Semtex8
Semtex Level 8 — receive a file through a timing covert channel where delays between bytes stand for bytes that were never sent.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
Non-sniffable data
This level is about some very simple covert channel, about transferring information that cannot possibly be sniffed. There is a socket file in /rdx/nature. It is a local Unix socket. Receive data from it until EOF and save it to a file.
Watch the time between the received bytes. Certain delays mean certain bytes that have been left out (have not been sent).
0-1 s : no special data
1-2 s : 'Q'
2-3 s : 'L'
3-4 s : 'A'
4-5 s : 'V'
you have to take these “unsent” data into your output file too, exactly at the places where they occur.
Thus you are receiving data while not receiving anything.
The output file is a .jpg image :)
Study guide
Level map: read from the Unix socket /rdx/nature until end of file and save the result.
What this level teaches
Covert channels: hiding data in timing so it cannot be sniffed as content.
Key ideas
- Timing channel. The delay before each received byte encodes extra data: a pause in the 1–2 second range stands for one letter, 2–3 seconds another, and so on, as the page’s table shows.
- Reconstruct the data. Insert the omitted characters exactly where the delays occurred.
- The result. The completed file is a JPEG image.
- Local Unix socket. A file-like endpoint for local inter-process communication.
How to approach it
- Write a reader that records the time between bytes.
- Apply the table to insert the hidden bytes.
- Verify the output with
fileand open the picture.
Why it matters
Covert timing channels exist in real malware and in side-channel attacks.