4 ms·

This is definitely a pure conspiracy theory, but there have to be hundreds of readily usable side-channels for transmitting information out of a compromised box

This is definitely a pure conspiracy theory, but there have to be hundreds of readily usable side-channels for transmitting information out of a compromised box that wouldn't show up in Wireshark unless you knew exactly what to look for. Think biases in timings or not-so-random bits in client-generated TLS values.

vacri 13y ago
This is a good point, but remember also that those packets have to go somewhere specific - the information may not be encoded in the bits, but in the timing instead. This being said, the information still has to arrive at its destination.
- PavlovsCat 13y ago
  We're talking about an adversary that potentially taps and stores all traffic at major endpoints worldwide. They packets have to go further than a few hops, but not to a specific destination, not necessarily. Think taping a playing card to the spokes of a deaf person's bike. You won't automagically hear it when they're riding it in the basement, but if they ride through the streets, you'll know.
jsn 13y ago
Don't know why you were downvoted, it's a valid concern. It won't be "phoning home", though -- you only can phone the so called "global adversary" this way (because you can't send packets to arbitrary addresses). Also, messing with TLS probably won't work at all. Messing with e.g. MTU sizes, IP sequence numbers and perhaps TCP options, on the other hand, could probably work.
brudgers 13y ago
There's nothing quite like a good conspiracy theory to start the morning, I read your comment and thought, "Gosh, encoding phoning home spyware that way would be straight forward to implement on top of an automatic updates feature." I won't say I am a bit more paranoid, rather I am amused by the thought that I could be, but for the understanding that the technical details are so raw that there is no avoiding such exploits once anyone is granted my trust.
pessimizer 13y ago
Scariest subthread in months. Steganography that doesn't depend on packet contents, but on metadata that seems ephemeral, insignificant, and/or arbitrary. If all of the traffic on a few large pipes has to pass through you, I don't see how this wouldn't be both straightforward to implement and undetectable. If this hasn't been done, it will be.

vacri 13y ago

This is a good point, but remember also that those packets have to go somewhere specific - the information may not be encoded in the bits, but in the timing instead. This being said, the information still has to arrive at its destination.

PavlovsCat 13y ago
We're talking about an adversary that potentially taps and stores all traffic at major endpoints worldwide. They packets have to go further than a few hops, but not to a specific destination, not necessarily. Think taping a playing card to the spokes of a deaf person's bike. You won't automagically hear it when they're riding it in the basement, but if they ride through the streets, you'll know.

jsn 13y ago

Don't know why you were downvoted, it's a valid concern. It won't be "phoning home", though -- you only can phone the so called "global adversary" this way (because you can't send packets to arbitrary addresses). Also, messing with TLS probably won't work at all. Messing with e.g. MTU sizes, IP sequence numbers and perhaps TCP options, on the other hand, could probably work.

brudgers 13y ago

There's nothing quite like a good conspiracy theory to start the morning, I read your comment and thought, "Gosh, encoding phoning home spyware that way would be straight forward to implement on top of an automatic updates feature." I won't say I am a bit more paranoid, rather I am amused by the thought that I could be, but for the understanding that the technical details are so raw that there is no avoiding such exploits once anyone is granted my trust.

pessimizer 13y ago

Scariest subthread in months. Steganography that doesn't depend on packet contents, but on metadata that seems ephemeral, insignificant, and/or arbitrary. If all of the traffic on a few large pipes has to pass through you, I don't see how this wouldn't be both straightforward to implement and undetectable. If this hasn't been done, it will be.