TCP over Microsoft Teams: a covert C2 channel for bulk data transfer
I tunneled a real IP link through Teams video calls by hiding packets in H.264 SEI NALs: 2.15 Mbps over three bonded meetings, byte-verified.
Kevin Pham / deoxy
Things Ibuilt, broke,and measured.
Sometimes it's a protocol, sometimes a radio, sometimes production security. The write-ups keep the measurements and the parts that failed.
Read the latest notes↓
######$$
*$#$#*!!;
!#$$#$#***!=
##$$$ ###*!=;
*##$ ## *! =:!;
!*# # ** ! :*=
#$$#!#*!** !!!*;~,!
*#$$$$#!!=!!!*=;;~,!
!### #*!=:;;;;:::-**
+!;;!*!*!==~~-------
!=;;;+;*;=:=;:~,-
!;=+=;++;+*;;;;,~-
*+;;!!;;;;;*;;++;
;; +;;;**;**;;;*;
+;!!;+ !;;;*;;+;+;
*!; ;;;;;+;+!;;**; ;+
+;+;=*;== +;;;; *;*;;
=;;=;;+===+;!====+*+ ++;*;;
! =+ =*=;; **;+= ; *;*;; ;;
! ; = = ; ;;*; ;; ;;;;;;+
; +; ; ;+ !=;+ ;;+*;;
; ; = ;; === ;;;; +;
; ; *; *; ;;
;; ;;;;
; ++ ;
;;; !
== +;
;
;
;
;
;
++
;*;
;
;;
$$$$$$#
###**!!$$$# #
=#$$$###**==$$$$
=#$ $$$$##**!=;
##$$$$$$ !!=;
!;=**# $ $$$##***!!==
! #;$#*!#~#$$ *!!!=;:
#$$$$$ **#: ###### ==;:
=! !! !+ ! ; ==!+!!!!!+!!!!==+===*$$$$$ #!**### !!!= :~
! !!;! +!!; =!+!!!! = == ==!+=! +!!!*#$!### *!=:-, ****** ;;~- *=
! !!!!+=+!!!!=!=!+!!!!!+!!!=!!+=!===*#*###!!=!!*** ==;:-##!-
!!!!+!!!!!=!!! + ===!!!+!!!==!!!!!!=*!!! ;;==!!!!!!!=##:-,*!!*
====!! !!!+!!!! +==+=!!++====:,; ;;- --;;; ~!**#;:--***#
!!!!!=+!=!!+!!!!!+!===!+===== ======+ ,,~, , ,~;;;;;;---#**#
== !!! = =+== === ~~~~-,#####
!! +=== ==+ ==== =+=
!!!+ !! ===+== ====
=!+!! ++!+===== =!+=
==!! !! ====!+!!!
= === !+==
!!!!!+= =!!
!!
!
!+
!
!!
+=
= !==
!!
##
$##*=#
#$$$#**!:
*#$###*!;
#*###***!;-;
*$$$#!**!!;;~!
!####*;=;===~,*
!+=;;;;=!!=~-----
+;;;;;+*;;;;~-,
;;;+;;;+;+;;;
!;;;;+;+;+;;+;;
=;;;+;=;;!=+;;;;;;;
!=== =+=;;= *;+==+;;*;;;+
;;; +; ;;;; !+;;;;;;;
;; =;; ==+;;++;
*;;;;;;
;*;;;;
==; ;
;+
;;
*;
*+
;;; $##
;; ##*!!$$$$
*$$$##*!;$$
*$$$$$##*!=;
*$$$$$$#**!=:
!$$#**#$$ ##**!=;
*$$$$#**#### !!=;:
!!!!!!+!!!!+!!##$$#=**!****** =;~#=~
== =!!+!!!!!+!!!= =====!=+!!!!!=+!!!==!*##!!;=== !!!=::-*!
!!!==+!!!!=!!==!=+====+==;=;;;;-:;!!!*;;:-**#
= =+==!!!+!!=======+== -~,-,, ~;;;---#*#
!!!!+!=!+!!!+!!!== =+==== ##
; =====+ +=== =+
!!!=!!====+ =+==
==+==+= =======
== == !=++
!!!+ =!!
!!
!+
!!
+==
=!===
!
Latest writing
10 entries, newest first10entries · newest first
02 Security↗An eMudhra CA private key was literally 4
An approved export test derailed eMudhra's key ceremony. Eight weak CA keys got certified. Why did a legitimate deployment need this procedural exception?
03 Signals↗Giant Steps: an adversarial audio modem that survives noise cancellation
Voice calls erase modem tones. I built a Rust modem that sends bytes as vowels and uses the spare pitch channel to play Coltrane. Listen to it work.
04 Security↗BrowserDefense: The browser is part of the endpoint
Browser-side telemetry for detection and response, with a working demonstration of Shadow Detection following page structure across changing domains.
05 Reverse Engineering↗From a U.S. Defense Contractor to Chinese Crypto Thieves
Tracing Coruna's spread into Chinese crypto theft through recovered iPhone exploits, wallet-stealing code, and a 5,000-USDT retail integration offer.
06 Reverse Engineering↗Dynamic Code Loading: But you consented, right?
Similarweb's extension harvests AI chats and browsing history. A remote server supplies its next instructions. Why does Google let it?
07 Systems↗I put a Fly Brain in an RC car to sniff WiFi
I wired a simulated fly brain to an RC car, turning WiFi into smell and neural spikes into motion. What worked, what broke, and what still needed my code.
08 Reverse Engineering↗I Became the Action Replay for My Truck
Root in my truck’s Android head unit was trapped by SELinux — until I flipped one byte, rewrote my identity, and raced Mario Kart on the dashboard.
09 Reverse Engineering↗Inside UNC6671's Browser Implant
Source analysis of UNC6671's Chrome implant: DevTools control, keylogging, storage theft, camera capture, and durable detection.
10 Signals↗I Nearly Hit Dial-Up Speeds Over a Guitar Cable
A from-scratch OFDM modem in Rust: almost 28.8k over a 30-foot guitar cable, plus a checksum-valid TCP/IP link over virtual audio.