2016 IEEE European Symposium on Security and Privacy Games Without Frontiers: Investigating Video Games as a Covert Channel Bridger Hahn, Rishab Nithyanand, Phillipa Gill, and Rob Johnson Stony Brook University Email: {bdhahn, rnithyanand, phillipa, rob}@cs.stonybrook.edu Abstract—The Internet has become a critical communication Researchers have responded by proposing several look- infrastructure for citizens to organize protests and express like-something censorship circumvention tools. These tools dissatisfaction with their governments. This fact has not gone aim to disguise covert traffic as another (benign) protocol to unnoticed, with governments clamping down on this medium evade detection by censors. This can take two forms: either via censorship, and circumvention researchers working to stay mimicking the cover protocol using an independent imple- one step ahead. In this paper, we explore video games as a mentation, as in SkypeMorph [11] and StegoTorus [12], or new avenue for covert channels. Two features make video encoding data for transmission via an off-the-shelf imple- games attractive for use as a cover protocol in censorship mentation of the cover protocol, as in FreeWave [13]. circumvention tools: First, games within a genre share many This has created an arms race between censors and common features. Second, there are many different games, circumvention tool developers. For example, Tor’s intro- each with their own protocols and server infrastructures. These duction of “pluggable transports”, i.e. plugins that embed features allow circumvention tool developers to build a single Tor traffic in a cover protocol to counter censors that block framework that can be adapted to work with many different Tor [14]. Censors have already begun blocking some of these games within a genre; therefore allowing quick response to transports [15], and some censors have gone so far as to censor created blockades. In addition, censored users can block entire content-distribution networks that are used by diversify their covert communications across many different some circumvention systems [16]. games, making it difficult for a censor to respond by simply Furthermore, recent work has shown that care must blocking a single covert channel. be taken when designing and implementing a look-like- something covert channel. For example, Houmansadr et al. We demonstrate the feasibility of this approach by imple- showed that, when a covert channel re-implements its cover menting our circumvention scheme over three real-time strat- protocol, the copy is unlikely to be a perfect mimic of the egy games (including two best-selling closed-source games). original protocol, and a censor can use the differences to We evaluate the security of our system prototype, Castle, by recognize when a client is using the covert channel [17]. quantifying its resilience to a censor-adversary, similarity to Worse yet, Geddes et al. demonstrate that even running real game traffic, and ability to avoid common pitfalls in the cover application is not enough to avoid detection by covert channel design. We use our prototype to demonstrate censors [18] – i.e., approaches like FreeWave may be de- that our approach can provide the throughput necessary for tected via architectural, channel, and content mismatches bootstrapping higher bandwidth channels and also the transfer between the application’s regular behavior and its behavior of textual data, such as web articles, e-mail, SMS messages, when being used as a covert channel. and tweets, which are commonly used to organize political actions. 1.1. The promise of video games 1. Introduction In light of this state of affairs, this paper argues that video games have several features that make them an at- The Internet has become a critical communication infras- tractive target for covert channel development. tructure for citizens to obtain accurate information, organize There are many games available, enabling developers political actions [1], and express dissatisfaction with their to create a diverse set of circumvention tools. The governments [2]. This fact has not gone unnoticed, with gov- number of real-time strategy games has grown rapidly in ernments clamping down on this medium via censorship [3], the last few years. This growth has been driven in part [4], [5], surveillance [6] and even large-scale Internet take by the democratization of game publishing, as embodied downs [7], [8], [9]. The situation is only getting worse, with in game distribution platforms such as Steam [19] – e.g., Freedom House reporting 36 of the 65 countries they survey Figure 1 shows the total number of real-time strategy video experiencing decreasing levels of Internet freedom between games that have been released since 2010 on the Steam 2013 and 2014 [10]. platform. Further, each game uses its own network protocol 978-1-5090-1752-2/16 $31.00 © 2016 IEEE 63 DOI 10.1109/EuroS&P.1510.1109/EuroSP.2016.17 application-level attacks in which the censor attempts to identify covert channels by joining the game. 150 120 Games have the potential to reverse the resource imbal- ance in the arms race between censors and developers. 90 By lowering the development cost of creating new covert 60 channels, video games can create an asymmetry that cir- 30 cumventors can use to win the arms race against censors. 0 Total Number of RTS Total 2010 2011 2012 2013 2014 Censors can respond to look-like-something circumvention tools by blocking the cover protocol entirely or attempting Games Released Since 2010 Year to distinguish legitimate uses of the protocol from uses by Figure 1: Growth of the real-time strategy game video game the covert channel. If developing such mechanisms is time genre on the Steam distribution platform [19]. consuming for the censor, but circumvention tool developers can quickly construct new tools, there will almost always be effective circumvention tools available for end users. and infrastructure, so the censor cannot simply block all games using a single technique. Censorship circumvention 1.2. Our contributions developers can use this large body of games to adapt and evade a censor’s attempt to block any particular game. In spite of the above benefits, we must answer several questions to understand the feasibility of using video games Video games share common elements, making it possible for covert channels: to use a single framework across many games. For example, most Real-Time Strategy (RTS) games have the • Security: Can we encode data in the video game so notions of buildings, units, and rally points, and censorship that the censor cannot distinguish regular game play circumvention tools that encode information by interacting from covert channel sessions? with these objects can be easily ported from one RTS game • Extensibility: Can we build a framework that can to another. Many games also feature replay logs and similar be quickly adapted to new games? user interfaces, enabling covert channel frameworks that are • Performance: Can video games support good covert only loosely coupled to the internals of any particular game. channel bandwidth? Game-based circumvention tools can re-use off-the-shelf To answer these questions, we have built Castle, a pro- game implementations Since games have features that totype video game-based covert-channel framework. Castle make it relatively easy to automate interaction with the encodes data as player actions in an RTS game. Castle uses game, circumvention tool developers do not need to re- desktop-automation software to execute these actions in the implement the game (or its network protocol), ensuring that game. The video game software transmits these moves to the the circumvention tool can leverage the existing implemen- other players in the same gaming session, who then decode tation of the game. This prevents attacks that can distinguish the message and send replies in the same way. between the original implementation and the cover-protocol Security. Castle’s design makes it resilient to several classes implementation of an application or protocol [17]. of attacks. Since Castle uses the underlying game to trans- mit data, an attacker cannot use simple IP- or port-based Game-based circumvention tools avoid previously en- blocking to block Castle without blocking the game entirely. countered pitfalls. Games in select genres often support When used with games that encrypt and authenticate their both peer-to-peer and server-based gaming sessions (e.g., traffic, an attacker cannot use deep packet inspection to dis- real-time strategy games), so they can adapt to whichever tinguish Castle traffic from regular game traffic. Encryption is better for the circumvention tool. This allows architec- and authentication also preclude simple packet injection or tural matching as described by Geddes et al. [18]. Games manipulation attacks. Since games use network communica- must maintain synchronized state, so they are loss sensi- tion to synchronize their state, they are loss sensitive, unlike tive, avoiding the channel mismatch between multimedia some VoIP protocols. Thus Castle cannot be distinguished and Web/textual covert content identified by Geddes et al. from regular gaming sessions through selective packet delay [18]. Finally, games are reasonably able to avoid content or dropping attacks. Finally, when used with password- mismatches by due to the large amount of diversity in typical protected gaming sessions, Castle is immune to application- content characteristics. level attacks, such as the censor attempting to join the same Games often have built-in security features that can sup- gaming session to observe the player’s in-game actions. port secure covert channels. It is considered good practice We evaluate Castle’s security against statistical traffic- for games support encryption and authentication in order analysis attacks by applying several previously published to prevent cheating [20], [21] – e.g., the Microsoft DirectX classifiers – i.e., the Liberatore [24], Herrmann [25], and networking API [22] and the Steam peer-to-peer networking Shmatikov [26] classifiers.