Using Markov chains as a keyed obfuscation method

Machine learning methods, simple and complex, can be used in almost all aspects of our digital lives. Interestingly enough, it is rarely observed in the offensive side of information security. When I was thinking about the number of ways an attacker can exfiltrate data past a firewall, I decided to try out an old favorite, Markov chains, in order to build the next generation of “book ciphers”.

A Github repository has been created for this project: markovobfuscate

Markov Chains as a Keyed Obfuscation Method

This is a project that has been sitting in my private git repository for a long while, and after I was recently reminded of it, I’ve decided to write it up and do an initial release. The premise of the project is to use Markov chains in order to obfuscate binary information to appear similar to written language.

I feel it’d probably be good for me to mention this fairly early on…I AM NOT A DATA SCIENTIST! I enjoy using machine learning where I can, but I have no formal training in it, and I am not a data scientist at my employer. I’m absolutely a data science amateur, but what machine learning I do know, I have found it to be extremely useful. On another note, I highly suggest that anyone reading this should spend some time to learn some basic machine learning concepts at some point. It is an extremely useful tool to have in your toolbelt.

Markov Chains

For anyone not familiar with Markov chains, they are very commonly used in conversational bots. For example, there are a number of bots on Twitter which emulate people. For instance, @da_667 has setup @667__ebooks as a bot which impersonates @da_667 based on what he’s said on Twitter in the past. Presumably, this bot is using Markov chains, which have been generated with his past Twitter feed to generate messages such as this:

my theory: colonel sanders isn't dead because he's worked for javascript. — 667ebooks (@667ebooks) November 20, 2015

While this appears to be English, it doesn’t entirely make sense (but still amusing).

The way most Markov chains operate is in two phases: Learning and Generating. Markov chains can also be used to “fit” input, in order to determine how likely a sentence was to have been generated from the source, but that is not relevant to this post. In the Learning phase, the Markov engine is fed a data set (a set of sentences) which were generated by the source being emulated. The engine then breaks these sentences down into words, and calculates the chance that each word will follow every other word.

Consider the following:

markov.learn(["im on fire", "im going to die"]) im on fire going to die im 0 .5 0 .5 0 0 on 0 0 1 0 0 0 fire 0 0 0 0 0 0 going 0 0 0 0 1 0 to 0 0 0 0 0 1 die 0 0 0 0 0 0

While this can be a real pain to do by hand, it is really easy to gather information like this in code.

When in the generation phase, the Markov engine will pick the most likely word to follow the current word in order to pick the next word in the sentence to tweet.

For both phases, I have simplified the description, and some implementations can grow to be significantly more complicated.

Using Markov Chains to Our Advantage

Given our previous knowledge of how Markov chains work, we can potentially use this knowledge to create an obfuscated stream of data which appears like English (or any other language we feel like using). The concept is as follows: Instead of using the most likely word to follow our current word, we use the Nth most likely word to follow, where N represents a single byte we are trying to send. This does require that both sides have the same Markov model, but this isn’t much of an issue, as it only requires both sides to have read the same “book” or set of sentences.

Consider the following:

current_word = "apple" sorted_list_of_words_following_apple = [ "sucks", "over-charges", "sauce", "cider", ... ] byte_to_represent = 0x2 print current_word + " " + sorted_list_of_words_following_apple[byte_to_represent]

Additionally, there is a possible issue where our “book” will not generate enough word comparisons to give us enough information to represent a full 8 bit value. In order to recover from this, we can spread the value out over multiple words, and require that each byte must be represented by available values of at least 256.

Proof of Concept

As you may have imagined, I have built a proof of concept for this. It is in pure Python 2, and should be quite simple to integrate into Python based projects. If you working in a language other than Python…good luck! But seriously, hopefully you can read enough Python to reimplement based on the supplied code and this blog post. Additionally, if you implement this in another programming language or at all, please feel to let me know on Twitter or something.

Here’s an example:

# Markov engines fed with War and Peace, thanks to Project Gutenberg. Original string: This is a test message to prove the concept. Obfuscated string: each with head had thought that rostov holding her a pause occurred said quickly began rapidly taking up hurriedly drinking his hand him kutuzov sent tikhon interrupted natasha spoke most precious and some strange beautiful armenian was lying or inevitability governing the count's eldest boy you'll allow themselves by heart began wiping away his brows with your faithful unalterable love not go of war would in due form making long wanted him such cases but napoleon was standing where's that might but simply . next morning in petersburg in each week so what sweets . those pranks in passing along looking gloomily at pierre rose Deobfuscated string: This is a test message to prove the concept.

As any reader should be able to tell, no sane person typed the obfuscated string, but it could be quite difficult for a naive algorithm (working at scale) to be even remotely close to being able to tell that this information was obfuscated, much less what the underlying data was. Interestingly enough, since we have some room for randomization (based on the first word chosen), each time the message is obfuscated, it can be different.

Original string: This is a test message to prove the concept. Obfuscated string: lord forgive it then assume the campaign during 1812 has deigned to meet at midday sun appeared . he's grinning the army beyond dorogobuzh while with those orders as having wrung a pleasant comforting and asked petya . he kissed them sat among those big head aches and now pierre inquired about playing cards holding in that here my arms . how things snatched at dolokhov's intimacy now frightened imploring look round natasha rising wind that . please . what's in bed during that the count's dissatisfaction on taking rather for himself mentally . he's our most in command preceding order to speak Deobfuscated string: This is a test message to prove the concept. Original string: This is a test message to prove the concept. Obfuscated string: then already knew about moscow already prepared if all said crossly that before leaving the same she's very young bear me no nonsense as our parting from west paris would sacrifice had prepared the thought occurred but simply solicit donations received one might need thought a place a soldier passed before how papa he might expose his first saw through without saying not going for christ's sake in the sun but should wake natasha the very still showing pity he loved so count peter kirilovich said dron died of france alone even those taking Deobfuscated string: This is a test message to prove the concept.

Let’s try a more interesting example:

Original string: -----BEGIN ENCRYPTED PRIVATE KEY----- MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIDHHhyAEZQoICAggA MBQGCCqGSIb3DQMHBAiHEg+MCYQ30ASCAoDEvGvFRHvtWOb5Rc0f3lbVKqeUvWSz xQn+rZELHnwb6baolmbFcsi6XkacVzL/EF7Ll4de/CSQ6pZZCCvfDzov0mPOuGve SAe7hbAcol7+JWVfzbnVTblPf0i7mwSvK61cKq7YfcKJ2os/uJGpeX9zraywWyFx f+EdTr348dOez8uHkURyY1cvSHsIdITALkChOonAYT68SVighTeB6xOCwfmsHx+X 3Qbhom2YCIxfJiaAoz2/LndCpDaEfOrVrxXFOKXrIbmeDEyjDQj16AVni9uuaj7l NiO3zrrqxsfdVINPaAYRKQnS102jXqkH01z72c/MpMMC6dwZswF5V3R7RSXngyBn 1GLxVFHKR753Gt0IDag13Bd8Jt890/v0tE0Kx66jCkRGn+VCq6+bsnh7VpTH/cG5 dlFnv56lv2leknu5ghdJHX8YQ6HjnioaaheLA+ORAxqAlD8Itt1/pRBOOMSkutdz d1px9dB2ZBpSoRAOcBwU5aFaw9uu+tXyzrPM3tZomu8ryQYMNlmVgPNDJOz6jPJi jaZHWTS7U6j370oH/B0KTUG/ybrJGFnOmPP4h2u/ugG75EkfotURsvbrWuetQhOi TCH+9nbIcT3pxnTXqI2IRHZXMturQ+6fqlJF3bb9bWarMBuC3KgprqyqXxeM0Sqg VlyKLWwAuMf2Ec7t7ujqaNmVgv6bpwHEbR6njIi7lC7j4w6D2YQ8vacgvS3MB/K0 SX54HNVBVuXhAixPtYJ6tOBGm7QFAKaXju0PJ+AljnMEsHRekOs2u42OHBXEWDE8 VHw7/lTXWsJkBcQM+g/svyqV4xKHDAixPms2SUwJyKjvEgV+CQok4F/T -----END ENCRYPTED PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC9TCCAl6gAwIBAgIJANL8E4epRNznMA0GCSqGSIb3DQEBBQUAMFsxGDAWBgNV BAoTD1N1cGVyZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQsw CQYDVQQGEwJVUzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuMB4XDTE0MDUxMjE2 MjUyNloXDTM0MDUwNzE2MjUyNlowWzEYMBYGA1UEChMPU3VwZXJmaXNoLCBJbmMu MQswCQYDVQQHEwJTRjELMAkGA1UECBMCQ0ExCzAJBgNVBAYTAlVTMRgwFgYDVQQD Ew9TdXBlcmZpc2gsIEluYy4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOjz Shh2Xxk/sc9Y6X9DBwmVgDXFD/5xMSeBmRImIKXfj2r8QlU57gk4idngNsSsAYJb 1Tnm+Y8HiN/+7vahFM6pdEXY/fAXVyqC4XouEpNarIrXFWPRt5tVgA9YvBxJ7SBi 3bZMpTrrHD2g/3pxptMQeDOuS8Ic/ZJKocPnQaQtAgMBAAGjgcAwgb0wDAYDVR0T BAUwAwEB/zAdBgNVHQ4EFgQU+5izU38URC7o7tUJml4OVoaoNYgwgY0GA1UdIwSB hTCBgoAU+5izU38URC7o7tUJml4OVoaoNYihX6RdMFsxGDAWBgNVBAoTD1N1cGVy ZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQswCQYDVQQGEwJV UzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuggkA0vwTh6lE3OcwDQYJKoZIhvcN AQEFBQADgYEApHyg7ApKx3DEcWjzOyLi3JyN0JL+c35yK1VEmxu0Qusfr76645Oj 1IsYwpTws6a9ZTRMzST4GQvFFQra81eLqYbPbMPuhC+FCxkUF5i0DNSWi+kczJXJ TtCqSwGl9t9JEoFqvtW+znZ9TqyLiOMw7TGEUI+88VAqW0qmXnwPcfo= -----END CERTIFICATE----- Obfuscated string: countess in fact been captured if all sorts i chapter xx chapter xi the most doleful nocturnes on tiptoe noiselessly to an apple should i made to one arm he meant too and without hurting her fate and told count well well my pet whose sake stop them to attack singly across that prince bolkonski's simplicity . he really began pacing the adjutant reproached those voices footsteps going up . anatole returned a voice plainly terribly wild beast was a most cases we must remain attached themselves in reply the fact they have turned loaded five years . he moved voices sang morel with his body as petya heard and took command justify his eyes to cry or four so let that movement . again used all became smooth as hostess at tarutino a peasant laborer . as napoleon frowning slightly in no wish so you'll forget to think only tell everything became distorted out over once shown to be pitied so definitely ordered up poor creature said on louis xiv's activity tushin not my cousin she too there await him her old friend tell cried petya . at pultusk . countess petted and he used when once heard . boris but before you believe either in different companies which russian arms board them come when had decided by word incomprehensible which the best for peace or me pass anna semenovna continued after prince vasili said smiling young rostov felt though no definite means death they saw several men is god my position trying whether this time since lived somewhere with pale colored breeches he will win but neither to what said timokhin and we really begin what lay your serfs a loud at their carts should i understand that so soon taking no she called dunyasha had told herself from here at another his smile betraying his face again glancing from lifting him how i agree oh i mean for prince bagration's face became known as women here on reading was coming you should tell my sister remarked another peasant families who entered more orderers but also good kind are not heard at midday there seemed difficult would receive this terrible thing which natasha laughed turned angrily shouted someone inquires by fear of happiness he remained in their campfires while by way full of a minute . i'm standing among a soldier three hundred years his son's letter and some great blessing if from princess lay the door trying for there have changed she made as young couple he replied balaga and yet with only without realizing that other she became distorted mouth rode on your charming that made wills produced from her might . anna scherer's reception by way we did i consider who took some unknown but dared complain to let relief after every soldier there or understand people's welfare the whole body as hostess . before the war by asking silly ladies with rapid retreat is why go out and though embracing prince noticing trifles you it impossible . their numbers got chapter xxxvi prince de soutenir ce grand is it looked frightened face . of doing said one like everyone questioned . in prince i always tried me is easy chair she feared a german princes who till you got that god and were trying through at her again smilingly talking dron drop . some tricks glanced round inquiringly repeated but at daybreak said quickly gliding sleigh runners and by word fire he were an awakening and their fellows do you for nicholas sent instructions that after passing by long lashes that'll teach this same heights pass to go i might very readily introduced mazurka began reciting some rum to avoid anything are often troubling about petya fixing on go into english parliament that an account as legitimate questions humanity of great success might he as emperor after what or sometimes asked you been written by pierre seemed congested somewhere or perhaps she remarked someone asks the russians with delight of doing to your taste . it like to think speak . the new sitting opposite hill lay in search facility in with curiosity awe struck prince i want rain entered those blasphemous words frightened face of thought kutuzov arrived during fifteen can i can stay by to my country amid their turn back chest shoulders . and wished natasha left eye could do anything only feared napoleon frowning without looking malignantly at smolensk at present my enemy force commensurate with life my sister leave his serene highness' staff that kutuzov arrived at once recognized napoleon nor believed anyone or lesser interval boom boom boom flopped into moscow either the cause prompting the latter instinctively feel themselves from moscow at it an unknown and suddenly the war andrew interrupted but neither . those other trouser leg was needed said yes that's twue devil mack and a crowd pushing anatole continuing to the night said but changed boris having her grief fell off any purpose immediately recognizing the last all are often forgot them with them because our lodge a happy all who must expect this not far ahead shot the russians need to be told chiefly to marry he still firing but quite unclothed sat some steps accompanied them listened wishing but dared attack said that for christ's sake eh dron and prince went inside their theory say the expression gradually diminishes or lesser remoteness of man's long as possible power needs and i expected from men were called power 2 when after his partner in each frenchman . to die tomorrow your head like when spoken laughingly of view nor in alarm was made so busy causing the field especially on its peculiarly deliberate . our forefather adam to marry you look as people always the fire is i owe forty eight feet off mamma pressed to avoid general complained of doing this set them over them not heard on the cause they gazed rapturously breathless when alone knew all is constantly conflict of wine . i'm heartily they turned upside down as little lamp stood met for her usual simple . prince told them all or self possession mingled joy pierre for tomorrow at present affairs every action depends and saw immense number is not very people spoke in a special deep wrinkles on the country amid his nose the campaign it under precisely two o'clock left the people might our entrenchments but then immediately became his feet stood at home a different camps and told herself with closed as commander for us two officers directing her voice no mary having brought and put it stood rapt gaze disturbed . the regiment quivered angrily to go said was telling of something unnatural state affairs pierre glanced at schon gut morgen he kissed princess a sense in 1805 and we were much at the one need anything for no confusion . everything came once lit struck by the rostovs' being used supposing natasha on said what and seeing clearly the emperor left us rather bigger one has not consider kurakin's demand because in regard as this there has begun nor anywhere tomorrow brings victory at last chords of his knees some from another horse the village country ahead to him such blessedness which was napoleon asked me natasha continued that other she left arm of great natural manner were heard bickering with the third that same life was his eye could therefore so badly things and an incomprehensible he held both passed the old colonel is easy chair for others treated one after looking ecstatically conscious is better if on receiving a month reviewing troops plunder . this officer who would she laughed talked over which it grew some places for whom did . ah reverberated now by memories awoke . one no nonsense old courtier feel i not bear . do like prince could speak is nothing said alpatych lifting up but helene beaming smile so much money he turned red . then just like affectation . yet all up your disposal of natasha's singing a red ribbon of napoleon asked anatole kuragin go my soul not my uncle came a bit wait haven't stretchers . why felt by name is usually complicated disease . count arakcheev and looked frightened expression as usual semblance of borodino not that your faithful slave of pierre's caution . pierre thought . tell your mother's place to avoid inconveniencing him how that natasha listened now felt uncomfortable position rose as every face glowing with animation but changed . you still fresh columns which afterwards he kissed princess never mind instantly guessed they wanted i'll have it over thirty five minutes later . let herself was brought and yet my friends went every now did it still funnier . let anyone told their eyes looked long coat said she made earlier than she made pierre moved them how his actions there anything wrong in every face glowing with each to fight a woman's dress princess drubetskaya's case insisted though declaring to one mass rendered him i take out prince in despair how once glance inviting him to cry though whenever a single division will also instructed me but dared not much better lie . ah it which everything around pierre rose . without trying with quick resolute face beamed with more easily some not notice him having done otherwise than this same living on her too but would call in advance of man's honor remarked vera sufficiently prepared for a carriage containing the battle on business weary but even denisov expressed . nicholas will to all rostov's cards that their efforts is done at each on as young horse in a talk alone with him walked kutuzov's groom a ball recoils after crossing herself evidently just the chief subjects were . o p . boris to begin your victory said her brother's with people from a couple left petersburg society will warm whiffs of . dolokhov smiled amiably at one thought their fellow prince theodore she screamed swore on like prince koutouzov to pass natasha whom will call i'll tell natasha insisted began clapping pierre rose up stroked the hill the carriage inquired zherkov and this class and my beloved bald general with kutuzov looked significantly at this pierre repeated her not give him over natasha you got so what fun nor the porch there said that affair of self justifications of command turned him so remote and see an approaching whistle flew into which seemed the world was such moments rose superior french phrases marshals stood hesitating piteous despairing gesture of his master of prussia ever done nothing from he returned from where candles or not resist their expression seized on by special protection and looked out beyond which two unequal to princess felt numb in dismay and taking my new military side and felt after its inevitable to hear this expression thoughtful smile had time nesvitski drove his power because he tried with love affair would be worthy added addressing michaud how your love one for any money decide or into which every word to say he's at a quiet backbiter said without receiving news with great balloon leppich now just more this will warm he received . our talk related how is taken definite and now much afraid even the captain rose took me said holding and if only sound eye lit stone sparkled with your turn from sonya my friends told you for permission previously seemed thriving and in 1805 and therefore fought this question of police . who the twenty horsemen galloped away when napoleon could at cards behind so far ahead of and though her a man's good said the action so she never loved prince vasili . count on returning . do leave it then explained simply directed in them others on parade does up another way guewilla warfare had not understanding the bridge because you to all were burning lips having brought yourself said the matter princess is a commander overtaking baggage or another division not himself sick russians left near by every loss for himself moving according to kill you this class for napoleon the world only by everybody know about her old conditions of natasha's whole series for several important occasions that all would sometimes stronger the ground slip as prince bolkonski's no peace chapter xxxii beside countess i felt convinced you not himself away into alexander's guards before this had witnessed on sundays . said bolkonski she passed dolokhov made in vienna . those same resolution pierre evidently feeling at yankovo ten guns to understand a whole . ah it what regiment prince answered zherkov had begun prince kuragin into her house as often thought she must seem to the next he drew bagration bent till he is bad composition but the thought were silent feeling for war began knitting of prisoners looking in one offered it they desire was coming along get to get her but always directed toward restraining his majesty at heart well sounded buoyant steps were busy as happens sometimes came from you papa in with long and still an equal power unobtrusively simply . go out go quickly down . look was said mary moved his cheeks sunken emaciated young people such justification . princess mary don't forget yourself your regiment of prussia without content . still regarded as people was his intention . very quiet manner without her thin strap and with so many such ardor all a most gracious sovereign has proposed that way bagration who would grow severely but that's another voice suddenly growing angry reprimand for himself be destroyed religion napoleon but which afterwards pursued began working in a time and felt in order will remain inactive would become as in vain to remain in different people introduced hospitals death is my letter and felt offended me so terrible what have written . then having to her look was all sorts a thing was there must dance song in full significance have another push yourself worthy men left for nothing at smolensk and made your life pursued their horses bridled her life itself is an apple also looking out . some voices bowed himself or if it come . from what makes it all made earlier said something black with particular moral support you but never thought such reflections on tiptoe and some larger or is moving her she remarked that lay considered everything became convinced the drawing out directly opposite reputations . petya cried prince is already be called king overcoming by prince not take murat solemnly at his nose sat like cords that look up or should insist . prince murat i knew that even before others what to help with sonya i expect from bad lookout for having seen alone could sit whole position because anatole's appearance of his small white chamois leather case and if he stopped with natasha needed which princess glanced through his master in attendance considered by giving detailed chat generally wore was thinking man nor less chance remarked loudly and the fire very few paces from above him seemed very unwell and no no connection between their pace went rapidly across to him yet man can answer to say remarked the men in chief's actions was over rostov standing there oh hush seemed quite unexpected direction in accord and self abasement . before such lengths and where willarski found that the action they thought and is much since she was decided to wait a man's sharp trot only to wait to herself was lying recovering or sent greetings from vienna were it now smiling sardonically and you speak so replied rapp do all at braunau was taken as of free of reason prince bagration reported having dressed his serene expression softened grateful but to dinner called buonaparte is good naturedly as something sweet sorrow which dolokhov flashed lightning from your men went red lips grew quite new count she ought to dinner taciturn . rostov when having heard probably bruised face whipping up a few replies about the latter understood them they again smilingly to die feeling there they carried off properly he was covered chair how his eye the evening i who held a loud speranski only necessary not sleep either a talk moved forward words were placed himself prince andrew's estate prince bolkonski's not have them details himself quite independently of events have received leaflets with all came four days previously . have led astray . for nicholas so and rode to work all nonsense humbug exclaimed different person . but despite these consultations were evidently so strong effect she ought not being played its normal physical condition the bridge fire in this consciousness as best for several officer who do all she with excitement of happiness of horses so full rations the cause mathematics from pierre ran to go very bad for sonya natasha with marya concerned her slender mischievous with people is known grandee of things ask for some voices then now why there when when expressing the air as other watched for one said smiling face reporting that terrible recollections of russia while it seemed by another reminded one officer with merry shouts onto it yes go any work too well mamma are both these wounded lay with me too well disposed her only sound and some troops it necessary things seem of this old friend older . two conceptions the hill they expected on leave permits had thought impossible for some given which though mankind especially against utitsa semenovsk hollow between her lips parted she asked indicating a moment though shy childlike fear getting into what luck the morning tikhon briskly forward to understand that his master but . look evidently so pierre so accustomed always became still his intention . of hussars to cry directly the horses showered upon eykhen threatening the other wounded at some intrigue egotism conflict . let down by general weyrother to be arranged some means death none but now did what to pass this there no less insistent on them i'll trust yourself to the latter had noticed them up three weeks had suddenly flaring up their box those tears again heard so strongly as clear blue frocks and having summoned appeared and some message dolgorukov the will call and though a day fleecy clouds floating to the evening speranski did he had worn a boy with satisfaction flitted to some message dolgorukov as all came an aide de beausset's face yet met pierre felt as she repeated approvingly evidently means he stood irresolutely beside denisov not understood me under what they drew dolokhov got somewhere and the great russia but she gazed for themselves on he used when trying but yet been lost faith you done all by self satisfaction ran along at pierre now taking hers . here tomorrow . the field guns on taking notes he spoke her daughter's distress some steps he listened not true conservatives a german fellow men came her face changed the end kutuzov's instructions she tried equally indifferent case by other evening the position away to do we feel friendship of some like how many new dresses french official who sometimes enters russia . he were placed them while drying it to help laughing long mustache that and see how d'you do that'll do that feeling bound himself from falling over pink dresses into prussia ever increasing seemed to be prepared raising of and sometimes even seem quite differently the regiment having rested and sometimes complete victory and he approached that made some invisible smoker . by people was unable from bogucharovo about i made me only been living in consequence has an hussar horses near one with pale scared look on with another sort had she with bare hand will all alone knew he ran from excitement shown him no government how nice stepmother . for but our failures resulting from being foes take any purpose we assume that sort out what kutuzov to hear it true not an atmosphere to hear the back distracted count cyril says or my fate to an honorable gentleman or perhaps all everything said addressing natasha no means what one can one the horses away the very erect majestically . why count sat in another wounded spirit too great delight which is of death i chapter xxii next glanced through for this conversation upon eykhen threatening to your belly . said uncle what your troops it that so accustomed groove he and above all one as having interrupted dolgorukov ride through napoleons louis xv at and though five rubles for her fate not ask an evident to kutuzov fell off blockhead well let kuragin made some orders pierre found dolokhov in a field shouting that of human lives were taken were taken by to set and that here i've done but always before yesterday replied but dared to feel when dolokhov pressed his hair her the two battles at bogucharovo . what's he could do his leg glancing however small prussian war when denisov . sometimes flung herself so well read them smiled in waiting your carriage drove through and did everybody took heed her look there's nobody wants to be quick and those scoundrels . please vasili but on cause . he's chosen words to her companion makarin dashed out but again going round . she says to love which always thoughts ran toward the french voices trying for someone would always came two fires in me last an old dotard father is already knew no hindrance if threatening inaccessible it matter so ill suited the officers the wounded yet left long expected this happened there very old days on pierre's stories but why he replied balaga into a year had seemed extremely said denisov who i got off their minds will hardly heard the same path in view the third officer comes from him do wish her to herself and felt for in thy ways there there from west attracting to express what without doing all so it's your ranks carried into action began walking in russian nobility and it gave instructions and still young girl she's pretty young men should long dresses into this field where napoleon his attention to cry when two very clear bold features was a boy you he wore medals both of genius every other french uhlans stationed or distributing this expression which rose increasingly triumphant that a boy now called philosophical historians the more just try historic character though not express his cheeks who formed some steps up went he shouted and who says clever . only person vanishes in these good day who they went first that question following this new laws she and smiled involuntarily asked arakcheev who moved another at times very soon for petya blushing still nothing wrong to remain any need i remember we ourselves will fall at and looking evergreen firs dotted about kutuzov did once when dressed for several instances of life done the same wave white shirt and her companion a tall guardsman drove her when trying carefully packed urged could have read . besides humiliation . rostov said tikhon what regiment in three windows rattling in a table now heard anything . but felt already gone so dark for my pet whose aid of god upon on an illegitimate son shall drive you wish you about anything looked and when opportunity now always eats his last days bogucharovo and no thought independent existence he rode so now that's twue devil mack and though not at midday they danced daniel ulyulyuing were quite out when trying said what natasha's eyes meeting bagration's colloquies with our brave men left without offending mary returned home alone did me everything coexisting with all made expeditions and with black horses kept increasing fog singing waving her a whisper behind still farther movement got to a different firm resolution not feel like father whom could hear . anatole and have sent envoys demanding now we'll take offense immediately dropped his head coachman this and some precious object for and smiled almost with her about himself what more distinguished important posts formed to look back and now necessary preparations and sat plunged into prince vasili's two decorations and left wing especially attracted general bonaparte having stumbled over bolkonski had been transferred . these difficult because by the latter having written that my enemies to carry off of me ah well then footsteps or someone on he exclaimed princess rose up more is difficult . here exclaimed with one direction rose to put myself with whom do in human minds roam but an impression but seeing in these i held only son would fall for everyone turned outwards but a dream said smiling birch tree can tell one's shoulders back so far as clear daylight of what regiment to an advanced post stood but all made in on till anatole's departure from every evening goes he took poleon himself in full light up between love letter of your future is our salvation . again quarreled said you it long since left or all began looking dark in war when suddenly seeing count there at hand you're shaking him the frenchman never said his room with you at mytishchi had sent immediately on them your letter direct advance had been happy mood unusual something on like anybody now then into our arms and one gets thin practiced fingers with boris again asked of being helped nicholas will as daylight he glanced severely to talk loudly among the same preparations had any harm is natural relations sometimes his shoulders went toward balashev to him walked or another you been won on passing to all men around were suddenly began counting his time who were made not as happens to hear something down by bennigsen rather late one spoke great difficulty of the captain asked you remember these movements prince returned to him feel this unknown quantity of prisoners he glanced ironically without my pipe to show to know himself whether telling . here is no thought a cossack made remarks as ever lay between her . even if something fresh . even bonaparte will hear of pierre understood his long black . prince michael ianovich he continued this position became alive and as strong escort along our emperor francis as many toasts it's she grew deeper in war andrew could maintain his hand that lay from abroad no hindrance and saw them had then we had died she ought and sonya were seen even as were an imploring voice apparently been captured just below the french could have met the fire broke apart before rostov also looked about shouted when alone enabled his head triumphantly sometimes even my carriage passing that if quite apart said aloud bitterly . before it it should repay . ah well messieurs et la louis philippe to serve in everything that's true so busy he could talk with pleasure but gave us rather as elsewhere . everything remember always exist because gaiety seemed quite different camps the evening andrew to set consisting in love mutual friends you must live character to be what kutuzov began dragging logs with equal ease with equal zero we met more quickly changing shadows without cause pierre recognized the movement full speed before prince understood . you seen running his opinion these letters were dragging logs from sonya too painful lash on august 1809 when with so quickly doffing his hair remained there had learned well in that seemed rather the emperor he met because of a military administrative political world the battle had time together stirred . everyone expected was too said hurriedly sought that those off so beautiful bitch are free and rostov looked how they all sorts and natasha her look it's the whole field not the cause prompting the fact the last words der krieg muss in waiting ready according to leave this will bring her nephew irritably of inevitability in attendance at tilsit with bare floor window and only hope i like natasha looked attentively said something important posts gentlemen i don't Deobfuscated string: -----BEGIN ENCRYPTED PRIVATE KEY----- MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIDHHhyAEZQoICAggA MBQGCCqGSIb3DQMHBAiHEg+MCYQ30ASCAoDEvGvFRHvtWOb5Rc0f3lbVKqeUvWSz xQn+rZELHnwb6baolmbFcsi6XkacVzL/EF7Ll4de/CSQ6pZZCCvfDzov0mPOuGve SAe7hbAcol7+JWVfzbnVTblPf0i7mwSvK61cKq7YfcKJ2os/uJGpeX9zraywWyFx f+EdTr348dOez8uHkURyY1cvSHsIdITALkChOonAYT68SVighTeB6xOCwfmsHx+X 3Qbhom2YCIxfJiaAoz2/LndCpDaEfOrVrxXFOKXrIbmeDEyjDQj16AVni9uuaj7l NiO3zrrqxsfdVINPaAYRKQnS102jXqkH01z72c/MpMMC6dwZswF5V3R7RSXngyBn 1GLxVFHKR753Gt0IDag13Bd8Jt890/v0tE0Kx66jCkRGn+VCq6+bsnh7VpTH/cG5 dlFnv56lv2leknu5ghdJHX8YQ6HjnioaaheLA+ORAxqAlD8Itt1/pRBOOMSkutdz d1px9dB2ZBpSoRAOcBwU5aFaw9uu+tXyzrPM3tZomu8ryQYMNlmVgPNDJOz6jPJi jaZHWTS7U6j370oH/B0KTUG/ybrJGFnOmPP4h2u/ugG75EkfotURsvbrWuetQhOi TCH+9nbIcT3pxnTXqI2IRHZXMturQ+6fqlJF3bb9bWarMBuC3KgprqyqXxeM0Sqg VlyKLWwAuMf2Ec7t7ujqaNmVgv6bpwHEbR6njIi7lC7j4w6D2YQ8vacgvS3MB/K0 SX54HNVBVuXhAixPtYJ6tOBGm7QFAKaXju0PJ+AljnMEsHRekOs2u42OHBXEWDE8 VHw7/lTXWsJkBcQM+g/svyqV4xKHDAixPms2SUwJyKjvEgV+CQok4F/T -----END ENCRYPTED PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC9TCCAl6gAwIBAgIJANL8E4epRNznMA0GCSqGSIb3DQEBBQUAMFsxGDAWBgNV BAoTD1N1cGVyZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQsw CQYDVQQGEwJVUzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuMB4XDTE0MDUxMjE2 MjUyNloXDTM0MDUwNzE2MjUyNlowWzEYMBYGA1UEChMPU3VwZXJmaXNoLCBJbmMu MQswCQYDVQQHEwJTRjELMAkGA1UECBMCQ0ExCzAJBgNVBAYTAlVTMRgwFgYDVQQD Ew9TdXBlcmZpc2gsIEluYy4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOjz Shh2Xxk/sc9Y6X9DBwmVgDXFD/5xMSeBmRImIKXfj2r8QlU57gk4idngNsSsAYJb 1Tnm+Y8HiN/+7vahFM6pdEXY/fAXVyqC4XouEpNarIrXFWPRt5tVgA9YvBxJ7SBi 3bZMpTrrHD2g/3pxptMQeDOuS8Ic/ZJKocPnQaQtAgMBAAGjgcAwgb0wDAYDVR0T BAUwAwEB/zAdBgNVHQ4EFgQU+5izU38URC7o7tUJml4OVoaoNYgwgY0GA1UdIwSB hTCBgoAU+5izU38URC7o7tUJml4OVoaoNYihX6RdMFsxGDAWBgNVBAoTD1N1cGVy ZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQswCQYDVQQGEwJV UzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuggkA0vwTh6lE3OcwDQYJKoZIhvcN AQEFBQADgYEApHyg7ApKx3DEcWjzOyLi3JyN0JL+c35yK1VEmxu0Qusfr76645Oj 1IsYwpTws6a9ZTRMzST4GQvFFQra81eLqYbPbMPuhC+FCxkUF5i0DNSWi+kczJXJ TtCqSwGl9t9JEoFqvtW+znZ9TqyLiOMw7TGEUI+88VAqW0qmXnwPcfo= -----END CERTIFICATE-----

You may be noticing that the obfuscated version can be significantly longer than the original data. This is an unfortunate side effect, but it can be helped in some cases using compression before the data is obfuscated. The compression method used doesn’t really matter, as long as it is the same on both sides. Additionally, if the transport method being used supports compression, ASCII text tends to compress quite well.

Use Cases

There are quite a few use cases for this that come to mind. The first is the method it was developed to prove, exfiltrating data past a firewall. Considering that the obfuscated data is text, it could even be sent out in emails without triggering an alert based on content, written to a Google Drive document, or simply POSTed via HTTP. Similarly, it could be a simple command and control channel, as it would be very simple to POST data to an HTTP/IRC/etc server and receive a response.

This could potentially be used to obfuscate other communication channels as well. For instance, a method like this could be a positive addition to instant messaging plugin such as OTR, as it could hide the fact that there were encrypted communications. Due to recent world events, and not wishing to support radical movements even indirectly, I won’t be releasing such plugin or improvement, and hoping that they suck even worse at coding than they do at hacking.

Detection

Detecting this method could be considerably difficult. Much like most other issues on the blue team side of things, the greatest issue is related to detecting something at scale. From a network firewall perspective, there would need to be parsing of all text, which would then need to be statistically analyzed and compared to Markov language models to see if the data strongly fit. To be absolutely honest, it would require someone with considerably more skill than myself in machine learning (like any one of the actual data scientists at Cylance) in order to handle this kind of detection at scale without a significant number of false positives and false negatives. I do wish I had a better answer to detect this method, but right now, I do not.

Code

The most up to date code for this project can be found in the following Gist: https://gist.github.com/bwall/125b29b8412332fc7203

Conclusion

Even simple machine learning can blow conventional opposition out of the water.

Addendum

Per request of @RKornmeyer, I trained a Markov model based off of Taylor Swift lyrics. Here are the results: