High Wi-Fi Latency: Data Hidden in ICMP Payloads

Overview

The challenge shipped a network capture with a story about unusually high Wi-Fi latency. Instead of a performance problem, the capture hid a covert channel: data being exfiltrated inside ICMP packets that looked, at first glance, like ordinary pings.

Challenge brief

Analyse the provided traffic capture, explain the "latency", and recover the hidden flag.

Analysis

Opening the capture in Wireshark, the general traffic was unremarkable. The interesting signal was in the ICMP stream: echo requests whose payloads did not contain the usual repeating ping pattern, and whose timing was irregular compared with normal background traffic.

Filtering to ICMP isolated the suspicious packets. Their payloads contained short encoded fragments — clearly data, not padding.

1# isolate ICMP and dump payload bytes in capture order2tshark -r capture.pcap -Y icmp -T fields -e icmp.seq -e data.data

Solution

The fragments were extracted, ordered by their ICMP sequence numbers, concatenated and decoded. The reconstructed string was the flag in the event's Bsides_Mumbai{…} format.

Flag

Recovered and verified during the event. The flag value is redacted here; the format is Bsides_Mumbai{…}.

Lessons learned

Protocols that are usually ignored — ICMP, DNS — are classic exfiltration channels. In real incident response, a payload-size or entropy check on ICMP traffic is a cheap and effective detection.