Hello Jacek and all,
Before, going down this path I would recommend reading the very relevant works:
Embedding Covert Channels into TCP/IP
Steven J. Murdoch, Stephen Lewis
It is commonly believed that steganography within TCP/IP is easily
achieved by embedding data in header fields seemingly filled with
“random” data, such as the IP identifier, TCP initial sequence number or
the least significant bit of the TCP timestamp. We show that this is
not the case; these fields naturally exhibit sufficient structure and
non-uniformity to be efficiently and reliably differentiated from
unmodified ciphertext. Previous work on TCP/IP steganography does not
take this into account and, by examining TCP/IP specifications and open
source implementations, we have developed tests to detect the use of
naïve embedding. Finally, we describe reversible transforms that map
block cipher output into TCP ISNs, indistinguishable from those
generated by Linux and OpenBSD. The techniques used can be extended to
other operating systems. A message can thus be hidden in such a way that
an attacker cannot demonstrate its existence without knowledge of a
secret key.
7th Information Hiding Workshop, Barcelona, Catalonia (Spain), 06–08 June 2005. Published in LNCS 3727, Springer-Verlag.
[
paper ]