[Paper Review] Steganography using the Extensible Messaging and Presence Protocol (XMPP)

Reshad Patuck, Julio Hernández-Castro|arXiv (Cornell University)|Sep 27, 2013

User Authentication and Security Systems8 citations

TL;DR

This paper presents the first steganographic framework, StegMPP, for hiding data within the Extensible Messaging and Presence Protocol (XMPP) by exploiting protocol-level metadata such as the 'type' attribute, 'id' values, and 'xml:lang' presence. It demonstrates that most channels remain undetected by stateless wardens and shows minimal entropy differences, indicating resilience against entropic steganalysis, though some channels are detectable by stateful wardens with high computational cost.

ABSTRACT

We present here the first work to propose different mechanisms for hiding data in the Extensible Messaging and Presence Protocol (XMPP). This is a very popular instant messaging protocol used by many messaging platforms such as Google Talk, Cisco, LiveJournal and many others. Our paper describes how to send a secret message from one XMPP client to another, without raising the suspicion of any intermediaries. The methods described primarily focus on using the underlying protocol as a means for steganography, unlike other related works that try to hide data in the content of instant messages. In doing so, we provide a more robust means of data hiding and additionally offer some preliminary analysis of its general security, in particular against entropic-based steganalysis.

Motivation & Objective

• To develop a covert communication channel within XMPP that remains undetected by intermediaries.
• To exploit protocol-level redundancy in XMPP instead of message content for more robust steganography.
• To evaluate resistance against both stateless and stateful wardens, particularly in the context of entropic steganalysis.
• To provide a proof-of-concept tool, StegMPP, for practical implementation and testing of these steganographic techniques.
• To explore methods to harden channels against stateful warden detection through dynamic channel switching.

Proposed method

• Hiding one bit per message by manipulating the 'type' attribute, which is ignored by XMPP servers and passed verbatim to recipients.
• Using unique, discarded 'id' values as a covert channel, especially when sent to multiple clients to avoid detection.
• Exploiting the presence or absence of the 'xml:lang' attribute to encode hidden data, though this channel is less secure due to higher detectability.
• Utilizing leading and trailing spaces in XML elements as steganographic carriers, though these were found to be less effective.
• Applying case variation of the 'type' attribute as a potential channel, though removed from StegMPP due to detectability by stateless wardens.
• Simulating both stateless and stateful wardens to evaluate detectability, with the latter requiring tracking message sequences and state changes.

Experimental results

Research questions

• RQ1 Can steganographic channels be constructed using XMPP protocol metadata rather than message content?
• RQ2 How resistant are these channels to detection by a stateless warden that inspects individual messages?
• RQ3 To what extent can stateful wardens detect hidden messages by analyzing message sequences and protocol state changes?
• RQ4 How do statistical entropy measures compare between clean XMPP sessions and steganographic sessions?
• RQ5 What techniques can improve resistance to stateful warden detection, and how can they be practically implemented?

Key findings

• Most steganographic channels in StegMPP remain undetected by stateless wardens, as they do not analyze message sequences or state.
• The channel based on the presence of the 'xml:lang' attribute shows a 0.013456 higher entropy than clean traffic, making it significantly more detectable by statistical steganalysis.
• The entropy differences between clean and steganographic sessions are minimal—ranging from -0.002113 to +0.013456—indicating that entropic steganalysis would require large data volumes and high precision.
• Stateful wardens can detect some channels, but their implementation is computationally expensive and prone to high false positive rates on busy XMPP servers.
• The use of discarded 'id' values as a covert channel is undetectable by stateless wardens and can be hardened by sending messages to multiple clients.
• The paper concludes that protocol-level steganography in XMPP offers strong resilience against common steganalysis techniques, especially when combined with dynamic channel switching.