Hiding Information in Retransmissions

TL;DR

This paper introduces RSTEG, a novel steganographic technique that exploits TCP retransmission mechanisms to covertly transmit data, with detailed analysis and simulation results on its bandwidth and network impact.

Contribution

The paper proposes RSTEG, a new method for network steganography that leverages retransmission protocols to hide information, expanding the scope of covert communication techniques.

Findings

RSTEG achieves measurable steganographic bandwidth.

It influences the level of network retransmissions.

The method is applicable to various retransmission mechanisms.

Abstract

The paper presents a new steganographic method called RSTEG (Retransmission Steganography), which is intended for a broad class of protocols that utilises retransmission mechanisms. The main innovation of RSTEG is to not acknowledge a successfully received packet in order to intentionally invoke retransmission. The retransmitted packet carries a steganogram instead of user data in the payload field. RSTEG is presented in the broad context of network steganography, and the utilisation of RSTEG for TCP (Transport Control Protocol) retransmission mechanisms is described in detail. Simulation results are also presented with the main aim to measure and compare the steganographic bandwidth of the proposed method for different TCP retransmission mechanisms as well as to determine the influence of RSTEG on the network retransmissions level.