On the Existence of Subliminal Channel in Instant Messaging Systems

Transcription

1 , pp On the Existence of Sbliminal Channel in Instant Messaging Systems Lingyn Xiang 1, Yha Xie 2, Gang Lo 3 and Weizheng Wang 1 1 School of Compter and Commnication Engineering, Changsha University of Science and Technology, Changsha , China 2 Lodi Mnicipal Office, SAT, Lodi , China 3 College of Information Science and Engineering, Hnan University, Changsha , China xiangly210@163.com, hades9527@163.com, @qq.com Abstract Sbliminal channel is a covert commnication channel that can secrely exchange secret information. By analyzing the commnication protocols and encryption algorithms of two poplar instant messaging systems QQ and Skype, this paper devotes the efforts to find whether they satisfy the condition of establishing sbliminal channel or not. The broad-band sbliminal channel can be established in Skype and QQ messages. Therefore, two sbliminal channel schemes are proposed to embed and extract sbliminal information. Finally, performances of the proposed sbliminal channels are compared with those of the ones based on ElGamal digital signatre and Newton channel. Experimental reslts and theoretical analysis show that they are easy to be implemented with large bandwidth and execte fast. Keywords: sbliminal channel, covert commnication, instant messaging, Skype, QQ 1. Introdction Sbliminal channel is a covert commnication channel constrcted in pblic channel. It hides additional message mainly in pblic-key cryptosystem, athentication, and digital signatre schemes. The sender and the designated receiver can transmit secret information by the sbliminal channel withot arosing sspicion from the pblic or channel warden. Since the concept of sbliminal channel was first proposed by Simmons [1] in 1983, it played a significant role in covert commnication. In covert commnication, sbliminal channel has prominent advantages. One is that the attackers cannot intitively discover the existence of sbliminal information, as the host of sbliminal channel is innocent and legitimate. The other is that the attacks cannot retrieve the transmitted secret information, which is comptationally infeasible even if they learned the existence of the sbliminal information. Crrently, many researchers have stdied on sbliminal channel and designed plenty sbliminal channel protocols [2-13]. Simmons not only proposed some narrow-band sbliminal channels [2] bt also a broad-band one [3] in DSA signatre schemes. Sbseqently, Anderson, et al., [5] constrcted a more secre broad-band sbliminal channel named Newton channel in ElGamal signatre scheme. Many sbliminal channels were also constrcted based on elliptic crves cryptosystem [6, 7], NTRU pblic-key cryptosystem [8], RSA-PSS signatre scheme [9], Lamport s one-time signatre schemes [10], and so on. ISSN: IJSIA Copyright c 2015 SERSC

2 Sbliminal channel severs as an important kind technology of information secrity, it can be widely applied. Chen, et al., [14] took the concept of sbliminal channel to propose a fair online payment system to protect the cstomer s ownership. Zhao, et al., [15] adopted the sbliminal channel to propose a variant of the reversible watermarking scheme with improved secrity. Reviewed the related work, sbliminal channels constrcted in signatre schemes are the main trend, which embedded secret information into signatres, whereas, they had the disadvantages of low transmission efficiency, limited sbliminal capacity, and no real time. Moreover, freqently transmitted signatres are easily sspected. To overcome these shortcomings, instead of generating a new signatre, a sbliminal channel is sggested to be established in an existing natral legitimate host like instant messages. On the other hand, with the poplation of instant messaging (IM), and gradally development from the individal applications extended to enterprise application and commercial applications in today, the messages of IM have become the ideal carrier of sbliminal information. IM is a type of online chat which offers real-time commnication over the Internet. The main typically transmitted messages inclde real-time text, images, adio, video, clickable hyperlinks, etc. De to secrity concerns, secre IM platforms always encrypt the contents of the messages. The se of encryption algorithms provides the possibility of establishing sbliminal channel. As the existing monitoring systems can only monitor the commnication of pblic channel, bt not take effective detection on commnication of sbliminal channel. So it s essential to deploy in-depth research and analysis on the existence of sbliminal channel in IM messages. In this paper, the existence of sbliminal channel in two poplar IM systems QQ and Skype has be analyzed by stdying their commnication protocols and encryption algorithms. In addition, embedding and extraction algorithms of sbliminal information in QQ and Skype messages have been designed. Finally, the comparison with the other typical sbliminal channels based on digital signatre is made from the aspects of bandwidth, embedding/extraction algorithmic efficiency and accracy. 2. Existence Analysis on Sbliminal Channel in Poplar IM Systems Most cryptographic algorithms of pblic-key cryptosystem have the probabilistic characteristic. One plaintext may correspond to several ciphertexts. This randomness of the cryptosystem is a necessary condition for existence of the sbliminal channel. Ths, the cryptographic algorithms with randomness can serve as the host of sbliminal channels, and the sbliminal information can be hidden in the randomness. For the warden in the Prisoners problem introdced by Simmons [1], the randomness of a cryptosystem mainly incldes three categories: 1) the stochastic parameters inptted from the cryptosystem, sch as the session key in a probabilistic digital signatre scheme. They are the main sorce of randomness; 2) the randomness cased by the redndancy of the representation of the plaintext. The same semantic can be expressed into several possible message symbols; 3) the semantic randomness of the sent messages, namely, the warden is ncertain to the content of the being sent messages. If the eqivocation in different semantics is not 0, then the corresponding otpt encrypted data is randomness for the warden. As long as the encrypted data has the aforementioned randomness for the warden, the sbliminal channel exists. The cryptographic algorithms of conventional symmetric key cryptosystem are always only sed for encryption. One plaintext can be only encrypted to a niqe cipher text for the same key. In this case, sally no random redndant information can be tilized, so there is generally no practical sbliminal channel existing in a symmetric cryptographic algorithm. 354 Copyright c 2015 SERSC

3 At present, there are many available IM systems (Skype, Tencent QQ, Facebook Messenger, Twitter, Ubiqe, etc.,). Most of them are non-standard systems with their own different cryptosystem and commnication protocols. In addition, the developers of IM systems treat their own technologies in confidence de to their interests. Becase the sed protocols and cryptosystems are not nified standard and pblic, it makes the existence of sbliminal channel has its own particlarity in all kinds of IM systems. Therefore, the researches on the existence of sbliminal channels in IM systems shold be separately carried ot for different ones. In this paper, two representative IM systems Skype and QQ have been analyzed Existence of sbliminal channel in Skype Skype is a freemim voice-over-ip service and instant messaging client, originally developed from Erope and crrently developed by Microsoft-owned Skype technologies. De to its good voice transmission qality and high secrity, it has hge amont of registered sers from all over the world, 663 million at the end of 2010 [16]. In order to secrely commnicate, Skype ses standard cryptographic primitives inclding the AES, RSA, the ISO signatre padding scheme, the SHA-1 hash fnction, RC4 stream cipher, and so on [17]. In conclsion, Skype reportedly ses two encryption techniqes. One is RSA for key negotiation; the other is the AES to encrypt conversations. The instant messages transmitted throgh a session are encrypted by AES algorithm from Skype-end to Skype-end withot passing throgh any intermediary node. The AES implemented by Skype does not completely the same with the standard AES. It is impossible to know the details of the implementation of Skype AES. All packet data in a session in Skype are served as the plaintext and placed in a bffer. The plaintext except for the last two bytes in a Skype bffer is encrypted by the followed encryption protocol [17]: 1) Sccessive blocks of plaintext are XORed to AES cipher blocks with a key established for the session. The size of an inpt block is 128 bits. Its strctre is: salt:salt:packet_index:block#, where packet_index is a 48-bit vale, block# is a 16 bit vale. The size of the sed key is 256 bits. 2) A CRC checksm is calclated on the contents of the encrypted bffer. The mod 2 sm of the CRC with the low order 2 bytes of the packet_index is stored in the last 2 bytes of the bffer. 3) Note: Only the low order bits of the AES conter change from block to block while encrypting a bffer. The packet_index changes from bffer to bffer. The salts are contribted by each Skype client and are random vales. Althogh Skype ses AES, which is a symmetrical block cipher algorithm, it pads random nmbers into the packet data before encryption. So there is a certain amont of random redndancy in Skype encryption protocol, this provides the condition of establishing sbliminal channel in Skype messages. Set sbliminal information is U, then the sender can replace the random nmber salt in the inpt block with U; while the receiver can extract the sbliminal information by separating random nmber salt in the received inpt block. Therefore, the sbliminal channel is sccessflly established in Skype messages, and its bandwidth is the total length of the sed random nmber salt. According to the definition of broad-band sbliminal channel[3], if a sbliminal channel ses all or almost all the sbliminal space in the channel, it is defined as a broad-band one, so the sbliminal channel constrcted in Skype messages belongs to broad-band sbliminal channel. Copyright c 2015 SERSC 355

4 2.2 Analysis of the existence of sbliminal channel in QQ Tencent QQ, poplarly known as QQ, is an IM system service developed by Chinese company. It is the most poplar IM system in China with the largest nmber of sers. As of 20 March 2013, there are million active QQ acconts. QQ ses 16-R Tiny Encryption Algorithm (TEA) to encrypt the text message in a session. TEA is a block cipher algorithm invented by David Wheeler and Roger Needham of Cambridge Compter Laboratory in Its secrity can be improved by increasing the nmber of its encryption ronds. De to the length of the instant messages reqired to be encrypted by TEA in QQ commnication is variable, a stffing techniqe is sed to transform the message before encryption. A message will be transformed into a plaintext named as the QQ message packet. The details of the stffing process are described as follows: 1) Let a ( len 1 0 ) m o d 8, where len is the length of the sent instant message. 2) Let b a 0 x F8, and then stff b into the first byte of the plaintext. 3) Stff the second to the ( a 3) -th bytes of the plaintext by random nmbers. 4) Stff the content of the transmitted QQ message into the plaintext starting from the ( a 4 ) -th byte. 5) Stff sccessive 0 into the end of the plain text ntil the length of the plain text in bytes is a mltiple of 8. Ths, the strctre of the plaintext transformed from a message of QQ can be expressed as: b#:random nmber #:message#:0#. The sing of random nmber creates a condition for sbliminal channel existing in QQ messages. The form of sbliminal channel existing in QQ messages is similar to that in Skype messages, bt the former has its own characteristic in aspect of the bandwidth. The amont of sbliminal information in each QQ message is limited by the length of the sent message. According to the stffing process, we can calclate the bandwidth of the corresponding sbliminal channel B a 2, namely, B ( len 1 0 ) m o d 8 2. Therefore, it can obtain a conclsion that the maximm bandwidth is 9 bytes, while the minimm bandwidth is 2 bytes. The relationship between len and the band width is shown in Table1, where k is an arbitrary integer. As a reslt, in order to take fll advantage of the sbliminal channel bandwidth in each QQ message, the length of the sent message mst be 8*k+5 bytes. In this case, the sbliminal channel bandwidth can reach the maximm. Similar to the Skype, the sbliminal channel in QQ messages is broad band. Table 1. The Relationship between the Message Length and the Sbliminal Channel Bandwidth in QQ Messages Message length(byte) Sbliminal channel bandwidth(byte) 8*k 8*k+1 8*k+2 8*k+3 8*k+4 8*k+5 8*k+6 8*k Sbliminal Channel Schemes in IM Systems According to the above analysis, when the sender wants to send secret information to the receiver, he/she can embed it into the instant messages via sbliminal channel. The secret information can be recovered from the received instant messages withot sspicion. Ths, we design sbliminal channel schemes in IM Skype and QQ messages to transmit secret information, respectively. 356 Copyright c 2015 SERSC

5 3.1 Sbliminal Channel Scheme in IM Skype The precondition of embedding sbliminal information via Skype messages is the random nmber in the data strctre before Skype encryption. The sbliminal channel scheme incldes two algorithms: sbliminal information embedding algorithm and sbliminal information extraction algorithm. A ser of Skype ses the embedding algorithm to send instant messages with sbliminal information while the other ser ses the extraction algorithm to recover the sbliminal information when he/she receives the messages. The two commnicating sers will share a key for encrypting the sbliminal information. The details of the algorithm are as follows. Algorithm 1: Embedding Algorithm of Sbliminal Information in the Skype Messages Step1: Calclate the bit length of sbliminal information U and denote it as L e n, then stff meaningless dada into U ntil L e n is divisible by 64. Step2: Chaotic modlate and encrypt U with a shared key K in order to obtain a psedorandomized information U. It shold be noted that U mst have the same length with U. Step3: Estimate the bit length of the reqired Skype message L en by M L e n L e n, if M the bit length of Skype message M L en L en, then stff meaningless data into M ntil M L en L en M. Step4: Divide M into 16 bits eqal-size blocks, and denote the i -th block as M. Then i divide U into blocks, and denote its i -th block as U, the nmber of blocks as 2 N. i Step 5: Initialize i 1. Step 6: Constrct the inpt block by replacing the random nmber salt in the strctre of Skype inpt block with the blocks from U. Ths, the constrcted i -th inpt block is: U 2i 1# 2 i U # packet_index# M. i i 1 i Step7: Encrypt the constrcted i -th inpt block by AES. Step8: If i N, then go to step 6, otherwise end the algorithm. The sbliminal channel capacity of an instant message sent by a ser of Skype is determined by the message length. As the message have a variable length, it may not have the enogh sbliminal space to carry the reqired secret information. We can deal with it by two methods. One is to stff arbitrary meaningless data into the message to expand its length. The above Algorithm 1 ses it. The other is to partition the secret information into several segments, one can be jst embedded into the crrent message and other segments will be embedded into next Skype messages.. Algorithm 2: Extraction Algorithm of Sbliminal Information in the Skype Messages Step1: For the encrypted message received from the Skype client, decrypt it by AES. Step2: Seqentially extract the first 64 bits of each decrypted 128-bit block and denote the whole extracted information as D. Step3: Obtain the sbliminal information U by decrypting D sing the shared key K. 3.2 Sbliminal Channel Scheme in IM QQ As the message of QQ will be stffed by random nmber before being encrypted, the sbliminal channel can be established in QQ messages. We design a sbliminal channel scheme in QQ, which is similar to that in Skype. 4 Copyright c 2015 SERSC 357

6 Algorithm 3: Embedding Algorithm of Sbliminal Information in the QQ Messages Step1: Chaotic modlate and encrypt the sbliminal information U with a shared key K, and then obtain a psedo-randomized information U. Step2: Calclate the byte length L en of sbliminal information U, where 1 L en 1 0, and calclate the byte length L en of the sent QQ message M. M Step3: According to Table 1, estimate the sbliminal channel bandwidth B of M. Step4: If B L en, then go to Step5; if B L en, then n L en B ; if B L en, then n B L en 8. Step5: Stff n spaces into the message M. Step6: Use U as the random nmber and M to constrct a QQ message packet P. Step7: Encrypt P by TEA. Since each QQ message can be embedded 9 bytes at most, if the length of the secret information exceeds 9 bytes, it shold partition the secret information into several segments and separately embeds them into several QQ messages. Algorithm 4: Extraction Algorithm of Sbliminal Information in the QQ Messages Step1: Decrypt the message packet received from the QQ client by TEA and denote it as P. Step2: Read the first byte of P and denote its vale as b. Step3: Calclate a b & 0 x07. Step4: Read the data D from the second to ( a 3) -th bytes of P. Step5: Decrypt D by TEA sing the shared key K to obtain the sbliminal information U. 3.3 Performance Analysis of the Two Schemes Sbliminal Capacity: By the strctre of Skype inpt block and encryption algorithm, it can find that the sbliminal space of Skype messages is increased with the increase of the message length. The sent message is divided into blocks for encryption by AES. Each 128-bit inpt block of AES contains 16-bit Skype message and 64-bit random nmbers, which are sed to embed the sbliminal information. The ratio of sbliminal information to the Skype message is 4 to 1. Ths, the Skype commnication has a great sbliminal space. By the stffing process of the QQ sed before encryption, the sbliminal channel in each QQ message can only send 2 to 9 bytes of sbliminal information, which is determined by the length of the transmitted message in this commnication. The sbliminal space in a QQ message is limited. Long sbliminal information shold be segmented and be embedded into several QQ messages. In conclsion, the embedding capacity of the sbliminal channel in the IM can be enlarged by sing more instant messages Secrity: The secrity of the proposed sbliminal channel schemes in IM systems can be garanteed by the following three aspects: 1) The cracker is difficlt to discover the existence of sbliminal channel. The sbliminal information is embedded into the sent instant message in the form of psedo legitimate data. And it will be recovered before the receiver reads the content of the instant message. 2) The sbliminal information is chaotic modlated and encrypted, and the sent message with sbliminal information is also be encrypted by encryption algorithm sed in the IM systems, even if the IM commnicates are sspected, it also cannot detect and recover the sbliminal information. 358 Copyright c 2015 SERSC

7 3.3.3 Algorithmic Efficiency: The proposed schemes do not need to apply hash fnction and asymmetric encryption to the original data, and jst directly encrypt secret information by symmetric encryption algorithm. Secret information with arbitrary length can be segmented to be embedded into instant messages. Ths, compared with the previos sbliminal channel schemes based on digital signatre algorithms, the proposed schemes cost fewer times and have a faster embedding speed to embed the same secret information. 4 Experimental Reslts The sbliminal channels in ElGamal digital signatre schemes are broadband and the sender and receiver share a private key. The proposed sbliminal channels in Skype and QQ messages belong to the same type of sbliminal channel with the ones in ElGamal. Newton channel is also broadband, bt the sender and receiver do not share a private key, a receiver can jst calclate a part of the private key. At the same time, it can exploit only half of signed data to embed information. Its bandwidth is slightly smaller than that of the traditional broadband sbliminal channel. We selected 10,000 random signatre messages to embed sbliminal information by sing the sbliminal channel in ElGamal digital signatre scheme and in Newton channel[6]. And the experiments are also condcted on embedding sbliminal information into QQ and Skype messages. As examples, in the ELGamal digital signatre scheme: p = , g =2, x = , k is a random nmber with g cd ( k, p 1) 1. In the Newton channel: p = , x = , g = q = The experimental reslts are list in Table 2. Shown by the Table 2, the sbliminal channels in QQ and Skype messages have a great advantage in the extraction speed and bandwidth. In addition, the sbliminal capacity can be enlarged with the amont of the sed instant messages increasing. Especially, they are simple to be realized. Therefore, they have important vales in generalization and application. Table 2. The Performance Comparison of the Different Sbliminal Channels Skype QQ ElGamal Newton Embedding High, when k satisfies High High High speed the constraint condition bit/ms. 1.6KB/ms. 1.5KB/ms bit/ms. (It shares all keys, and (It shares all (It shares all (It needs to solve Extraction needs to solve the keys, and jst keys, and jst the discrete speed eqation for extraction decrypts sing decrypts sing logarithm when < AES.) TEA.) problem.) k< ) Embedding 100% 100% 32.5%, when k satisfies 100%, when p 1 Copyright c 2015 SERSC 359

8 accracy the constraint condition. is B smooth. Extraction accracy 100% 100% 100% 100% Maximal bandwidth 5 Conclsions 4 times of the length of the sent instant message 9 bytes lo g ( p 1) bits lo g q bits In this paper, the sbliminal channel schemes in Skype and QQ are proposed, as the existence of the random nmber in the data packet generated from Skype and QQ commnications. Combined with IM technology, the sbliminal channel has some new characteristics: simple to se, good imperceptibility, high efficiency and large bandwidth. Secret information can be secrely transmitted with the Skype and QQ messages. Unfortnately, the sbliminal channel can also be sed by the terrorists or illegal grops for exchanging illegal information. Therefore, the ftre work shold focs towards detecting the presence of nlawfl information in the sbliminal channel established in the IM messages. ACKNOWLEDGEMENTS This project is spported by National Natral Science Fondation of China (Nos , , ), the Scientific Research Fnd of Hnan Provincial Edcation Department (Grant no. 12C0011), Science and technology project of Hnan Province (2012GK4006), and Scientific research projects in Colleges and niversities of Hnan Province in 2012 (12C0560). References [1] G. J. Simmons, The Prisoner s Problem and the Sbliminal Channel, Proceedings of CRYPTO 84, (1984), Agst 19-22, California, America. [2] G. J. Simmons, The Sbliminal Channels of the US Digital Signatre Algorithm (DSA), Proceedings of the 3rd Symposim on: State and Progress of Research in Cryptography, (1993) Febrary 15-16, Roma, Italy. [3] G. J. Simmons, Sbliminal Commnication Is Easy Using the DSA. Advances in Cryptology - EUROCRYPT 93, LNCS, vol. 765, (1994), pp [4] G. J. Simmons, Sbliminal Channels: Past and Present, Eropean Transactions on Telecommnications, vol. 5, no. 4, (1994), pp [5] G. J. Simmons, The history of sbliminal channels, IEEE Jornal on Selected Area in Commnication, vol. 16, no. 4, (1998), pp [6] R. Anderson, S. Vandeney, B. Preneel and K. Nyberg, The Newton Channel. Third International Workshop on Information Hiding (IH99), (1999) September 29 - October 1, Dresden, Germany. [7] X. Zho, X. Yang, P. Wei and Y. H, An Anonymos Threshold Sbliminal Channel Scheme Based on Elliptic Crves Cryptosystem, The 7 th International Conference on Compter-Aided Indstrial Design and Conceptal Design, (2006) November 7-9, Hangzho, China. [8] Y. Xie, X. Sn, L. Xiang and G. Lo, A Secrity Threshold Sbliminal Channel Based on Elliptic Crve Cryptosystem, International Conference on Intelligent Information Hiding and Mltimedia Signal, (2008) Agst 15-17, Harbin, China. [9] Q. Cai and Y. Zhang, Sbliminal Channels in the NTRU and the Sbliminal-free Methods, Whan University Jornal of Natral Sciences, vol. 11, no. 6, (2006), pp [10] J. M. Bohli and R. Steinwandt, On Sbliminal Channels in Deterministic Signatre Schemes, The 7th International Conference on Information Secrity and Cryptology (ICISC 2004), (2004) December 2-3, Seol, Korea. [11] D. R. Lin, C. Wang, Z. K. Zhang and D. J. Gan, A Digital Signatre with Mltiple Sbliminal Channels and Its Applications, Compters & Mathematics with Applications, vol. 60, no. 2, (2010), pp [12] K. Kim, F. Zhang and B. Lee, Exploring Signatre Schemes with Sbliminal Channel, The 2003 symposim on cryptography and information secrity, (2003) Janary 26-29, Hamamast, Japan. [13] C. L. Yang and C. M. Li, Sbliminal Channels in the Identity-based Threshold Ring Signatre, International Jornal of Compter Mathematics, vol. 86, no. 5, (2009), pp Copyright c 2015 SERSC

9 [14] X. J. Xin and Q. B. Li, Constrction of Sbliminal Channel in Id-based Signatres, 2009 WASE International Conference on Information Engineering(ICIE 2009), (2009) Jly 10-11, Shanxi, China. [15] C. L. Chen and J. J. Liao, A Fair Online Payment System for Digital Content via Sbliminal Channel, Electronic Commerce Research and Applications, vol. 10, no. 3, (2011), pp [16] Skype, (2014), [17] T. Berson, Anagram Laboratories, Skype Secrity Evalation, (2005), Athors Lingyn Xiang, she received her B.E. degree in compter science and technology, in 2005, and the Ph. D. degree in compter application, in 2011, Hnan University, Hnan, China. Crrently, she is a Lectrer in College of Compter and Commnication Engineering, Changsha University of Science & Technology, Hnan, China. Her research interests inclde network and information secrity, steganography, steganalysis, machine learning. Yha Xie, he received his B.E. degree in compter science and technology, in 2005, and the M.E. degree in compter science and technology in 2009, Hnan University, Hnan, China. Crrently, he is a civil servant working for the Lodi Mnicipal Office, SAT, Lodi, China. His research interests inclde network and information secrity. Gang Lo, he received his B.E. degree in microelectronics technology, in 1998, the M.E. degree in software engineering, in 2004, and the Ph. D. degree in compter application, in 2008, Hnan University, Hnan, China. Crrently, he is an associate professor in College of Information Science and Engineering, Hnan University, Hnan, China. His research interests inclde information secrity, steganalysis, information hiding, and cryptanalysis.+ Weizheng Wang, he received his B.S. degree in applied mathematics, in 2005, and the Ph. D. degree in compter application, in 2011, Hnan University, Hnan, China. Crrently, he is a Lectrer in College of Compter & Commnication Engineering, Changsha University of Science and Technology. His research interests inclde bilt-in self-test, design for testability, low-power testing, and test generation. Copyright c 2015 SERSC 361

10 362 Copyright c 2015 SERSC