Examinando por Autor "Gorrochategui, Gorka"

Mostrando 1 - 2 de 2
  • Miniatura
    Ítem
    Covert L2/L3 tunneling via SIP signaling on embedded hardware: attack, evasion, and detection
    (Academic Press, 2026-10) Gorrochategui, Gorka; Zulaika Zurimendi, Unai ; Garaizar, Pablo
    Covert channels exploiting application-layer protocols represent a persistent threat in enterprise environments, particularly when targeting endpoints that remain outside the scope of endpoint detection and response solutions, such as embedded Voice over Internet Protocol (VoIP) phones. Existing SIP-based covert channels either embed low-bandwidth steganographic data within call-lifecycle signaling messages (Mazurczyk and Szczypiorski, 2008; Mehić et al., 2014; Tsiatsikas et al., 2015), or achieve higher capacity by requiring active Real-time Transport Protocol (RTP) media streams (Schmidt et al., 2018; Saenger et al., 2020). However, to our knowledge, no prior work implements continuous Layer 2/Layer 3 tunneling over standalone SIP signaling outside of call contexts, nor validates such a channel on real embedded hardware against multiple network intrusion detection systems. We present a covert channel that encapsulates arbitrary Ethernet frames and IP packets within SIP OPTIONS messages, which are lightweight requests typically used for NAT keep-alive and capability probing, without establishing any voice call. A portable proof-of-concept with TUN/TAP virtual interfaces and ChaCha20 symmetric encryption has been implemented and deployed on two ARM-based IP phones from different vendors, showing that even resource-constrained embedded devices can serve as covert network egress nodes. Empirical evasion testing against Suricata, Snort 3, Zeek, and a FortiGate firewall with full Unified Threat Management (UTM) services reveals that the channel achieves a secure operating bandwidth of 128 kbit/s without triggering alerts on any of the tested platforms. Analysis of the tested rulesets and parsers reveals the absence of entropy-based or header-length anomaly rules for Session Initiation Protocol (SIP), accounting for the detection gap. To address this, we implement a lightweight statistical detection mechanism that analyzes non-standard SIP header entropy, showing that the covert channel can be identified through targeted analysis of header content. The gap is not inherent to SIP: current rulesets inspect syntax but not header content, length, or entropy. Adding any of these features is sufficient to detect the channel, as shown by the Zeek script and Suricata 8 rule provided as supplementary material. A single entropy threshold can itself be evaded through low-entropy padding. We therefore show that multi-feature and anomaly-based detectors recover identification of the channel where the scalar test fails. We also contribute a synthetic benign SIP corpus, generated with SIPp to emulate multiple devices and signaling scenarios, released as supplementary material for evaluating false positives beyond the single legacy dataset previously available.
  • Miniatura
    Ítem
    STUN comprehension-optional attributes as a covert channel: design, implementation, and detection
    (Elsevier Ltd, 2026-11) Gorrochategui, Gorka ; Zulaika Zurimendi, Unai ; Garaizar, Pablo
    Real-time communication protocols carry implicit trust at perimeter defenses because enterprise networks must allow them for Voice over IP (VoIP) and Web Real-Time Communication (WEBRTC) operation. Existing covert-channel literature has explored Session Initiation Protocol (SIP) signaling (Mazurczyk and Szczypiorski, 2008), Real-Time Transport Protocol (RTP)/RTCP media (Mazurczyk, 2013; Schmidt et al. 2018), and WEBRTC streams (Barradas et al. 2020; Figueira et al. 2022), but Session Traversal Utilities for NAT (STUN), despite its central role in NAT traversal and its ubiquity in modern networks, has not been investigated as a covert channel carrier. We design a Layer 2 covert channel that encapsulates arbitrary Ethernet frames within STUN comprehension-optional attributes, which RFC 5389 (Rosenberg et al., 2008) requires compliant implementations to silently ignore. A bidirectional polling mechanism overcomes STUN's client–server asymmetry, producing a full-duplex tunnel indistinguishable from legitimate Interactive Connectivity Establishment (ICE) keep-alive traffic. A portable proof-of-concept was implemented and deployed on two embedded Linux devices of distinct architectures: an ARM-based Yealink T19P E2 IP phone and a MIPS-based Ubiquiti EdgeRouter X. Empirical evasion testing was conducted against Snort 3 with 47,143 Talos rules, Suricata 8 with the ET Open ruleset, Zeek with the spicy_STUN analyzer, and a FortiGate 40F firewall running full Unified Threat Management (UTM) services. Across 3646 data-carrying covert messages, no signature or protocol-aware engine flagged the traffic as anomalous. To address the detection gap, we propose a lightweight Shannon-entropy detector applied to optional-attribute payloads. The mean per-attribute entropy of the covert channel reaches 6.247 bits/byte, well above the highest entropy observed in 1358 legitimate STUN messages from the ITC-Net-blend-60 dataset (4.392 bits/byte from Telegram). A 4.5 bits/byte threshold flags all 3646 covert messages while producing zero false positives across the legitimate corpus. These results expose a systemic detection gap in current network defense strategies and motivate the integration of entropy-aware inspection into Real-Time Communication (RTC) signaling protocols.