On Covert Acoustical Mesh Networks in Air

TL;DR

This paper demonstrates the feasibility of covert acoustical mesh networks using ultrasonic audio signals for stealthy communication, revealing security vulnerabilities and proposing countermeasures.

Contribution

It adapts underwater communication systems for covert air-based ultrasonic communication and extends it to multi-hop mesh networks, highlighting security implications.

Findings

Ultrasonic audio can be used for covert multi-hop communication.

Covert acoustical mesh networks can bypass traditional security measures.

Countermeasures like lowpass filtering and intrusion detection can detect such channels.

Abstract

Covert channels can be used to circumvent system and network policies by establishing communications that have not been considered in the design of the computing system. We construct a covert channel between different computing systems that utilizes audio modulation/demodulation to exchange data between the computing systems over the air medium. The underlying network stack is based on a communication system that was originally designed for robust underwater communication. We adapt the communication system to implement covert and stealthy communications by utilizing the ultrasonic frequency range. We further demonstrate how the scenario of covert acoustical communication over the air medium can be extended to multi-hop communications and even to wireless mesh networks. A covert acoustical mesh network can be conceived as a meshed botnet or malnet that is accessible via inaudible audio transmissions. Different applications of covert acoustical mesh networks are presented, including the use for remote keylogging over multiple hops. It is shown that the concept of a covert acoustical mesh network renders many conventional security concepts useless, as acoustical communications are usually not considered. Finally, countermeasures against covert acoustical mesh networks are discussed, including the use of lowpass filtering in computing systems and a host-based intrusion detection system for analyzing audio input and output in order to detect any irregularities.