TCP over Microsoft Teams: a covert C2 channel for bulk data transfer
I tunneled a real IP link through Teams video calls by hiding packets in H.264 SEI NALs: 2.15 Mbps over three bonded meetings, byte-verified.
Kevin Pham / deoxy
I’m Kevin Pham.
I reverse engineer things, investigate security failures, and build things that tend to require an explanation.
Read the latest notes↓
######$$
*$#$#*!!;
!#$$#$#***!=
##$$$ ###*!=;
*##$ ## *! =:!;
!*# # ** ! :*=
#$$#!#*!** !!!*;~,!
*#$$$$#!!=!!!*=;;~,!
!### #*!=:;;;;:::-**
+!;;!*!*!==~~-------
!=;;;+;*;=:=;:~,-
!;=+=;++;+*;;;;,~-
*+;;!!;;;;;*;;++;
;; +;;;**;**;;;*;
+;!!;+ !;;;*;;+;+;
*!; ;;;;;+;+!;;**; ;+
+;+;=*;== +;;;; *;*;;
=;;=;;+===+;!====+*+ ++;*;;
! =+ =*=;; **;+= ; *;*;; ;;
! ; = = ; ;;*; ;; ;;;;;;+
; +; ; ;+ !=;+ ;;+*;;
; ; = ;; === ;;;; +;
; ; *; *; ;;
;; ;;;;
; ++ ;
;;; !
== +;
;
;
;
;
;
++
;*;
;
;;
$$$$$$#
###**!!$$$# #
=#$$$###**==$$$$
=#$ $$$$##**!=;
##$$$$$$ !!=;
!;=**# $ $$$##***!!==
! #;$#*!#~#$$ *!!!=;:
#$$$$$ **#: ###### ==;:
=! !! !+ ! ; ==!+!!!!!+!!!!==+===*$$$$$ #!**### !!!= :~
! !!;! +!!; =!+!!!! = == ==!+=! +!!!*#$!### *!=:-, ****** ;;~- *=
! !!!!+=+!!!!=!=!+!!!!!+!!!=!!+=!===*#*###!!=!!*** ==;:-##!-
!!!!+!!!!!=!!! + ===!!!+!!!==!!!!!!=*!!! ;;==!!!!!!!=##:-,*!!*
====!! !!!+!!!! +==+=!!++====:,; ;;- --;;; ~!**#;:--***#
!!!!!=+!=!!+!!!!!+!===!+===== ======+ ,,~, , ,~;;;;;;---#**#
== !!! = =+== === ~~~~-,#####
!! +=== ==+ ==== =+=
!!!+ !! ===+== ====
=!+!! ++!+===== =!+=
==!! !! ====!+!!!
= === !+==
!!!!!+= =!!
!!
!
!+
!
!!
+=
= !==
!!
##
$##*=#
#$$$#**!:
*#$###*!;
#*###***!;-;
*$$$#!**!!;;~!
!####*;=;===~,*
!+=;;;;=!!=~-----
+;;;;;+*;;;;~-,
;;;+;;;+;+;;;
!;;;;+;+;+;;+;;
=;;;+;=;;!=+;;;;;;;
!=== =+=;;= *;+==+;;*;;;+
;;; +; ;;;; !+;;;;;;;
;; =;; ==+;;++;
*;;;;;;
;*;;;;
==; ;
;+
;;
*;
*+
;;; $##
;; ##*!!$$$$
*$$$##*!;$$
*$$$$$##*!=;
*$$$$$$#**!=:
!$$#**#$$ ##**!=;
*$$$$#**#### !!=;:
!!!!!!+!!!!+!!##$$#=**!****** =;~#=~
== =!!+!!!!!+!!!= =====!=+!!!!!=+!!!==!*##!!;=== !!!=::-*!
!!!==+!!!!=!!==!=+====+==;=;;;;-:;!!!*;;:-**#
= =+==!!!+!!=======+== -~,-,, ~;;;---#*#
!!!!+!=!+!!!+!!!== =+==== ##
; =====+ +=== =+
!!!=!!====+ =+==
==+==+= =======
== == !=++
!!!+ =!!
!!
!+
!!
+==
=!===
!
Latest writing
10 entries, newest first10entries · newest first
02 ↗An eMudhra CA private key was literally 4
An approved export test derailed eMudhra's key ceremony. Eight weak CA keys got certified. Why did a legitimate deployment need this procedural exception?
03 ↗Giant Steps: an adversarial audio modem that survives noise cancellation
Voice calls erase modem tones. I built a Rust modem that sends bytes as vowels and uses the spare pitch channel to play Coltrane. Listen to it work.
04 ↗BrowserDefense: The browser is part of the endpoint
Browser-side telemetry for detection and response, with a working demonstration of Shadow Detection following page structure across changing domains.
05 ↗From a U.S. Defense Contractor to Chinese Crypto Thieves
Tracing Coruna's spread into Chinese crypto theft through recovered iPhone exploits, wallet-stealing code, and a 5,000-USDT retail integration offer.
06 ↗Dynamic Code Loading: But you consented, right?
Similarweb's extension harvests AI chats and browsing history. A remote server supplies its next instructions. Why does Google let it?
07 ↗I put a Fly Brain in an RC car to sniff WiFi
I wired a simulated fly brain to an RC car, turning WiFi into smell and neural spikes into motion. What worked, what broke, and what still needed my code.
08 ↗I Became the Action Replay for My Truck
Root in my truck’s Android head unit was trapped by SELinux — until I flipped one byte, rewrote my identity, and raced Mario Kart on the dashboard.
09 ↗Inside UNC6671's Browser Implant
Source analysis of UNC6671's Chrome implant: DevTools control, keylogging, storage theft, camera capture, and durable detection.
10 ↗I Nearly Hit Dial-Up Speeds Over a Guitar Cable
A from-scratch OFDM modem in Rust: almost 28.8k over a 30-foot guitar cable, plus a checksum-valid TCP/IP link over virtual audio.