Writing Steganographic Messages in Spam
I ran across this security link a few days ago and I thought it would be worth sharing with my readers. It’s a way to steganographically encode spam with text. This is actually one of the more ingenious ways that I’ve seen to encode messages. I mean, we all get insane amounts of spam, so what better way to send information than by spam. One of the key ways to tell that there is a covert channel is by looking for anomalous traffic, but spam is so common and it is so common that it comes from everywhere that it is very difficult to detect.
That said, there are a few obvious problems with this. The first being you have to either set up an agreement with the other party to know which messages are spam, or that party has to run all of their mail through the steganographic filter. Using a resource on the web, is the same thing as sending it plaintext (unless you use the SSL connection). But now you are risking that the website itself isn’t under federal wiretap or something else. Also, you have to worry about the spam that you are expecting actually making it through your spam filters. So unless you have an account that simply sits out in the middle of the DMZ with no protection there is a high liklihood of loosing the spam entirely.
You also cannot use the spammimic tool as an API (as far as I can tell) meaning you have to send all your traffic over HTTP/HTTPS to that website which sets off huge alarms for anyone who was eavesdropping. And last but not least, as with any steganographic system, once you tell people that it exists, it is almost completely useless. That’s the problem with staganography, you can never tell anyone about the best ways to hide data, or it’s a broken system.
Still, interesting idea though!
August 1st, 2006 at 9:07 am
This could be very interesting, specifically regarding passwords.
Imagine a site with a server that can more than handle the current userbase(for spammimic conversion proccessing). A users password is converted into a salted md5 then using a similar method to the spammimic tool.
A hacker later enters your database…to find…..
“Hello there sir. You should see this investment opportunity….” etc.
I know that would confuse the heck out of me.
August 2nd, 2006 at 12:20 pm
Yah, unfortunately I think the cat is out of the bag. It’s an interesting idea certainly, but now if I saw a bunch of spam sitting there, I’d be pretty sure what the problem was. Creating your own varient of the same thing could work, for sure, but relying on an third party with an existing algorithm seems like a bad idea since the name of the game is hiding the algorithm from your eavsdropper.