Exfiltration techniques

Hello. I am looking for some crafty data exfiltration techniques, mainly to acquire code I've written at my current job before I get fired. Work laptop encrypts any outgoing data, so I can't copy it to external media. Here are some ideas I've come up with: - Zip up code and convert archive to base64 text file - Open file in text editor and record cell phone video of me scrolling through it - Capture each page in the video to an image and then run that image through OCR on my home PC to convert it back to base64 - Decode the local base64 to ZIP and then extract Ingenious idea if I do say so myself and I've proven that it can be done with simple blocks of text. However, OCR relies heavily on a word dictionary, but base64 is just a bunch of letters and numbers which renders OCR basically impossible. So I came up with the idea to create my own dictionary out of every possible base64 character combination, but the Tesseract libraries I settled on do not make it easy to utilize custom dictionaries. No one else seems to know how, either, so I abandoned the attempt. Idea 2 - On source machine, write program to modulate data bits to audible sound - On target machine, write program to demodulate the sound through a microphone and convert it back to bits. Basically a modem in the truest form This is another grand idea and, as a skilled software engineer, would not prove to be much of a challenge. However, I just need to be pointed in the right direction. So does anyone else have any other slick methods to get data from this encrypted machine? I know this place has some real brains, so let's hear your best ideas.

>>2883 > Work laptop encrypts any outgoing data, so I can't copy it to external media. Could you explain this further? What OS? How is this supposed to work?

>>2883 The problem with both techniques is that they will leave forensic evidence of what you did on the machine. A cool hardware project might be to build a device that plugs into VGA/HDMI port and pretends to be a monitor but saves screenshots so you can OCR the data back like your idea 1. You could probably do the same thing with a camera pointed at the screen too if you can take the laptop home with you. It would probably be a bit too tedious and impractical just to steal garbage source code from work though.

>>2884 >Could you explain this further? What OS? How is this supposed to work? It would probably be a work laptop which OP has no control over. Depending on how sophisticated the company is they may do forensic analysis on it after you leave so tampering with it in any way could go quite badly for you. The nuclear option might be to root it and subvert whatever software controls they have in place to stop you copying things off and then just say you lost the laptop but this series of actions could have some serious consequences if things don't work out the way you expect.

>>2887 What about feigning innocence by saying the laptop got rooted by malicious software and you have no idea what happened?

How much data is being discussed with this? Would it be at all feasible to write a program which generates an approximation of this source and refine it towards this in some way. This seems far-fetched, but I figured I'd suggest something that hasn't been suggested yet and this could be feasible if the data is particularly small. Remembering the general structure and then reimplementing it would also work, if it's small enough. I distinctly recall reading an account of extracting iPod firmware by having gained control over the device and using the speakers to output each bit and, over the course of several hours in a mostly-sealed container to decrease interference, successfully extracting in this manner. As I'm aware this works well enough, you'd probably be best off doing this and perhaps later testing the acquired data in some way; I'd wager it would most likely result in at least a compiler warning if an important character in the source were to change, but testing the actual compiled program's behavior would be best, of course. As for this account, I've been unable to relocate it.

>>2886 They can't find forensic evidence on OP's work laptop if they can't find OP's work laptop <_<

>>2890 >They can't find forensic evidence on OP's work laptop if they can't find OP's work laptop That's true. But stealing or destroying company property could make you easier to catch and make your situation much worse. Corporate laptops may have cellular modems too so check for that. You may not be disconnected from the network when you think you are so they may not even need physical access to the device to figure out what you did. >>2888 >What about feigning innocence by saying the laptop got rooted by malicious software and you have no idea what happened? That might be cool. I'm not OP but I don't think I would be able to play dumb because everyone knows I am into security.

>>2888 >What about feigning innocence by saying the laptop got rooted by malicious software and you have no idea what happened? The problem I see here is that malware would probably leave forensic artifacts that would help OP's case. Without that and a bit of digging through system logs or whatever their setup for devices leaving the premises(depending on OS) it'd be pretty easy to see OP was taking the piss. >>2890 They most likely have software set up to locate and/or wipe it from the sounds of things. >>2883 They have to decrypt it somehow. If you know what they use for decryption you could learn more about it and see if there are any viable workarounds or flaws you could exploit that wouldn't put you at as much risk. You already seem to have some type of steganography on the go so I'm not really sure what else to suggest.

>>2883 If you can play sound from it then maybe you can transfer data over aux audio cable? Might be a little bit more convenient then using actual sound waves. It has been done many, many times. There used to be audio recorders that worked like this and you should be able to find similar Arduino projects to achieve this.

>>2883 Rather than use OCR software, why not use a qr style encoding. This is much easier for image processing software to decode Software like qrencode should be able to do the job if you break the zipfile into small chunks, then encode each separately Then load all resulting images in image viewer software and click next on each of them while recording vid with cell phone

ideas: If you have fire wire or other pci accessible ports you can use a DMA attack to just dump the entire contents of memory. It's a little invasive, but shouldn't be dangerous. If you can take your laptop home, that'd be ideal. Second: If you have internet access but it's highly filtered you can extol the code via DNS queries Third: There alternatives to your lossy ocr method Try this: place a camera in front of the computer and flash the contents of the file to the video in binary black and white flashes. Depending on speed this will be highly reliable. You can also search for a method to root the computer and use your admin privileges to do things the easy way,, but that'd leave more evidence. I really doubt your computer encrypts everything it puts out. To be honest I bet if you put the thing on. Switch and opened up wireshark you'd find tons of soykaf you can embed the code in and retrieve from the logs. Here's an example: if your computer is windows, and it's domain joined a bunch of the active directory traffic is unencrypted. Just fuarrrk around until you find a command where you can send arbitrary strings. Not to mention you can likely root your own machine using smb relay attacks and that kind of stuff

OP here. Got sidetracked for a few days, but back on the topic. >>2884 >> Work laptop encrypts any outgoing data, so I can't copy it to external media. Could you explain this further? What OS? How is this supposed to work? Windows 7. They use endpoint encryption which, if I understand correctly, stands between the OS and all PC peripheral ports, encrypting all data that passed through the endpoint to USB devices, external drives, discs, etc. >>2886 >The problem with both techniques is that they will leave forensic evidence of what you did on the machine. Since I am looking for a self-rolled solution, the only forensic evidence would be the code I write myself, the intent of which would be wholey indecipherable provided they even know what they're looking for to begin with. >>2889 >How much data is being discussed with this? Maybe about 20 MB tops. >>2895 >If you can play sound from it then maybe you can transfer data over aux audio cable? Might be a little bit more convenient then using actual sound waves. It has been done many, many times. There used to be audio recorders that worked like this and you should be able to find similar Arduino projects to achieve this. I'd like to try this, but it can't be anything I'd have to download onto my work laptop. I'd rather not have to actually browse to any sites that would leave a trail of suspicion, either. Still, do you have any pointers on where I can start with this? >>2898 >Rather than use OCR software, why not use a qr style encoding. Someone else recommended this once, but the overall throughput would be way too slow. QR codes are quote limited to around 3k. It would take ages to manually tranfer 20 MB this way. Otherwise, crafty idea for transferring small amounts of data. >>2899 >If you have fire wire or other pci accessible ports you can use a DMA attack to just dump the entire contents of memory. It's a little invasive, but shouldn't be dangerous. If you can take your laptop home, that'd be ideal. Yes, I bring my laptop home every day. I will look into DMA attacks. >>2899 >If you have internet access but it's highly filtered you can extol the code via DNS queries I've heard of this, but am too scared to try it. As I understand it, this type of attack is practically impossible to detect unless you're looking for it. With my luck, they are and I don't want to test it. >>2899 >There alternatives to your lossy ocr method Try this: place a camera in front of the computer and flash the contents of the file to the video in binary black and white flashes. Depending on speed this will be highly reliable. I've thought of converting bits to black/white color, short/long audio blips, or other binary carrier signal, but measuring bits this way would make for very slow throughput. >>2899 >I really doubt your computer encrypts everything it puts out. So badly I want to put this to the test by saving a small text file to a thumb drive, but am afraid they have installed some kind of endpoint monitoring that would detect external devices, thus potentially raising suspicions and leaving a trail. >>2899 >soykaf >fuarrrk ????... word filter?

>>2902 OP here. As I mentioned, I bring my laptop home and plug my own Logitech G11 keyboard and Logitech G500 into it. Is it possible to transfer data to these devices? If so, I could offload it to my home machine rather easily. The endpoint encryption wouldn't affect this because the Logitech software itself has to communicate with the devices, something that couldn't occur if the communications were encrypted.

>>2903 You can install third-party hardware and drivers on your high-security machine? What is this "USB encryption" thing you are talking about? Is file system drive fully encrypted and accessible via password? Do you have access to keys, or does it boot from tokens? If first, take off the system drive, hook it up to another computer in read-only mode, dd whole partition to another drive, mount it and decrypt. Or just plug in a video capture card, output code to high contrast text editor, full screen, save screen by screen, then feed it to OCR. If your goal is to leave no forensic evidence, then only mirroring the drive and trying to fuarrrk with it on another system is only option, everything else will leave traces. Any kind of base 64 encoding, sound modulation and all this cowsoycaf larping would look suspicious unless you are ready to plead it was a virus from russian hackers. What the fuarrrgh, why such brainlets have a high-clearance programming job and I work at garbage disposal, why.

You get to take it home.... just clone the drive and use in in your PC, since you can normally login you can just decrypt the data like that

>>2905 >>2907 I doubt you'll be able to just pop the harddrive out. At the very least I'd expect some tamper evident seal on it somewhere. But lets see what OP says.

>>2908 I agree there must be some anti-tamper stuff going on if they are even using encryption with that thing and allowing you to take it home.

https://hackaday.com/2016/11/22/ip-over-qr-codes/ try this

>>2883 email it to yourself

>>2883 > mainly to acquire code I've written at my current job >>2902 >Maybe about 20 MB tops. Mainly? Are we taking about 20 MB of source code? If yes then this would translate to about 80000 LOC in C++ (estimate based on the project from my work). Assuming you have been working there for 10 years that gives use something of 31 NEW lines of code each day (5 days a week). No, I don't belive that you only want the code you have wrote. If you would then the company is stupid trying to fire a programmer who has writen so much code in there project.

What protections are there exactly, OP? Might sound obvious but anything software(and maybe hardware,) can likely be solved by booting into a linux live cd or usb, can you do this? Why exactly can you not ex-filtrate through the network? is this an off network machine? >>2922 >>No, I don't believe that you only want the code you have wrote. If you would then the company is stupid trying to fire a programmer who has written so much code in there project. Maybe the company is stupid. companies often are. and if not? it's called plausible deniability. why be a dick about this?

>>2922 >31 NEW lines of code each day (5 days a week). That's not very much for a professional programmer. I regularly write 200+ a day.

>>2925 Is it? Well if you think about small projects then yes, that is a small amount of code. But when a project gets biger, then you start looking on it different. A lot of work is put into rewriting things already in the project (and that doesn't count in the "NEW line per day", unless your not rewriting your own code), bug fixing, integration with new devices, meeting, and so on. Maybe I'm seeing this from a perspective of my own work but writing NEW code is about 20% of work time for me (or less). Add to this that part of the code I write (and probably other programmers also) is bullsoykaf code (for example glue to make two modules work together). There is no sense in obtaining this "glue code" as its worthless without the rest of the project. >>2924 >why be a dick about this? Ok, your right this is not my concern. If I don't believe OP's good intentions then I can just not give any help in solving this problem. It was not my intention to be a dick about this.

>>2925 Maybe at a micky mouse startup. In a real company you won't get anywhere near 200 new lines of code per day.

>take out the hard disk and clone it >smash the laptop and throw the pieces away >go to the police and report your laptop was stolen, tell them you don't know how >tell workplace your laptop was stolen this is simple

If you're worried about forensics, please don't use the laptop to write any incriminating code. If you can plug in a monitor (for example through hdmi) you might be able to record your screen and ocr with very few losses. Otherwise try booting to a linux live usb/cd and cloning the drive (although the keys are probably stored offsite). Or you could write a program that plays program files as audio, plug in an aux cord, and save the audio to a separate device (maybe even save it as a lossless format). If they ask questions (because this leaves a forensic path) say you wanted to do something artsy and sell it as a databending masterpiece. Also, if you can force your laptop to send the code to their home server, but without encryption, then you may be able to wireshark it off your network. Note that they probably force your computer to use their vpn.

>>2930 >They send a private investigator who fishes the broken laptop pieces out of your trash >You go to jail gg

>>2932 how does broken laptop with no hard disk -> you go to jail? I don't understand your logic. You know how a computer works at all?

>>2931 >If you can plug in a monitor (for example through hdmi) you might be able to record your screen and ocr with very few losses. I plug my laptop into my monitors at home. Do you know of a way to use my home PC to grab lossless screenshots from my work laptop via HDMI? If there's a way to do that, I won't even use OCR. Instead, I'll write my own code to convert the source code data into a PNG where each byte is represented by distinct RGBA values. I'd then capture that image losslessly on my home PC and convert the pixels color values back to bytes. >>2931 >Or you could write a program that plays program files as audio, plug in an aux cord, and save the audio to a separate device What I'd really like to do is convert data to an audio format, hook my laptop up to my home PC via line in/out, capture the audio losslessly, and then be able to interpret the noise as data. >>2931 >Also, if you can force your laptop to send the code to their home server, but without encryption, then you may be able to wireshark it off your network. Note that they probably force your computer to use their vpn. This is a good idea, and I do use their VPN. If it's not encrypted then I should be able to indeed Wireshark it when I check it into the repo. However, I use my wireless router for my laptop. Can Wireshark monitor outbound requests going through my router?

>>2934 >RGBA Now that I think of it, the alpha channel would not work for this, but I there are enough RGB values anyway. I could probably just use all reds provided that the capture is 100% lossless.

>>2934 >This is a good idea, and I do use their VPN. If it's not encrypted then I should be able to indeed Wireshark it when I check it into the repo. What's it they're using? Cisco AnyConnect or something? No way they're not using proper crypto. >However, I use my wireless router for my laptop. Can Wireshark monitor outbound requests going through my router? Just use a linux box and open an APN from there with a NAT to the router via ethernet. Seems easier than intercepting through the router. If I were to work at a multinational tech corporation, I'd go with the capture card route. Then I'd just use a very machine readable font for the editor and scroll through leisurely, keeping notes on which timestamp what file was selected and nothing else. >So badly I want to put this to the test by saving a small text file to a thumb drive, but am afraid they have installed some kind of endpoint monitoring that would detect external devices, thus potentially raising suspicions and leaving a trail. This is what you do: configure your phone as a mass storage device, go to work, plug in your phone as soon as it begins to beep it's low battery alert. It will probably not work, it's common practice to reject mass media devices

>>2933 I know how investigators work. Their laptop in your trash. >>2934 Anything suspicious you'd do on your computer would be logged. There is only 1 viable solution in this thread - to display text on screen and record it externally. >unencrypted VPN What's the point? >how do I Wireshark Stop, please, this is not funny anymore. You can't be this mentally challenged and possess valuable source code on your hands at the same time. This thread is pure bait. 2 weeks of soylatte larping and OP(?) spewing out information by bits. MODS

>>2926 I mean, most of the time programmers aren't writing new code, but if they were building a project from the ground up it's reasonable to write 30 new lines a day on average(1000 one day, 0 for the rest of the week, and so on)

Quick question because I still have no context on OP's situation: can you install innocuous software on the laptop? If you can then open audacity, take the zip/tar file, play as PCM, plug in an aux cord, record with same sample-rate/channels. Can you install GNU tools? Imagemagick to reinterpret bytes as an image is pretty godlike. Basically give us information on what you can/can't do on your laptop please.

>>2925 that's retarded

>>2933 >how does broken laptop with no hard disk -> you go to jail? >I don't understand your logic. Because you told them it was stolen. Now you have deliberately destroyed company property to hide evidence of another crime and been caught lying about it. >>2939 Still depends on the company. If you're at a micky mouse startup with no testing, documentation or any kind of quality standard then sure, 1000 loc a day no problemo. Not all jobs/companies are like that though.

>>2902 >Still, do you have any pointers on where I can start with this? Minimodem is a program that does what you want - you just send data to it and it'll output modulated audio. Set your phone to record from aux cable (if possible, or just use the microphone), and record the incoming audio. You can easily write your own simple implementation too: read in bytes of data (compressed, ASCII, whatever) for a 0 bit, output a tone at 1kHz, for a 1 bit, output a tone at 2kHz. Wait a few milliseconds, repeat, done.

>>2931 Sorry for asking, but for an aplication like this one, which language would you use? I've already thougth on this before, but I didn't knew how to do it. Does it basicly converts the text onto a frequence? This frequence arriving at the recipient, will it be decoded and run or it's going to be droped by the computer? Also, some audio inputs just can deal with outbound trafic, because they don't have mic...(I read somewhere that there is some way to change it so it can recive what you are sending to a input that normaly wouldn't recive.) So, how should I start?

There's a program called minimodem which can easily modulate stuff and decode it later. > Minimodem is a command-line program which decodes (or generates) audio modem tones at any specified baud rate, using various framing protocols. It acts a general-purpose software FSK modem, and includes support for various standard FSK protocols such as Bell103, Bell202, RTTY, TTY/TDD NOAA SAME, and Caller-ID. > Minimodem can play and capture audio modem tones in real-time via the system audio device, or in batched mode via audio files. > Minimodem can be used to transfer data between nearby computers using an audio cable (or just via sound waves), or between remote computers using radio, telephone, or another audio communications medium. http://www.whence.com/minimodem/ Under Windows it may work with Cygwin.

>>2984 Thats great! But in a different scenario, where only the sender have minimodem installed, is it possible somehow to use it to install himself at the recipient computer so a connection can be established?

OP here. Still working on a solution. This soykaf is fuarrrking complicated and I don't know which option is worth investing time in. So, for acquiring my source code, there are these options: QR code: I would have to write my own encoder on the source machine. I am not opposed to this, but the time it would take to transfer this much code makes me dread having to fall back to this solution. OCR: I think by far the best option here is to convert the binaries to base64, take pictures of my screen, and then use OCR to convert the images back to base64 and then to binary. The problem is HOW THE fuarrrk DO I DO THIS. I have been trying to use Tesseract, but it relies strongly on a dictionary and is absolutely useless against base64. I thought about generating every possible base64 character combination and using that as the dictionary, but can't figure out how. In short, this is the best solution, but I am abandoning it due to lack of support. Email: I could easily email myself the source code via Yahoo! or Gmail, but, if my company is using MITTM bullsoykaf, I could easily be discovered. I need a way to find out if they are intercepting HTTPS and I don't know how. Excel: Excel files are just archives of XML files, so I could theoretically hide a base64 string as a comment in one of the files, attach the workbook to a draft email, and then access my email from the corporate web app where I could download the Excel file. I don't know what security measures my company is utilizing, though. If I upload an attachment from my work machine and then download it remotely, they could detect this which could set a red flag. fuarrrk this is like kicking dead whales down the beach. It's so difficult. I can't believe there are no objective answers to this.

>>3208 >fuarrrk this is like kicking dead whales down the beach Gotta say, the word filters here are something else

Do you really need all of the code? If you had certain "key pieces" could you fill in the gaps yourself? If this is the case I would just take pictures of these key pieces and rewrite the code from these pictures, then fill in the blanks as I said. Otherwise, maybe try coping a file to a USB just to see what happens. Just open a text editor and write out something that looks like a Christmas shopping list and stick that on the USB. If you get called up for it then say it was for your sister/mother/father/aunt whatever. At least then you'll know if you can get a file onto a USB. Maybe call it something suspicious to see if you do get called up on it? I think you'll need to do some active probing to see exactly what's being watched. For all we know you could simply copy the files to a USB and everything works out fine. If you're assuming that some software if watching everything you do, you could always disconnect the device from the internet for a weekend and see if any specific files/folders seem to have grown. This software would probably have to store logs if it can't send the data over the wire.

>>2883 Some things to try Enterprise exfiltration-prevention software neglects MTP oftentimes, so just plug your Android phone in and be sure to use MTP mode If you use a 3rd-party CD burn software (cdrtfe is very good) that can get past stuff also Of course, this is all assuming the HDD is locked with Bitlocker or whatever in the first place to prevent you from just drive-swap or live CD Can you run PuTTY on it or something, perhaps, and use SSH to exfiltrate stuff? ZIP all your stuff up, split+base64 the archive, then just paste paste paste and reconstitute on the remote host Theoretically you could even SSH-tunnel into a server running a tiny webserver with just a file upload, use your browser (or theoretically there are win32 curl/wget, and doesn't PowerShell support HTTP these days?) to send a ZIP file through to your "localhost" web server

>>3208 > I need a way to find out if they are intercepting HTTPS and I don't know how. Check the HTTPS cert in your browser, seriously I'm actually using my own browser at work (I want Firefox but my company's IT can't into configuring it for HTTPS support with the MITM proxy, nor NTLM, so I just rolled my own installation and did the enterprise setup, thankfully it doesn't need Admin) But I did indeed get HTTPS errors until I found and installed the company cert, they have it set up as a "certificate authority" which "signs" "certificates" for every website whose connection they're intercepting Does your company mandate VPN when accessing over clearnet? If not, then seriously just get a f0cking raspberry pi or literally any other computer and take 20 minutes to set up a web server with file upload on your LAN at home and be done with it

>>3225 My understanding of these corporate external storage copy prevention stuff is that it records basically the "important" stuff >time >filename >size >heuristically determined relevant excerpts if that's helpful at all p.s. OP is actually infosec spy infomining for what "the kid use"

OP here Good replies which I will respond to over the holiday at some point. However, I think I have decided on my solution. I am just going to write my own OCR program tailored specifically to my particular need. The reason why is because all existing OCR programs are crap in recognizing anything that's not a word in a dictionary. There's no pure "character recognition" that doesn't need to look in a dictionary to calculate a best guess. In theory, dictionaryless OCR should be easy. Pic related is the program I am working on right now. I've already been able to define the vertical bounds of the monospace font OCR-A. Next, I will identify the horizontal bounds which will allow me to identify regions that contain characters. As it encounters new characters, it will prompt me to key in its character value which it will enter into a dictionary. I will then create a sort of of image DNA algorithm so that it can look up known characters by hash. Once it finds a match, it will know the character to which it corresponds. The rest is easy... just write the characters to a string and then decode the resulting base64 to its native format which, in this case, will be a .7z file. Will be working on this throughout the holiday and update everyone with my progress.

>>3231 This is SICK. I am popping mad bone right now. Now to plot the character boundary points. Once I do that, I will trim off empty space from top and bottom like what you see in row 1 beneath the N, above the y, and above/below the r and c's. After that, time to work on the image DNA algorithm.

>>3231 >>3232 ..is that really more feasible than just makin a tiny webserver on your LAN and using Private/Incognito to upload it? Or is it not so much about the exfiltration anymore, but the OCR project as such?

>>3233 >.is that really more feasible than just makin a tiny webserver on your LAN and using Private/Incognito to upload it? It really boils down to the fact that I am too scared to try anything that will leave a footprint of any kind. There are so many great ideas in this thread like SSH tunneling, MTP mode on Android, etc, but there's a reasonable chance of getting caught with any of these proposed methods, especially with my company's MITM bullsoykaf. With OCR or even transferring the data over an audio cable, this is practically undetectable. The only way they could figure it out is if they're taking screenshots and just happen to see Notepad at full screen with a bunch of base64 or see a audio-writing code in my IDE. Those are really the kinds of ultra covert methods I was hoping to see in this thread, though all of the other suggestions have been great and would certainly be viable in a low-security work environment. Updated pic: I've now identified character boundaries. Onto the image DNA now

>>3234 >The only way they could figure it out is if they're taking screenshots and just happen to see Notepad at full screen with a bunch of base64 or see a audio-writing code in my IDE. You may not be able to guarantee the deletion of the code you write to do this. Does the laptop have an SSD for example? Admittedly they would have to look for it forensically so if you don't arouse suspicion in the first place then the odds are good. What >>3233 said got me thinking. You have full control over your own LAN. If you can find a way to subvert the encryption between the laptop and work (VPN presumably? Or maybe SSL for email) then you could just copy everything to work and pull the data from the wire without implicating yourself. Does the laptop browser let you click through SSL certificate errors? Emailing the code to work and MITMing yourself with a self signed cert might be an easy way to do it.

>>3235 >You may not be able to guarantee the deletion of the code you write to do this. I am not even worried about them finding the code. All they'd ever find is a line of code that writes an archive to a base64 text file and, of course, a few base64 text files. That doesn't prove anything, nor it is enough to even give a clue as to what they were used for, especially without a network footprint of any kind. That's what makes this so awesome. Managing to transfer data in this way is the closest thing to sorcery and it feelsgoodman.jpg. >>3235 >You have full control over your own LAN What does this mean, exactly? The laptop is the company's and I can access the internet on it regardless whether or not I am connected to the network via VPN. I've noticed that traceroutes are substantially different when not connected. One might suggest that I disconnect VPN and do the dirty deeds via email, but, as someone already pointed out, they could be logging the data locally whenever a network connection is unavailable and then send the logs to the server on the next VPN connection. >>3235 >Does the laptop browser let you click through SSL certificate errors Don't know. Haven't encountered this. Not sure how I would MITM myself. New update: My OCR is coming along nicely, but with a good deal of challenges ahead. The image DNA is proving very difficult, but I am almost there. The red characters I had to identify for the program initially, but the yellow ones were identified automatically by finding a match on an existing DNA hash. Not bad for probably only 10 hours of coding. I could have this done by the weekend if I keep at it.

>>3239 Oh yeah, and there's a lot of screw-ups in the resulting base64 because I was typing in the wrong characters. The DNA part is also flawed because of how I am building the grid. I think I need to scale all regions to a static size.

>>3239 >All they'd ever find is a line of code that writes an archive to a base64 text file and, of course, a few base64 text files. Do you are just opening the text files manually one at a time? That's fair enough I guess. >What does this mean, exactly? It means you don't need to send the data to yourself, you can capture data as it goes across the wire because they are your wires. The data might be encrypted though. >One might suggest that I disconnect VPN and do the dirty deeds via email, Well I suggested email because there is nothing wrong with emailing your code to your company email address from your "secure" laptop. They can't prove that you did a MITM. It doesn't have to be email though. You could encrypt and embed parts of the code into cookies and send them to random http-only websites. The fact that you are on your home network and not at work gives many possibilities.

My samsung 5 has slow motion recordidng, use opencv to normalize the picture. Then extract text and compare until it becomes more and more cohesive (page turning). Use background subtraction using hughes transform to average out the background etc.

>>3208 You said earlier that QR codes can contain a max of about 3K byte data, which is correct, but remember that 40-L QR codes are only 177x177. If you could arrange them fullscreen and capture them pixel-perfect (by capturing the output of an HDMI port as some here have suggested), you could fit 40 on a 1440x900 screen (8 wide, 5 high). If you captured the video at 60 frames per second, and showed 40 new QR codes each frame, you could reach your 80M goal in only 11 seconds: 80000000 / (40 * 60 * 3000) = 11.1. Of course, if you're limited to camera recording, you'll potentially have to capture at a lower resolution / at a lower fps, so the time will go up. Even so, I doubt processing QR codes like this would take more than one night.

>>3248 To add to this, you can only display about 200x50 characters on a 1440x900 screen, so if you use text and OCR you're limited to about 10K per frame, compared to about 120K per frame with a fullscreen array of 40-L QR codes.

>>2883 >>3239 Now that i think about it, dump ssl-wrapped text (socat/netcat) in udp mode and dump everything on a random server very quickly

>>3242 >Do you are just opening the text files manually one at a time? That's fair enough I guess. It's one big text file that I plan on paging through as I record a video with my cell phone. >>3242 >They can't prove that you did a MITM. It doesn't have to be email though. You could encrypt and embed parts of the code into cookies and send them to random http-only websites. The fact that you are on your home network and not at work gives many possibilities. I admit that I like the ideas here, especially inserting the data into a cookie. An event craftier idea would be to find a site that uses WebForms so that I can inject my data string into the ViewState. This would prevent a suspiciously-large cookie while no one would care about the ViewState because those can be huge anyway. Still, I'd have to set up some means to intercept data sent to my router, but first would need to find out if outbound requests are encrypted. That's a lot of new research that I will save for a last resort if other covert methods fail.

>>3245 >My samsung 5 has slow motion recordidng, use opencv to normalize the picture. Then extract text and compare until it becomes more and more cohesive (page turning). Use background subtraction using hughes transform to average out the background etc. I just looked up OpenCV and it seems interesting, though perhaps a bit complicated. I would probably be able to leverage it to straighten out skewed video frames resulting from my camera not being perfectly horizontally and vertically parallel to my monitor, an issue that is giving my OCR algorithms lots of problems.

>>3248 >you could fit 40 on a 1440x900 screen (8 wide, 5 high) This is actually a great idea. I think there are code samples out there to create QR codes. I could develop it at home and then store it in one of my web email accounts as a draft and pick it up on my work PC from there. Going to look into this more.

Here's the latest update to my OCR app. For now, I've given up on trying to process cell phone images due to all the skewing and noise which has been a pain in the arse. So, just to get working code in place, I finally achieved 100% accuracy on pixel-perfect screen caps. The text in pic related is base64 of a 900-byte GIF which I was able to encode/decode perfectly. Also ran both strings through a text compare utility and there were no differences. Now I just need to find a way to automate the clean-up of the resulting cell phone images. If I can do that, I am pretty sure this program will be just as accurate as it is with screen caps.

>>3248 >by capturing the output of an HDMI port as some here have suggested Do you or anyone else in this thread know how I could use my home PC to capture video from my laptop VGA or HDMI port? Seems like I could connect my laptop directly to my PC graphics card and then use another app on my home PC to capture it. If I could do this then I am pretty sure I am sitting on a working solution right now as my custom-built OCR program would be able to handle the resulting images very nicely.

>>3257 Or, at the very least, anyone know of any ways to straighten out/clean up skewed/noisy cell phone images?

>>3257 Yo graphics chipset does not have "record" capability at all Unless you are able to write a custom firmware for it and even then I doubt it's electrically possible to just do without modifications (I tell ya what though, this project is damn neato but realistically a web server on ya LAN would get the job done. Especially if you set up a smol self-signed SSL cert and just checked it was being used before uploading)

>>3259 >realistically a web server on ya LAN would get the job done I recall this being mentioned, but don't know if it was fully explained. How would this work? I set up a web server on my home PC and then somehow connect to it through my work laptop? My work laptop connects to my home wireless. Again, I am trying to avoid sending anything detectable/suspicious over the wire from my work laptop. However, if the solution you propose would somehow allow my laptop to POST directly to my LAN web server then I am definitely interested.

>>3260 All you have to do is install Apache or Nginx or Hiawatha on a raspberry pi on your home Wi-Fi Configure it for PHP Maybe maybe bother configuring a self-signed HTTPS cert Spend 2 minutes making a minimal HTML+PHP upload utility Then >zip ur files up >Open private browser tab if you feel like it >go to http://192.168.0.69/my_upload_demo.php >check the HTTPS cert (after clicking through it), if you set one up >upload zip folder >bazinga, u don it seriously it's that simple

>>3260 >>3261(Me) To clarify, yes, you would need to connect your work laptop to your home Wi-Fi just for various reasons >not on the work network; they're not going to be monitoring it >lotsa bandwidth if you don't send it over the Global Wired >don't bother with port forwarding, as well as hoping a) your home ISP allows inbound connections and b) your work allows outbound connections to residential IP blocks and/or unknown domains

>>3257 You'd need a video capture card like this one: https://www.newegg.com/Product/Product.aspx?Item=9SIAB3G53D7821 (no wage slave)

>>3261 >raspberry pi Is this absolutely necessary?

>>3263 >You'd need a video capture card like this one I didn't even think of a capture card. I have one, but it takes s-video or coax as input. I will have to see if I have an adapter for HDMI or VGA. If not, I am pretty sure I know where to get one. Not worried about the quality difference. As long as the image is horizontally and vertically stable, I should be able to filter out any noise.

>realistically a web server on ya LAN would get the job done Depends on the level of logging on the laptop. A ton of HTTPS POST traffic to http://192.168.0.69 is a big red flag that an employee is stealing data.

>>3264 Not at all I was just using it as a for-instance to show that anything is suitable >>3270 Hence a) They're really really likely not going to be recording random connections made on his LAN b) even if they are (which is absurd) it's only going to be metadata c) if for some unfathomable reason they're fuarrrking MONITORING DATA SENT AROUND NON-WORK LANS, then see d) HTTPS (provided he CHECKS the cert to be sure it's his own before Uploading) will prevent them from detecting POST It uses nothing outside of the ordinary, just the browser that's already there Corporate logs DNS, and metadata + heuristic samples of any data that flows through their servers or across monitored links like USB; all they're tryna do is not get audited p.s. OP if you are a corporate auditor using us to plug exfiltration holes that could be used by innocent employees (aka doing your job for you) pls kill yourself uwu :3

>>3275 >a) They're really really likely not going to be recording random connections made on his LAN I don't think it's unlikely for a corporate laptop to keep a log of outbound connections. >b) even if they are (which is absurd) it's only going to be metadata Yes I'm not suggesting that they are doing full packet capture. It is precisely the metadata that is the problem. Why would an honest employee make any kind of connection to 192.168.0.69? It's doubly bad if the logs contain the protocol (HTTP POST). >d) HTTPS (provided he CHECKS the cert to be sure it's his own before Uploading) will prevent them from detecting POST That's fair enough. I still argue it is likely that outbound connections are logged and a connection to a LAN address will be considered suspicious. Is there any legitimate reason to do that?

>>3277 Windows spams a crapload of connections onto your LAN anyway If OP wanted to cover his ass, something that might work is to download several large files from his LAN webserver, say, anime MKVs, and then upload a few, different ones back, and perhaps "in the midst of" those, put the ZIP. Leaving off the SSL for one o' the uploads might be a really slick way to cover off anything on the offchance stuff's being recorded >Hmm let's see Anon's logs >Big, encrypted download on LAN... >Big, encrypted UPload on LAN... >Big— aHA, unencrypted upload! >Let's see here....Boku_No_Pico_Ep1.mp4 >Another big, encrypted upload.. >Another big, encrypted download... And then they just don't make eye contact with you Shoot, residential "OOTB" NASes are sold off-the-shelf because even today, people store files

>>3279 Ballsy.

>>3279 Boku No Pico is basically CP in some countries. might be better to be caught with all_your_src.zip lol

>>2883 if you are on windows do you have admin privs? if so find the active "encrypt" service and just suspend it. i doubt that service has a heart beat or crc. You could probably use cheat engine or misc and write a script to kernel sleep the process for a long as time if you really wanna be lazy.

>>3256 Hey man any updates? I have an idea that might interest you if you're still around

If it were me, this is what I would do. - convert text file of source code to binary - write a program to take binary input, and output it to a small corner of the screen where 0 = a block of black pixels, and 1 = a block of white pixels - prop cell phone up against that area of the screen, hiding it from view, and record the output - at home, do the reverse, video > binary > ascii

>>4029 It'd probably be too blurry to pull from a video, especially with skew/rotation. Someone else had the idea of encoding it to audio, which is quite easy using a similar method to the one you just described, then connecting it to your phone with a 3.5mm audio cable and having the phone record the audio as you play it

>>3800 >Hey man any updates? I have an idea that might interest you if you're still around OP here. Just coming back to let everyone know that I found a solution that worked beautifully. While my OCR technique was deviously awesome and despite the fact that I was well on my way to getting it working, I ended up using steganography to hide my code within image files which I then emailed to myself. Since my work uses MITM to intercept all requests even when HTTPS, it was a leap of faith as I was unsure what to expect. However, if they happen to have intercepted the request and examine the attachments, all they will see are legit JPGs that open perfectly well in an image viewer. And even if they decide to analyze the data in the images, it's all encrypted with no way to tell what the slurry of random bits actually is. I could still get terminated by mere suspicion, but I would still be able to file for unemployment since they wouldn't be able to prove that the termination was in just cause in connection with work. I think I am safe, though. I suspect that companies with ultra-high security don't allow POST, PUT, or other similar HTTP methods from inside the firewall, but my company doesn't seem to have gone that far (yet). However, anon, I would still like to hear your idea. Might come in handy in the future.

>>4079 So I had a few things I was throwing around in my head, and I'd appreciate your thoughts: 1. Why not use rgb letters? You'd be able to set up a b64 payload with three times the data "expressionability" One problem I thought of was recording quality and accidentally OCR'ing text outside the desired area which could be addressed by adding colored corners (I forget if you had a way to recognize the text area anyways). 2. Why not use larger UTF space whittled down to characters that aren't similar WITH high contrast backgrounds like ☺ - blue on yellow, etc, etc you could make some predefined combinations that are easily recognizable like red on white, white on green, etc. The tedious part would be writing a "mux" or decoder of sorts just because of the extra layers of abstraction. Lastly, since the jankiest monitors hopefully don't refresh below 30Hz 3. Instead of a full screen (contradicting my first point kinda), why not relegate the text window to show maybe a 3x3 grid of chars at the bottom right-hand side? The benefit would be in case someone was watching it wouldn't be as noticeable as a giant window scrolling through/ The reason I brought up the refresh rate is that windows stores display prefs containing the monitor's refresh rate, so before you display text you can find that number of Hz, display a blinking box at a calculated period so when you're parsing the video, you would be able to calculate the true and perceived rate that your camera captures monitor redrawings. This way you'd be able to calibrate the recognition time between frames just in case some are missed or are displayed for too long. Idk, thoughts?

>>2973 20 MB eq 20000000 Byte eq 160000000 Bit Assuming 5ms pause and 15ms tone this takes 888h (5.2 weeks). Assuming 5ms each it's 444h (2.6 weeks). Assuming 2ms each, we get 177h which is probably possible but still amounts to over a full week (nonstop ofc, and assuming perfect transmission all the time) This idea is seriously flawed for the amount of data. Of course, playing one of 256 tones would allow you to send a byte per cycle, taking 1/8 of the time. Still is like kicking dead whales down the beach, but at least is like kicking dead whales down the beach less.

>>2883 1) keylogger that copies buffer content. Ctrl+A Ctrl+V Finished. Get a USB drive that self identifies a keyboard (Rubber Ducky) and enters the commands via a script when plugged into the laptop. 2) Display an 8x8 black white blocks of 'QRcode' style (binary form of your code) as an image at 12frames/sec. When recording at 24fps you'll get 2 frames per image (for error correction). 8*12bytes/sec. 60hrs for 20Mb = INVALID 3) Write a graphics app that modulates lines on the screen Plus some of the ideas from that DEFCON about bridging airgaps: https://www.youtube.com/watch?v=gFTiD7EnVjU IR modulator instead of sound Sound in the high frequency range, you won't hear it, but it will be ripping your data to your recording phone.

One solution is to use Tor with obfuscated bridges. Obfuscated bridges are very, very, difficult to detect and are used in places like China to circumvent the Great Firewall. However, your employer may log programs used or take screenshots which may result in you getting caught using this method. First, select the option to get obfs4 bridges from https://bridges.torproject.org/options from one of your own computers and take note of them in a text file. Save the text file to a flash drive. Second, download the Tor Browser from https://www.torproject.org/download/download-easy.html.en on one of your computers and save it on a flash drive. Third, plug the flash drive into your work laptop and open The Tor Browser. Don't click connect. Instead choose the option that you are censored and copy and paste the bridges you took note of earlier. Do not use the default bridges as they are distributed in the Tor Browser and are easier to link to Tor. Finally, upload your archived code to one of many upload sites using the Tor Browser and set a short timer on the files life span on the upload site. Do not use a site that only has permanent uploads. Download the archive from the URL the site gives you onto one of your computers.