STUN comprehension-optional attributes as a covert channel: design, implementation, and detection
Cargando...
Fecha
2026-11
Título de la revista
ISSN de la revista
Título del volumen
Editor
Elsevier Ltd
Resumen
Real-time communication protocols carry implicit trust at perimeter defenses because enterprise networks must allow them for Voice over IP (VoIP) and Web Real-Time Communication (WEBRTC) operation. Existing covert-channel literature has explored Session Initiation Protocol (SIP) signaling (Mazurczyk and Szczypiorski, 2008), Real-Time Transport Protocol (RTP)/RTCP media (Mazurczyk, 2013; Schmidt et al. 2018), and WEBRTC streams (Barradas et al. 2020; Figueira et al. 2022), but Session Traversal Utilities for NAT (STUN), despite its central role in NAT traversal and its ubiquity in modern networks, has not been investigated as a covert channel carrier. We design a Layer 2 covert channel that encapsulates arbitrary Ethernet frames within STUN comprehension-optional attributes, which RFC 5389 (Rosenberg et al., 2008) requires compliant implementations to silently ignore. A bidirectional polling mechanism overcomes STUN's client–server asymmetry, producing a full-duplex tunnel indistinguishable from legitimate Interactive Connectivity Establishment (ICE) keep-alive traffic. A portable proof-of-concept was implemented and deployed on two embedded Linux devices of distinct architectures: an ARM-based Yealink T19P E2 IP phone and a MIPS-based Ubiquiti EdgeRouter X. Empirical evasion testing was conducted against Snort 3 with 47,143 Talos rules, Suricata 8 with the ET Open ruleset, Zeek with the spicy_STUN analyzer, and a FortiGate 40F firewall running full Unified Threat Management (UTM) services. Across 3646 data-carrying covert messages, no signature or protocol-aware engine flagged the traffic as anomalous. To address the detection gap, we propose a lightweight Shannon-entropy detector applied to optional-attribute payloads. The mean per-attribute entropy of the covert channel reaches 6.247 bits/byte, well above the highest entropy observed in 1358 legitimate STUN messages from the ITC-Net-blend-60 dataset (4.392 bits/byte from Telegram). A 4.5 bits/byte threshold flags all 3646 covert messages while producing zero false positives across the legitimate corpus. These results expose a systemic detection gap in current network defense strategies and motivate the integration of entropy-aware inspection into Real-Time Communication (RTC) signaling protocols.
Palabras clave
Covert channels
Entropy analysis
Intrusion detection
NAT traversal
Network security
Offensive security
Real-time communication
STUN
Entropy analysis
Intrusion detection
NAT traversal
Network security
Offensive security
Real-time communication
STUN
Descripción
Materias
Cita
Gorrochategui, G., Zulaika, U., & Garaizar, P. (2026). STUN comprehension-optional attributes as a covert channel: design, implementation, and detection. Computers and Security, 170. https://doi.org/10.1016/J.COSE.2026.105043