Dead Drop Covert Channel Technique Using Windows Registry

A dead drop is a delayed covert method of communication where data is left at a location and expected to be extracted by the receiving party at a later time. They serve the purpose of facilitating communication in a more anonymous manner such that the parties do not have to directly interact with each other. The complex file structure of Windows operating systems introduces the potential for dead drops in compromised systems. The registry is a hierarchical database that stores configuration settings and options for the system's hardware and software. Because the registry is accessible for addition and modification, there is potential for it to act as a dead drop location where the value of a register can store secret information. In this paper, we propose a Windows registry dead drop technique that places the dead drop in a registry of a compromised Windows system. The technique proposed in this paper allows for a persistent dead drop with high capacity which can be accessed repeatedly once the compromising phase is successfully completed.