3 ms·
Makes me wonder if this could be used as an obfuscated comms channel? (I'm sure there's a term covering it, steganography doesn't quite describe it). If you own
by edoloughlin 8y ago
Makes me wonder if this could be used as an obfuscated comms channel? (I'm sure there's a term covering it, steganography doesn't quite describe it).
If you owned a bunch of ipv6 addresses on multiple ISPs, you could use the timing of pings from these addresses as a comms protocol. You could even rotate IP addresses and use the modulus of the address to add a layer of obfuscation.
- shawn 8y agoYes. Ping and DNS are some of the most effective ways to exfiltrate data since they are rarely blocked.
- blattimwind 8y agoQuiet hosts with an unpublished v6 address are AFAIK impossible to discover in a better-than-linear-scan fashion from other networks (e.g. The Internet).
- zamadatix 8y agoNo different than obfuscating in higher level abstractions on a single IP as has been done forever. In either case you are getting a block of identifiers which have guidelines on how they should be used but no enforcement by design of the protocols. As an example things like port knocking can be carelessly translated into IP knocking. Doesn't make it any sneakier though, just less header.