#HITBHaxpo D1 - Hiding A Secret Distributed Chat System In 802.11 Management Frames

## Overview This talk presents a proof-of-concept distributed chat system hidden within WiFi 802.11 management frames, specifically probe requests. The presenter is a security researcher with 15+ years of hacking experience specializing in WiFi networks (802.11 protocol). The system demonstrates covert peer-to-peer communication designed for high-security environments where standard data exfiltration is blocked or heavily monitored.

## Key Topics **Covert Channels and Data Exfiltration:** The speaker explains that in high-security facilities with restricted network access and physical controls (USB device bans, monitored networks), alternative data exfiltration methods become necessary. Covert channels repurpose communication media for unintended purposes—in this case, embedding encrypted messages inside WiFi probe requests that appear as normal network traffic.

**Technical Architecture:** The system requires an Atheros-based WiFi monitor card, Linux OS, Python, and the Scapy library for raw frame injection. Messages are encrypted using AES and embedded in 802.11 information element fields (IE 0x221), with maximum payload ~1.5 kilobytes per frame. Larger messages are split across multiple frames using sequence counters to prevent duplication. Different chat rooms are identified by fixed MAC addresses derived from room names, with all participants sharing the same encryption key and channel (calculated via an algorithm based on room name).

**Distributed Mesh Design:** Rather than direct peer-to-peer communication, the chat system uses a retransmission approach where peers repeat messages multiple times, extending communication range to 100–200 meters. This distributed model allows multiple groups to operate simultaneously within the same physical space on different channels.

**Evasion Mechanisms:** Frames are intentionally crafted with invalid CRC checksums, causing standard WiFi drivers to dismiss them before reaching user-space. This makes them invisible to normal sniffing tools and wireless anomaly sensors. MAC addresses are randomized for anonymity, and frames deliberately violate WiFi protocol structures, appearing as background noise rather than suspicious activity.

## Technical Details **Frame Construction:** Probe request frames use broadcast addresses with encrypted payloads embedded in information elements. The presenter demonstrated frames with invalid CRC values that trigger automatic dismissal by traditional monitoring systems. Frame type and subtype are set to probe request (0x40), with one MAC address fixed per chat room and others broadcast.

**Implementation Example:** Scapy constructs frames with `Dot11(addr1=broadcast, addr2=random_mac, addr3=fixed_chatroom_mac)` containing encrypted message payloads. The proof-of-concept uses AES-ECB encryption mode; the speaker acknowledged ECB is a PoC shortcut and production systems should use CBC or counter modes. The speaker also demonstrated live chat and file transfer capabilities during the talk.

**Hardware and Software Stack:** Alpha WiFi cards with Atheros chipset recommended for monitor mode and injection capabilities. Historical driver development and open-source nature made Atheros widely supported, though modern manufacturers (Broadcom, others) are removing monitor mode capabilities to prevent unauthorized injection.

## Q&A Key Points - **AES Mode:** ECB was chosen for implementation simplicity in splitting messages; production should use CBC or counter mode for better security. - **Hardware Trends:** Atheros drivers historically supported strong monitor mode due to open-source development, but manufacturers increasingly restrict this capability in modern devices. - **Future Development:** Embedding this code into ESP32 or ARM-based devices with batteries could create truly portable covert hardware deployable in restricted facilities. - **Detection Resistance:** Invalid CRC frames are automatically dismissed by standard drivers before user-space processing, remaining invisible to typical wireless anomaly detection systems.

## Takeaways 1. WiFi protocol flexibility permits embedding arbitrary data in management frames through raw packet injection in monitor mode, bypassing standard protocol enforcement. 2. Physical facility access and a capable WiFi adapter are the primary requirements; implementation is straightforward using Python and Scapy. 3. Primary application context is high-security intelligence scenarios where normal exfiltration is impossible. 4. Complete proof-of-concept code is available on the presenter's GitHub (accessible via their Twitter account @Docs). 5. Project is explicitly a proof-of-concept, not production-ready; small embedded implementations could create undetectable covert channels for future deployments.