Researchers find new way to hide messages in VoIP

Researchers have devised a new scheme for hiding secret data within VoIP (Voice over Internet Protocol) packets, making it possible to carry on legitimate voice conversations during stolen data piggybacks on the call undetected, making its way to thieves on the outside.

Called transcoding steganography or TranSteg, the method calls for setting a larger-than-necessary payload space in VoIP packets and using the extra room to carry covert messages. In their experiment the researchers could send 2.2MB of covert data in each direction while an average seven-minute phone call.

Researchers at the Warsaw Institute of Research 's Institute of Telecommunications say that depending on how TranSteg is set up, detection can be impossible. Nevertheless other scenarios make it possible to detect given the right type of monitoring.

One big hurdle to the practical use of TranSteg is that it requires modifying the machines that send and receive the steganographic messages, say the researchers led by Wojciech Mazurczy, who has developed other VoIP steganography techniques.

The steganography-sending

TranSteg can be set up using either end devices just as VoIP phones or intermediary network devices as the steganography-sending and -receiving nodes. So the possibilities are two VoIP phones could be involved; two intermediary devices could be involved; the sending phone and an intermediary device could be involved; or an intermediary device and the receiving phone could be involved.

If two VoIP phones are the sending and receiving nodes and they use secure RTP, it is impossible for network monitoring to detect TranSteg, the researchers say. However if any of the other scenarios is used, monitoring at more than one place along the connection could detect TranSteg, they say.