A Security Model for VoIP Steganography

Abstract

Abstract-In 2005, an extensive taxonomy of threats for VoIP was published by a prominent industry group. Strangely, this taxonomy does not identify stegocommunication as a threat, even though many steganographic channels have been identified in VoIP protocols. To avoid such security gaps in the future, we argue that stegocommunication should be added to the traditional list of network threats: interruption, interception, modification, fabrication. The stegocommunication threat arises when the communication channel is purchased, provided, or supervised by anyone other than the communicating parties. We illustrate a stegocommunication threat to a business owner Charles. If Charles purchases a VoIP service for business-related communications by an employee Alice, then he faces the risk that Alice may undetectably communicate a business secret to an outside party Bob. In this insider-threat scenario, Charles can mitigate his security risk by installing a stegodetector.

AVARCIBER: a framework for assessing cybersecurity risks

“…In addition, continuing with the application of the snowball technique [25] to the conceptual models indicated in the previous articles, the following conceptual models of ontologies and taxonomies have been considered for this proposal: [26], focused on asset ontologies per user; [27], focused on asset ontologies; [28], paper focused on taxonomy of impacts on assets; [29], focused on mobile asset taxonomy; [30], focused on threat taxonomy; [31], focused on taxonomy of voice over IP threats; [32], focused on attack ontology; [33], focused on attack taxonomy; [34], focused on vulnerability taxonomy; [35], focused on vulnerability taxonomy based on information attributes; [36], paper focused on vulnerability taxonomy; and [37], focused on vulnerability taxonomy.…”

A novel watermarking method for software protection in the cloud

“…It has been claimed that 'agent-based models enable richer descriptions and analysis techniques about Internet-based environments, especially ones involving intelligent agents' [20]. We have successfully used an agent-based modelling technique [21] to analyze steganography threats in VoIP [22]. In this section, we exploit this technique to analyze the threats to the software collaborations in the cloud.…”

“…In our modelling technique, security goals are determined by human fears, and functional goals are determined by human desires. Any goal conflict is a threat to security or functionality [22]. In any insider threat, a single person has two aliases (e.g.…”

ReLACK: A Reliable VoIP Steganography Approach

“…Perhaps one of the best classifications of VoIP threats is the one provided by the Voice over IP Security Alliance (VOIPSA) [1]. In 2009 a group of researchers [2] recommended to add VoIP steganography or "stegocommunication" to the list of VOIPSA taxonomy as one of the VoIP service abuse threats.…”

“…Stegocommunication is a hidden communication, in which a message is hidden in a covert channel [2]. Thus, it is impossible to recognize the existence of the concealed message in the electronic object.…”