Spooky Action at a Distance: Generating Waves over the Wire for Novel C2

on YouTube ↗49m

" summary

A new tool called QuantumCat encodes data as timing, size and port changes rather than payloads, using Scapy/Ethernet/ICMP/UDP/TCP (QUIC-friendly) to send packets as bits; a live demo sends packets across ~30 hops to a US‑West VM and reliably transfers a 6.4 MB executable in ~2 hours. Network sensors that rely on Snort/Zeek session inspection miss it because packets contain no payload; frequency modulation and amplitude modulation methods work and bi‑directional comms are possible, while detection requires expensive behavioral correlation.

AI-written summary · about

" chapters (14)

1. 0:00Spooky Action at a Distance intro
2. 1:05Traditional C2 concerns
3. 3:33Detection cross section
4. 8:12Layer Four and Five Detection Challenges
5. 11:04QuantumCat for covert comms
6. 13:15QuantumCat modulation
7. 17:43Live demo: frequency mod
8. 20:54Testing over 30 hops
9. 24:05Amplitude & phase mod
10. 28:48GitHub tools & evasion
11. 32:19Improving firewall rules
12. 34:29Network visibility strategies
13. 36:58Detecting QuantumCat challenges
14. 38:01Q&A

" related talks

• 31mCommSec D1 - Steganography Ante PortasSteffen Wendzel · Hack In The Box Amsterdam 2018
• 48mAir-Gap securityMordechai Guri, Yisroel Mirsky, Yuval Elovici · CODE BLUE 2016
• 46mCurio Collection of Web ProtocolsOle Michaelis · code.talks 2017
• 44mSmashing The State Machine: The True Potential Of Web Race ConditionsJames · Nullcon Goa 2023
• 21mSee Like a Bat: Using Echo-Analysis to Detect Man-in-the-Middle Attacks in LANsYisroel Mirsky · Black Hat Asia 2019
• 40mVisualizing SecurityJay Jacobs · BSidesSF 2020
• 38mHiding A Secret Distributed Chat System In 802.11 Management FramesYago Hansen · HITBSecConf 2019 Amsterdam
• 55mEtherify, sonify: soft tempest at home and on the farmJacek Lipkowski · Oh My H@ck 2020