PaperlayerView exact revision on arXiv

Source-linked AI summary

On Covert Acoustical Mesh Networks in Air

Michael Hanspach, Michael Goetz

arXiv:1406.1213v1cs.CRcs.NIcs.SD

TL;DR

The paper addresses covert communication channels that bypass system and network policies by using audio hardware not ordinarily treated as a communications interface. It adapts an underwater acoustical network stack for ultrasonic over-air communication and extends it to multi-hop mesh networking. The resulting system transmits approximately 20 bit/s over distances up to 19.7 m, with a demonstrated three-hop path taking 18 s.

  • Problem

    Conventional security policies may overlook communications through speakers and microphones, allowing isolated computing systems with accessible audio hardware to exchange covert data.

  • Method

    The paper adapts an underwater acoustical communication stack and uses ultrasonic or near-ultrasonic audio modulation for multi-hop covert mesh communication.

  • Results

    Approximately 20 bit/s was achieved over distances up to 19.7 m between connected nodes, while a demonstrated three-hop path took 18 s.

  • Takeaways & Limitations

    Covert acoustical mesh networks can connect scattered systems and support covert services through inaudible audio transmissions, including multi-hop information leakage.

Abstract

from arXiv · show

Covert channels can be used to circumvent system and network policies by establishing communications that have not been considered in the design of the computing system. We construct a covert channel between different computing systems that utilizes audio modulation/demodulation to exchange data between the computing systems over the air medium. The underlying network stack is based on a communication system that was originally designed for robust underwater communication. We adapt the communication system to implement covert and stealthy communications by utilizing the ultrasonic frequency range. We further demonstrate how the scenario of covert acoustical communication over the air medium can be extended to multi-hop communications and even to wireless mesh networks. A covert acoustical mesh network can be conceived as a meshed botnet or malnet that is accessible via inaudible audio transmissions. Different applications of covert acoustical mesh networks are presented, including the use for remote keylogging over multiple hops. It is shown that the concept of a covert acoustical mesh network renders many conventional security concepts useless, as acoustical communications are usually not considered. Finally, countermeasures against covert acoustical mesh networks are discussed, including the use of lowpass filtering in computing systems and a host-based intrusion detection system for analyzing audio input and output in order to detect any irregularities.

I. INTRODUCTION

The paper proposes covert communication between computing systems through accessible speakers and microphones, using inaudible acoustical signals that bypass conventional network controls. It extends this channel to multi-hop mesh networks, even when systems are isolated by mandatory access-control policies.

  • Covert acoustical communication: Speakers and microphones provide an accessible communication medium that is not typically treated as a network interface or governed by security policies.The paper targets ultrasonic and near-ultrasonic frequencies to make transmissions stealthy.
  • Covert acoustical communication: Ultrasonic and near-ultrasonic frequencies enable covert communication by making acoustical transmissions inaudible or less detectable.The devices are commonly available and may already be accessible to applications needing audio functionality.
  • Covert acoustical mesh networks: Multi-hop routing extends the covert channel’s range and connects scattered devices into a wireless mesh network.The mesh contains participants that can act as infected victims, routers, attackers, or service-providing drones.
  • Scenario: Acoustical communication can connect application partitions on different computers despite isolation enforced through fine-grained mandatory access-control policies.The channel remains possible when both partitions can access shared audio hardware for legitimate audio applications.
  • Covert acoustical mesh networks: The scenario includes infected systems that exchange leaked information through compatible acoustic communication software installed by malware or by an attacker.Participants may be configured as senders, receivers, or both, depending on their role in the mesh.

A. A Network Stack for Acoustic Communication

The communication stack adapts a robust underwater acoustical networking system for terrestrial covert communication. Its modular layers combine application framing, lightweight networking, optional error correction, and an acoustic modem.

  • Stack rationale: The terrestrial system is built by adapting an underwater acoustical communication stack originally designed for robust communication.The paper motivates this choice because acoustical communication is established in underwater networks, whereas radio generally offers greater terrestrial range and rate.
  • Layered architecture: The stack separates application, network, error-correction, and physical-link functions into independently replaceable modules connected through internal TCP connections.The error-correction layer is optional for devices with limited processing power or memory.
  • Application Layer: GUWAL supplies 16-byte application frames containing a 2-byte header and a 2-byte CRC checksum for low-bandwidth underwater-style messaging.The frame format is reused as the application layer for the covert acoustical mesh network.
  • Application Layer: GUWAL uses compact source and destination addressing to save bandwidth while retaining an address range sufficient for small acoustic mesh networks.Its addresses can also serve as multicast addresses when needed.
  • Application Layer: The example application parses UTF-8 input, adds a payload-type byte, and sends frames containing up to eleven characters to the network layer.Frames are transmitted over a TCP connection between the application and network layers.

C. Network Layer

The network layer uses GUWMANET to route GUWAL messages across the acoustic mesh. It combines compact local addressing, per-hop forwarding information, reactive route establishment, and optional packet error correction.

  • C. Network Layer: GUWMANET reuses GUWAL’s 6-bit operational addresses and adds a 5-bit network address that is unique within the local 2-hop neighborhood.The local address supports neighbor distinction while avoiding the overhead of full network-wide uniqueness.
  • C. Network Layer: GUWMANET maintains end-to-end source and destination addresses while changing transmitter and last-hop addresses at every forwarding hop.This separates application-level endpoints from the nodes currently forwarding a message.
  • C. Network Layer: Route establishment uses reactive flooding: nodes repeat the first message they receive, record forwarding relationships, and the destination returns an acknowledgement.Temporary routing entries are created when a node overhears that it was selected as a last hop.
  • C. Network Layer: The physical link uses the Adaptive Communication System modem, while an optional error-correction layer can restore packets containing one or two bit errors.The correction layer can merge multiple error-prone versions of the same message into a correct packet.

3) Physical access using ACS modem:

The ACS modem adapts a robust underwater signaling system for ultrasonic air communication using frequency hopping, windowed waveforms, and receiver-side bandpass filtering.

  • JANUS-based ACS signaling uses FHSS with 48 carriers, including 20 carriers reserved for pure ultrasonic communication.The spectrogram exposes the frequency hopping within an ACS modem transmission.
  • The adapted modem uses a 21,000 Hz center frequency, 48,000 Hz sampling, and 1024 samples per bit to place transmissions in the ultrasonic range.
  • A trapezoid and square-root Hamming window improves differentiation between transmitted bits, producing the waveform shown in Figure 6.
  • The waveform begins with a 42 ms preamble for packet detection and synchronization before the transmitted data.
  • The receiver uses a Blackman-Harris bandpass FIR filter covering 20,400–23,000 Hz to isolate the transmitted frequency range.

IV. EXPERIMENTS AND MEASUREMENTS

Experiments with five Lenovo T400 laptops measured their audio-frequency capabilities and tested whether ultrasonic ACS transmissions could remain inaudible.

  • Five Lenovo T400 laptops running Debian 7.1 served as mesh-network participants in an untreated office/lab environment.
  • The laptops’ audio hardware was characterized by directly connecting line input and output and recording signals from 0 to 35,000 Hz.The resulting response reports relative sound-pressure attenuation across output frequencies.
  • Low-ultrasonic processing around 20,000 Hz was possible on Lenovo T400 systems, supporting ultrasonic or near-ultrasonic communication.
  • The ACS modem produced a pure ultrasonic transmission whose output frequency spectrum was recorded in Figure 9.
  • The adapted 0.042 s ultrasonic preamble was inaudible to experiment observers at the configured volume levels.

C. Range Experiment

Range and interconnection experiments demonstrate short-range ultrasonic links and a functioning five-node acoustical mesh, with direct line of sight supporting reliable multi-hop delivery.

  • C. Range Experiment: 8.2 m transmissions were observed at approximately 20 bit/s with the ACS modem, while the original near-ultrasonic waveform reached 19.7 m.
  • C. Range Experiment: The near-ultrasonic range below 20,000 Hz was more stable than the ultrasonic range because the hardware response decreased at frequencies ≥20,000 Hz.
  • C. Range Experiment: No bit errors were observed across the tested ranges, although approximately 20 bit/s was the most successful configured rate.
  • D. Interconnection Experiment with ACS Modem: The five-node mesh used direct line-of-sight links; communication through wall and door reflections did not establish connectivity.
  • D. Interconnection Experiment with ACS Modem: 18 s latency was measured for a three-hop transmission using four computers, and every packet reached the destination without bit errors after at most three retransmissions.
  • D. Interconnection Experiment with ACS Modem: Human speech did not considerably affect transmissions with the equiripple bandpass filter, but people blocking line of sight adversely affected connectivity.

V. APPLICATIONS OF COVERT ACOUSTICAL MESH NETWORKS

The paper demonstrates malicious applications of acoustical mesh networking, including multi-hop keylogging and forwarding captured keystrokes to Internet email through an SMTP/TCP/IP proxy.

  • A. A Multi-Hop Acoustical Keylogger: A multi-hop acoustical keylogger forwards keystrokes from an infected victim through infected drones until they reach a distant attacker.
  • A. A Multi-Hop Acoustical Keylogger: The implementation uses logkeys with root privileges, a named pipe, and a transmitter that sends accumulated keystrokes when a line-feed symbol is reached.
  • B. Connecting to and Tunneling over the Internet: An SMTP/TCP/IP proxy encapsulates collected keystroke frames and forwards them through an Internet-connected SMTP server as email.
  • B. Connecting to and Tunneling over the Internet: The receiver can pass data through a named pipe to a local or remote mail server, and GUWMANET/GUWAL headers can tunnel the protocol over HTTP/TCP/IP.

C. Other Applications for Covert Networks

The paper extends covert acoustical networks beyond data leakage by describing covert services and countermeasures that preserve ordinary audio functionality.

  • Other applications: Covert networks could periodically forward private encryption keys or small classified text files from infected victims.The data could also be spread across different environments when a computing system is carried around.
  • Other applications: An infected drone could act as a router while also providing covert services, such as access to further networks.One example is Internet access when the attacker is not directly connected to the Internet.
  • Countermeasures: Switching off audio devices may be impractical, so software-defined filtering offers an alternative against malicious covert-network participation.The discussed implementation uses ALSA with LADSPA on Linux-based systems.
  • Countermeasures: A 4-pole LADSPA lowpass filter with an 18,000 Hz cutoff effectively prevented inaudible communications in ALSA-based applications.The specific frequencies used by the acoustic modem could be filtered with bandpass or lowpass filtering.
  • Countermeasures: An audio intrusion detection system could detect modulated signals and handle audio according to signal characteristics rather than fixed filtering settings.The proposed approach can be implemented as an operating-system guard.

B. A Host-Based Audio IDS Designed as an Operating System Guard

The paper proposes a host-based audio intrusion detection guard that forwards audio while analyzing it for suspicious modulation, extending the covert-channel threat model to broader physical emanations and mesh-network malware.

  • Host-based audio IDS: The host-based audio intrusion detection guard forwards audio signals while storing them for stateful analysis inside the guard.Its architecture is similar to an audio filtering guard but adds an IDS state.
  • Host-based audio IDS: Frequency, amplitude, and phase analyses can detect digital signal processing modes and trigger filtering of suspicious audio interfaces.Highly suspicious ultrasonic signals could be pitched down to inform users of hidden audio activity.
  • Broader physical channels: The guard concept could also analyze other physical emanations, including modulated optical transmissions.The paper places systematic identification of such covert physical channels in future work.
  • Related work: The paper distinguishes its approach from command-and-control botnets by constructing a complete covert mesh network from acoustical emanations.This extends beyond using physical emanations only for command-and-control messages.
  • Related work: Unlike prior ultrasonic communication studies, the paper places ultrasonic communication in information security and demonstrates security-critical leakage over multiple infected-drone hops.The paper uses ultrasonic transmissions to build an air-based mesh network that is inaudible to human users.

VIII. CONCLUSION

The paper demonstrates feasible covert acoustical mesh networking over air using ordinary laptops and reports practical multi-hop transmission, while noting an unaddressed malware-infection step and proposing audio-based defenses.

  • Conclusion: Approximately 20 bit/s was achieved over 19.7 m between connected nodes using commonly available business laptops.The authors state that higher transmission rates would be possible over shorter distances.
  • Conclusion: A frame traversed the infected victim and two additional infected drones to reach the attacker in 18 s.The route demonstrates multi-hop covert acoustical communication over air.
  • Conclusion: The authors identify acoustical networking as a threat to high-assurance systems that omit acoustical communication from their security concepts.The conclusion states that such networking might break those systems’ security goals.
  • Limitation: The paper does not address how malware infects a computing system, although the authors state that this issue applies to covert-channel technologies generally.This leaves initial compromise outside the paper’s scope.
  • Countermeasures: When audio devices must remain available, software-defined lowpass filtering and host-based audio intrusion detection are proposed as countermeasures.The IDS analyzes audio input and output for modulated signals or hidden messages and may operate as an operating-system guard.
Loading 1406.1213v1…