Hiding A Secret Distributed Chat System In 802.11 Management Frames
summary
Implements a working distributed chat that hides messages and files inside 802.11 management frames, packing an AES-encrypted payload in probe requests (PoC uses ECB but recommends CBC/CTR for production). Uses Python + Scapy and an Alfa Atheros monitor-mode/injection card, splits large data into ~1.5 KB frame chunks, tags messages with a UID and sequence counter, and forces peers to retransmit (configurable, demonstrated ≈70 repeats) to form a range-extending mesh reaching ~100–200 m in demos.
AI-written summary · about
chapters (16)
- 0:00Introduction and motivation
- 2:27Covert channels and data exfiltration
- 5:45Required hardware and tools
- 8:12Wi-Fi frame structure basics
- 9:15Designing the hidden chat system
- 11:50Encryption and message handling
- 13:16Distributed chat system concept
- 16:55Live demonstration
- 20:37Technical implementation details
- 24:42Security and detection evasion
- 25:45Conclusion and resources
- 26:48Q&A session part 1
- 30:23Q&A session part 2
- 32:12Q&A session part 3
- 33:43Q&A session part 4
- 35:36Q&A session part 5
related talks
31mD1T1 - Covert Data Exfiltration Channel
33mWi-Fi Brokering
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
08mBit Whisperer: Enabling Ad-hoc, Short-range, Walk-Up-and-Share Data Transmissions via ...
31mCommSec D1 - Steganography Ante Portas
05mLightning Talk - Rampart Communications: Next Generation Wireless Security
34mPractical Side-Channel Attacks Against WPA-TKIP
27mWIFI-Important Remote Attack Surface: Threat is Expanding