadays, Khan resides in Miami Beach and spends equal time on partying and Network Security research. Khan has previously presented 5 techincal papers in various professional conferences. Khan has a Masters in Computer Engineering and a Bachelors in Electrical Engineering from Auburn University, AL.
Related talks
Main Stage·19 min
Willa Cassandra Riggins · abyssknight
Willa Cassandra Riggins and abyssknight demonstrate unconventional data exfiltration methods that bypass strict enterprise egress controls using novel covert channels.
Packet Hacking Village·56 min
Mike Raggo, Chet Hosmer
Innovative covert TCP techniques for hiding malicious traffic and establishing undetectable command-and-control channels.
Main Stage·46 min
Daniel Crowley · Damon Smith
Daniel Crowley and Damon Smith reveal techniques for embedding covert web bugs and beacons within common document formats to leak recipient IP and environment data.


