Click to edit Master title style• Click to edit Master text styles“UYR”• Third level
Under Your Radar— Second level— Fourth level» Fifth level
CovertChannel & Exfiltration

Ali Hadi / Mariam Khader
Princess Sumaya University for Technology (PSUT)
Amman/Jordan

Clickto edit Master title style
Outline•• Click
Introto edit Master text styles
Second level•—
What• Third level• Usage— Fourth level» Fifth level• Idea• How it Works• Why Under Radar• Action Clickedit Master title style
QuicktoIntro.
•• Steganography
Click to edit Master text styles– Hiding the existence of the data

— Second level• Third level• Covert—Channel
Fourth level– Unseen»“secret”
Fifth levelcommunication• Exfiltration (aka Exfil)– Illegal retrieval of data from a compromisedcomputerClick to edit Master title style• Click to edit Master text styles— Second level• Third level
WhySocial Networks& Multimedia?
— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Hackers
Datatitle
withstyleVideo
Click toExfiltratingedit Master
Steganography via Cloud Video Services• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

KEN WESTIN@TripeWire[1]

Clicktoedit
Mastertitle
style
What: UYR?
Clickto edit Mastertext channel
styles and•• Newapplication
layer covert
exfilsystem level— Second• Applies
multimedia
stego techniques• Thirdlevel
Fourth level• Hard for—Radars
to detect what’s being sent
» Fifth level

Clicktoedit
Mastertitle
styleUsages?
•• Covert
Click toCommunications
edit Master text styles— Second level• Exfiltrating
Data• Third level— Fourth level» Fifth level

ClicktoeditMastertitlestyleIdea?
•• No
Clickreal
to dataedit Masteris transmitted!
text styles— Second• Only
data leveltransmitted is a bunch of• Third level
numbers(key)!
— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level

How it works?

— Fourth level» Fifth level

Clicktoedit
Mastertitle
style
Protocol Agreements•• Social
Click toMedia
edit Master
Used text styles— Secondlevel• VideoUsed• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Click to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

Extract Hidden
Message/DataClick toedittoMastertitle style
WhyHardDetect?
Evade current detection techniques• Click to edit Master text styles• UYR has no signature— Second level• No patternor anomaly• Third level— Fourthlevel• No proof
to correlate
between the» Fifth level
video + image
usedClick to edit Master title style• Click to edit Master text styles— Second level• Third level— Fourth level» Fifth level

ClicktoeditMastertitle
style
References[1] http://tripwire.com/state-of-security/incident-detection/hackersexfiltrating-data-with-video-steganography-via-cloud-video• Clickto edit Master text styles
services/Secondlevel[2]—
Youtube,Cisco,and Google Stats, http://jlbmedia.com/online• Third level
video-impact-2014— Fourth level[3] https://www.youtube.com/watch?v=QfVVfB_UHeA» http://www.statisticbrain.com/twitter-statistics/
Fifth level[4] Twitter Stats,[5] UYR, https://github.com/Mariam118/UYRAli Hadi@binaryz0ne
Mariam Khader @MariamKhader118

ClicktoeditMaster
title
style
Special Thanks
Princess Sumaya University for Technology• Click
toour
editfamilies,
Masterfriends,
text styles(PSUT),—Second level and all those who
security4arabs,• Third levelsupportedus!
— Fourth level» Fifth level