STUN comprehension-optional attributes as a covert channel: design, implementation, and detection

Vista sencilla de ítem
dc.contributor.authorGorrochategui, Gorka
dc.contributor.authorZulaika Zurimendi, Unai
dc.contributor.authorGaraizar, Pablo
dc.date.accessioned2026-08-13T06:48:57Z
dc.date.available2026-08-13T06:48:57Z
dc.date.issued2026-11
dc.date.updated2026-08-13T06:48:57Z
dc.description.abstractReal-time communication protocols carry implicit trust at perimeter defenses because enterprise networks must allow them for Voice over IP (VoIP) and Web Real-Time Communication (WEBRTC) operation. Existing covert-channel literature has explored Session Initiation Protocol (SIP) signaling (Mazurczyk and Szczypiorski, 2008), Real-Time Transport Protocol (RTP)/RTCP media (Mazurczyk, 2013; Schmidt et al. 2018), and WEBRTC streams (Barradas et al. 2020; Figueira et al. 2022), but Session Traversal Utilities for NAT (STUN), despite its central role in NAT traversal and its ubiquity in modern networks, has not been investigated as a covert channel carrier. We design a Layer 2 covert channel that encapsulates arbitrary Ethernet frames within STUN comprehension-optional attributes, which RFC 5389 (Rosenberg et al., 2008) requires compliant implementations to silently ignore. A bidirectional polling mechanism overcomes STUN's client–server asymmetry, producing a full-duplex tunnel indistinguishable from legitimate Interactive Connectivity Establishment (ICE) keep-alive traffic. A portable proof-of-concept was implemented and deployed on two embedded Linux devices of distinct architectures: an ARM-based Yealink T19P E2 IP phone and a MIPS-based Ubiquiti EdgeRouter X. Empirical evasion testing was conducted against Snort 3 with 47,143 Talos rules, Suricata 8 with the ET Open ruleset, Zeek with the spicy_STUN analyzer, and a FortiGate 40F firewall running full Unified Threat Management (UTM) services. Across 3646 data-carrying covert messages, no signature or protocol-aware engine flagged the traffic as anomalous. To address the detection gap, we propose a lightweight Shannon-entropy detector applied to optional-attribute payloads. The mean per-attribute entropy of the covert channel reaches 6.247 bits/byte, well above the highest entropy observed in 1358 legitimate STUN messages from the ITC-Net-blend-60 dataset (4.392 bits/byte from Telegram). A 4.5 bits/byte threshold flags all 3646 covert messages while producing zero false positives across the legitimate corpus. These results expose a systemic detection gap in current network defense strategies and motivate the integration of entropy-aware inspection into Real-Time Communication (RTC) signaling protocols.en
dc.identifier.citationGorrochategui, G., Zulaika, U., & Garaizar, P. (2026). STUN comprehension-optional attributes as a covert channel: design, implementation, and detection. Computers and Security, 170. https://doi.org/10.1016/J.COSE.2026.105043
dc.identifier.doi10.1016/J.COSE.2026.105043
dc.identifier.issn0167-4048
dc.identifier.urihttps://hdl.handle.net/20.500.14454/6497
dc.language.isoeng
dc.publisherElsevier Ltd
dc.rights© 2026 The Authors
dc.subject.otherCovert channels
dc.subject.otherEntropy analysis
dc.subject.otherIntrusion detection
dc.subject.otherNAT traversal
dc.subject.otherNetwork security
dc.subject.otherOffensive security
dc.subject.otherReal-time communication
dc.subject.otherSTUN
dc.titleSTUN comprehension-optional attributes as a covert channel: design, implementation, and detectionen
dc.typejournal article
dcterms.accessRightsopen access
oaire.citation.titleComputers and Security
oaire.citation.volume170
oaire.licenseConditionhttps://creativecommons.org/licenses/by/4.0/
oaire.versionVoR
Archivos
Bloque original
Mostrando 1 - 1 de 1
Miniatura
Nombre:
gorrochategui_stun_2026.pdf
Tamaño:
1.85 MB
Formato:
Adobe Portable Document Format
Descargar
Colecciones
Artículos