BruCON 0x07 - The .11 Veil, Camouflage & Covert! Invisible WiFi, Revealed

### Overview In this BruCON 0x07 presentation, speakers Amrita and Rishikesh discuss techniques for covert communication, camouflage, and data smuggling across IEEE 802.11 wireless networks. Beginning with an anecdote where unexpected message read-receipts suggested unauthorized Wi-Fi access point interactions, the speakers explore how wireless frames at the data link layer can be manipulated to carry hidden data rather than relying solely on traditional packet payloads. Their exploration focuses on crafting frames with Scapy, manipulating 802.11 Information Elements (IEs), and modifying wireless driver protocol stacks.

### Key Topics - **Covert Channels in 802.11**: Establishing communication mechanisms that transfer data objects between processes outside standard computer security policies, focusing specifically on Layer 2 management and control frames. - **ELT Euphoria**: Leveraging 802.11 Information Elements (IEs) inside broadcast management frames (such as beacon frames and probe requests/responses) to embed hidden information. - **ACK and Response Frame Smuggling**: Utilizing unicast/multicast acknowledgment and control frames to bypass sequencing limitations by piggybacking on pre-established host communication. - **Patch Peloton (Driver Patching)**: Altering wireless network drivers to change frame parsing behavior (e.g., protocol version fields), rendering traffic completely invisible or uninterpretable to unpatched stations.

### Technical Details - **ELT Euphoria & Information Elements**: IEEE 802.11 allows up to 256 Information Elements (with roughly 121 in active practice). The speakers specifically target the Traffic Indication Map (TIM) element's Partial Virtual Bitmap field, which allows pushing 1 to 251 bytes of arbitrary data in a single frame. Because beacon frames occur at standard intervals (around 1 per 100 ms, or 600 per minute) and require no authentication or association, they represent a stealthy broadcast medium. However, due to challenges injecting raw beacon frames via Scapy on Linux, the researchers demonstrated the technique using crafted probe request frames (subtype `0x04` instead of beacon subtype `0x08`). - **ACK-Based Diversion**: To address multi-packet sequencing and lost frame issues present in broadcast beacon/probe techniques, the speakers evaluated embedding encoded data inside acknowledgment (ACK) and response frames. By utilizing pre-shared keys and metadata fields (like ID, sequence numbers, and frame control), they established a bidirectional, ordered covert conduit between two cooperating hosts. - **Patch Peloton**: Inspired by Laurent Butti's 2006 Black Hat research on wireless driver patching, the authors altered the standard 802.11 frame header version field (normally set to `0`) to `10`. An access point configured in master mode on Linux broadcasting frames with version `10` caused standard unpatched devices to drop or misinterpret the frames entirely (yielding garbled sniffer dumps or driver crashes), while hosts with matching patched drivers processed the frames normally. - **Implementation Challenges**: Scapy exhibited Layer 2 packet fabrication errors, lack of out-of-the-box lost frame retransmission, and encoding issues during live testing. Furthermore, driver patches tested successfully on Linux kernel 2.6 encountered compilation and resource integration barriers when porting to modern Linux 4.x kernels.

### Takeaways Covert channels over 802.11 can bypass standard network perimeter controls and anomaly-detection firewalls that scrutinize payload data rather than Layer 2 management/control headers. Additional information elements, such as TPC request/response (over 200 bytes), Country element (up to 256 bytes), and PS-Poll frames, remain viable carriers for stealthy data smuggling. While multi-frame sequencing, frame loss handling, and modern OS kernel driver compatibility require further engineering, manipulating 802.11 protocol parameters represents an effective method for creating covert, camouflaged wireless communication.