Iyer and Nandedkar - Covert Cupid Under 11 Veil Approach for Covert

### The Motivation for 802.11 Covert Channels At 01:32, the speakers introduce the motivation behind developing covert communication channels over 802.11 wireless infrastructure. In restricted enterprise environments, perimeter firewalls, proxy filters, and wired intrusion detection systems stringently monitor layer-3 IP traffic. However, wireless physical space remains porous, allowing data transmission via pre-association link-layer frames that bypass conventional IP inspection mechanisms entirely.

### Management Frame Mechanics and Information Elements At 06:16, the presentation defines covert storage and timing channels within IEEE 802.11 standards. At 07:47, the focus turns to unencrypted 802.11 management frames: Probe Requests, Probe Responses, and Beacons. Around 12:00, the speakers analyze the standard frame anatomy, pointing out that Information Elements (IEs)—such as Vendor-Specific elements (Element ID 221) and the Traffic Indication Map (TIM)—provide substantial malleable payload space that can be weaponized for hidden data transport without disrupting normal Wi-Fi negotiation.

### Radiotap Layer Injection and Custom Scapy Scripting At 09:28, the presenters explain how raw frame injection operates at the Radiotap layer using Linux monitor mode and Scapy scripts. By crafting arbitrary bytes directly into custom Information Elements within management frames, an attacker can broadcast data into the ether. A passive listener situated nearby can intercept and parse these frames without ever completing an 802.11 association handshake or establishing an IP connection.

### Exfiltration Throughput and Payload Encoding At 15:00 and 20:52, the speakers evaluate payload capacity, showing that between 100 and 750 bytes of concealed arbitrary data can be encapsulated into a single management frame. They describe modular encoding routines capable of segmenting files, remote execution payloads, or shell commands across sequential beacon bursts, providing a resilient exfiltration conduit across air-gapped or heavily monitored environments.

### Detection Evasion, Frame Loss, and Protocol Limitations At 23:54 and 26:55, the speakers address operational hurdles, including frame loss over noisy RF environments and the lack of native layer-2 retransmission for broadcast management frames. They analyze why traditional Wireless Intrusion Detection Systems (WIDS) fail to alert on anomalous IE payloads, noting that most monitoring solutions merely track BSSIDs and channel allocations. The session concludes with recommendations for developing heuristic signature engines to detect irregular IE lengths and suspicious broadcast intervals.

(AI summary — Gemini 3.8 Flash)