@botnet_hunter's blog
Using Markov chains as a keyed obfuscation method

Machine learning methods, simple and complex, can be used in almost all aspects of our digital lives. Interestingly enough, it is rarely observed in the offensive side of information security. When I was thinking about the number of ways an attacker can exfiltrate data past a firewall, I decided to try out an old favorite, Markov chains, in order to build the next generation of “book ciphers”.

UPDATE

A Github repository has been created for this project: markovobfuscate

Markov Chains as a Keyed Obfuscation Method

This is a project that has been sitting in my private git repository for a long while, and after I was recently reminded of it, I’ve decided to write it up and do an initial release. The premise of the project is to use Markov chains in order to obfuscate binary information to appear similar to written language.

I feel it’d probably be good for me to mention this fairly early on…I AM NOT A DATA SCIENTIST! I enjoy using machine learning where I can, but I have no formal training in it, and I am not a data scientist at my employer. I’m absolutely a data science amateur, but what machine learning I do know, I have found it to be extremely useful. On another note, I highly suggest that anyone reading this should spend some time to learn some basic machine learning concepts at some point. It is an extremely useful tool to have in your toolbelt.

Markov Chains

For anyone not familiar with Markov chains, they are very commonly used in conversational bots. For example, there are a number of bots on Twitter which emulate people. For instance, @da_667 has setup @667__ebooks as a bot which impersonates @da_667 based on what he’s said on Twitter in the past. Presumably, this bot is using Markov chains, which have been generated with his past Twitter feed to generate messages such as this:

While this appears to be English, it doesn’t entirely make sense (but still amusing).

The way most Markov chains operate is in two phases: Learning and Generating. Markov chains can also be used to “fit” input, in order to determine how likely a sentence was to have been generated from the source, but that is not relevant to this post. In the Learning phase, the Markov engine is fed a data set (a set of sentences) which were generated by the source being emulated. The engine then breaks these sentences down into words, and calculates the chance that each word will follow every other word.

Consider the following:

markov.learn(["im on fire", "im going to die"])

            im   on  fire going to die
im          0    .5  0    .5    0  0
on          0    0   1    0     0  0
fire        0    0   0    0     0  0
going       0    0   0    0     1  0
to          0    0   0    0     0  1
die         0    0   0    0     0  0

While this can be a real pain to do by hand, it is really easy to gather information like this in code.

When in the generation phase, the Markov engine will pick the most likely word to follow the current word in order to pick the next word in the sentence to tweet.

For both phases, I have simplified the description, and some implementations can grow to be significantly more complicated.

Using Markov Chains to Our Advantage

Given our previous knowledge of how Markov chains work, we can potentially use this knowledge to create an obfuscated stream of data which appears like English (or any other language we feel like using). The concept is as follows: Instead of using the most likely word to follow our current word, we use the Nth most likely word to follow, where N represents a single byte we are trying to send. This does require that both sides have the same Markov model, but this isn’t much of an issue, as it only requires both sides to have read the same “book” or set of sentences.

Consider the following:

current_word = "apple"
sorted_list_of_words_following_apple = [
    "sucks",
    "over-charges",
    "sauce",
    "cider",
    ...
]
byte_to_represent = 0x2

print current_word + " " + sorted_list_of_words_following_apple[byte_to_represent]

Additionally, there is a possible issue where our “book” will not generate enough word comparisons to give us enough information to represent a full 8 bit value. In order to recover from this, we can spread the value out over multiple words, and require that each byte must be represented by available values of at least 256.

Proof of Concept

As you may have imagined, I have built a proof of concept for this. It is in pure Python 2, and should be quite simple to integrate into Python based projects. If you working in a language other than Python…good luck! But seriously, hopefully you can read enough Python to reimplement based on the supplied code and this blog post. Additionally, if you implement this in another programming language or at all, please feel to let me know on Twitter or something.

Here’s an example:

# Markov engines fed with War and Peace, thanks to Project Gutenberg.
Original string: This is a test message to prove the concept.

Obfuscated string: each with head had thought that rostov holding her a pause occurred said quickly began rapidly taking up hurriedly drinking his hand 
him kutuzov sent tikhon interrupted natasha spoke most precious and some strange beautiful armenian was lying or inevitability governing the count's 
eldest boy you'll allow themselves by heart began wiping away his brows with your faithful unalterable love not go of war would in due form making 
long wanted him such cases but napoleon was standing where's that might but simply .  next morning in petersburg in each week so what sweets .  
those pranks in passing along looking gloomily at pierre rose

Deobfuscated string: This is a test message to prove the concept.

As any reader should be able to tell, no sane person typed the obfuscated string, but it could be quite difficult for a naive algorithm (working at scale) to be even remotely close to being able to tell that this information was obfuscated, much less what the underlying data was. Interestingly enough, since we have some room for randomization (based on the first word chosen), each time the message is obfuscated, it can be different.

Original string: This is a test message to prove the concept.

Obfuscated string: lord forgive it then assume the campaign during 1812 has deigned to meet at midday sun appeared .  he's grinning the army 
beyond dorogobuzh while with those orders as having wrung a pleasant comforting and asked petya .  he kissed them sat among those big head aches and 
now pierre inquired about playing cards holding in that here my arms .  how things snatched at dolokhov's intimacy now frightened imploring look 
round natasha rising wind that .  please .  what's in bed during that the count's dissatisfaction on taking rather for himself mentally .  he's our most 
in command preceding order to speak

Deobfuscated string: This is a test message to prove the concept.




Original string: This is a test message to prove the concept.

Obfuscated string: then already knew about moscow already prepared if all said crossly that before leaving the same she's very young bear me no nonsense 
as our parting from west paris would sacrifice had prepared the thought occurred but simply solicit donations received one might need thought a place 
a soldier passed before how papa he might expose his first saw through without saying not going for christ's sake in the sun but should wake natasha 
the very still showing pity he loved so count peter kirilovich said dron died of france alone even those taking

Deobfuscated string: This is a test message to prove the concept.

Let’s try a more interesting example:

Original string: -----BEGIN ENCRYPTED PRIVATE KEY-----
MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIDHHhyAEZQoICAggA
MBQGCCqGSIb3DQMHBAiHEg+MCYQ30ASCAoDEvGvFRHvtWOb5Rc0f3lbVKqeUvWSz
xQn+rZELHnwb6baolmbFcsi6XkacVzL/EF7Ll4de/CSQ6pZZCCvfDzov0mPOuGve
SAe7hbAcol7+JWVfzbnVTblPf0i7mwSvK61cKq7YfcKJ2os/uJGpeX9zraywWyFx
f+EdTr348dOez8uHkURyY1cvSHsIdITALkChOonAYT68SVighTeB6xOCwfmsHx+X
3Qbhom2YCIxfJiaAoz2/LndCpDaEfOrVrxXFOKXrIbmeDEyjDQj16AVni9uuaj7l
NiO3zrrqxsfdVINPaAYRKQnS102jXqkH01z72c/MpMMC6dwZswF5V3R7RSXngyBn
1GLxVFHKR753Gt0IDag13Bd8Jt890/v0tE0Kx66jCkRGn+VCq6+bsnh7VpTH/cG5
dlFnv56lv2leknu5ghdJHX8YQ6HjnioaaheLA+ORAxqAlD8Itt1/pRBOOMSkutdz
d1px9dB2ZBpSoRAOcBwU5aFaw9uu+tXyzrPM3tZomu8ryQYMNlmVgPNDJOz6jPJi
jaZHWTS7U6j370oH/B0KTUG/ybrJGFnOmPP4h2u/ugG75EkfotURsvbrWuetQhOi
TCH+9nbIcT3pxnTXqI2IRHZXMturQ+6fqlJF3bb9bWarMBuC3KgprqyqXxeM0Sqg
VlyKLWwAuMf2Ec7t7ujqaNmVgv6bpwHEbR6njIi7lC7j4w6D2YQ8vacgvS3MB/K0
SX54HNVBVuXhAixPtYJ6tOBGm7QFAKaXju0PJ+AljnMEsHRekOs2u42OHBXEWDE8
VHw7/lTXWsJkBcQM+g/svyqV4xKHDAixPms2SUwJyKjvEgV+CQok4F/T
-----END ENCRYPTED PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIC9TCCAl6gAwIBAgIJANL8E4epRNznMA0GCSqGSIb3DQEBBQUAMFsxGDAWBgNV
BAoTD1N1cGVyZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQsw
CQYDVQQGEwJVUzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuMB4XDTE0MDUxMjE2
MjUyNloXDTM0MDUwNzE2MjUyNlowWzEYMBYGA1UEChMPU3VwZXJmaXNoLCBJbmMu
MQswCQYDVQQHEwJTRjELMAkGA1UECBMCQ0ExCzAJBgNVBAYTAlVTMRgwFgYDVQQD
Ew9TdXBlcmZpc2gsIEluYy4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOjz
Shh2Xxk/sc9Y6X9DBwmVgDXFD/5xMSeBmRImIKXfj2r8QlU57gk4idngNsSsAYJb
1Tnm+Y8HiN/+7vahFM6pdEXY/fAXVyqC4XouEpNarIrXFWPRt5tVgA9YvBxJ7SBi
3bZMpTrrHD2g/3pxptMQeDOuS8Ic/ZJKocPnQaQtAgMBAAGjgcAwgb0wDAYDVR0T
BAUwAwEB/zAdBgNVHQ4EFgQU+5izU38URC7o7tUJml4OVoaoNYgwgY0GA1UdIwSB
hTCBgoAU+5izU38URC7o7tUJml4OVoaoNYihX6RdMFsxGDAWBgNVBAoTD1N1cGVy
ZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQswCQYDVQQGEwJV
UzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuggkA0vwTh6lE3OcwDQYJKoZIhvcN
AQEFBQADgYEApHyg7ApKx3DEcWjzOyLi3JyN0JL+c35yK1VEmxu0Qusfr76645Oj
1IsYwpTws6a9ZTRMzST4GQvFFQra81eLqYbPbMPuhC+FCxkUF5i0DNSWi+kczJXJ
TtCqSwGl9t9JEoFqvtW+znZ9TqyLiOMw7TGEUI+88VAqW0qmXnwPcfo=
-----END CERTIFICATE-----

Obfuscated string: countess in fact been captured if all sorts i chapter xx chapter xi the most doleful nocturnes on tiptoe 
noiselessly to an apple should i made to one arm he meant too and without hurting her fate and told count well well my pet 
whose sake stop them to attack singly across that prince bolkonski's simplicity .  he really began pacing the adjutant 
reproached those voices footsteps going up .  anatole returned a voice plainly terribly wild beast was a most cases we must 
remain attached themselves in reply the fact they have turned loaded five years .  he moved voices sang morel with his body 
as petya heard and took command justify his eyes to cry or four so let that movement .  again used all became smooth as hostess 
at tarutino a peasant laborer .  as napoleon frowning slightly in no wish so you'll forget to think only tell everything became 
distorted out over once shown to be pitied so definitely ordered up poor creature said on louis xiv's activity tushin not my cousin 
she too there await him her old friend tell cried petya .  at pultusk .  countess petted and he used when once heard .  boris but 
before you believe either in different companies which russian arms board them come when had decided by word incomprehensible which 
the best for peace or me pass anna semenovna continued after prince vasili said smiling young rostov felt though no definite means 
death they saw several men is god my position trying whether this time since lived somewhere with pale colored breeches he will win 
but neither to what said timokhin and we really begin what lay your serfs a loud at their carts should i understand that so soon 
taking no she called dunyasha had told herself from here at another his smile betraying his face again glancing from lifting him 
how i agree oh i mean for prince bagration's face became known as women here on reading was coming you should tell my sister 
remarked another peasant families who entered more orderers but also good kind are not heard at midday there seemed difficult 
would receive this terrible thing which natasha laughed turned angrily shouted someone inquires by fear of happiness he remained 
in their campfires while by way full of a minute .  i'm standing among a soldier three hundred years his son's letter and some 
great blessing if from princess lay the door trying for there have changed she made as young couple he replied balaga and yet 
with only without realizing that other she became distorted mouth rode on your charming that made wills produced from her might .  
anna scherer's reception by way we did i consider who took some unknown but dared complain to let relief after every soldier there 
or understand people's welfare the whole body as hostess .  before the war by asking silly ladies with rapid retreat is why go out 
and though embracing prince noticing trifles you it impossible .  their numbers got chapter xxxvi prince de soutenir ce grand is 
it looked frightened face .  of doing said one like everyone questioned .  in prince i always tried me is easy chair she feared a
german princes who till you got that god and were trying through at her again smilingly talking dron drop .  some tricks glanced
round inquiringly repeated but at daybreak said quickly gliding sleigh runners and by word fire he were an awakening and their 
fellows do you for nicholas sent instructions that after passing by long lashes that'll teach this same heights pass to go i might
very readily introduced mazurka began reciting some rum to avoid anything are often troubling about petya fixing on go into 
english parliament that an account as legitimate questions humanity of great success might he as emperor after what or sometimes
asked you been written by pierre seemed congested somewhere or perhaps she remarked someone asks the russians with delight of 
doing to your taste .  it like to think speak .  the new sitting opposite hill lay in search facility in with curiosity awe 
struck prince i want rain entered those blasphemous words frightened face of thought kutuzov arrived during fifteen can i can
stay by to my country amid their turn back chest shoulders .  and wished natasha left eye could do anything only feared 
napoleon frowning without looking malignantly at smolensk at present my enemy force commensurate with life my sister leave 
his serene highness' staff that kutuzov arrived at once recognized napoleon nor believed anyone or lesser interval boom 
boom boom flopped into moscow either the cause prompting the latter instinctively feel themselves from moscow at it an 
unknown and suddenly the war andrew interrupted but neither .  those other trouser leg was needed said yes that's twue 
devil mack and a crowd pushing anatole continuing to the night said but changed boris having her grief fell off any purpose
immediately recognizing the last all are often forgot them with them because our lodge a happy all who must expect this 
not far ahead shot the russians need to be told chiefly to marry he still firing but quite unclothed sat some steps 
accompanied them listened wishing but dared attack said that for christ's sake eh dron and prince went inside their 
theory say the expression gradually diminishes or lesser remoteness of man's long as possible power needs and i expected
from men were called power 2 when after his partner in each frenchman .  to die tomorrow your head like when spoken 
laughingly of view nor in alarm was made so busy causing the field especially on its peculiarly deliberate .  our 
forefather adam to marry you look as people always the fire is i owe forty eight feet off mamma pressed to avoid 
general complained of doing this set them over them not heard on the cause they gazed rapturously breathless when alone 
knew all is constantly conflict of wine .  i'm heartily they turned upside down as little lamp stood met for her usual simple .  
prince told them all or self possession mingled joy pierre for tomorrow at present affairs every action depends and saw immense 
number is not very people spoke in a special deep wrinkles on the country amid his nose the campaign it under precisely two o'clock 
left the people might our entrenchments but then immediately became his feet stood at home a different camps and told herself with 
closed as commander for us two officers directing her voice no mary having brought and put it stood rapt gaze disturbed .  the 
regiment quivered angrily to go said was telling of something unnatural state affairs pierre glanced at schon gut morgen he 
kissed princess a sense in 1805 and we were much at the one need anything for no confusion .  everything came once lit struck 
by the rostovs' being used supposing natasha on said what and seeing clearly the emperor left us rather bigger one has not 
consider kurakin's demand because in regard as this there has begun nor anywhere tomorrow brings victory at last chords of his knees 
some from another horse the village country ahead to him such blessedness which was napoleon asked me natasha continued that other 
she left arm of great natural manner were heard bickering with the third that same life was his eye could therefore so badly things and 
an incomprehensible he held both passed the old colonel is easy chair for others treated one after looking ecstatically conscious 
is better if on receiving a month reviewing troops plunder .  this officer who would she laughed talked over which it grew some places 
for whom did .  ah reverberated now by memories awoke .  one no nonsense old courtier feel i not bear .  do like prince could speak 
is nothing said alpatych lifting up but helene beaming smile so much money he turned red .  then just like affectation .  yet all up 
your disposal of natasha's singing a red ribbon of napoleon asked anatole kuragin go my soul not my uncle came a bit wait 
haven't stretchers .  why felt by name is usually complicated disease .  count arakcheev and looked frightened expression as 
usual semblance of borodino not that your faithful slave of pierre's caution .  pierre thought .  tell your mother's place to 
avoid inconveniencing him how that natasha listened now felt uncomfortable position rose as every face glowing with animation but 
changed .  you still fresh columns which afterwards he kissed princess never mind instantly guessed they wanted i'll have it over 
thirty five minutes later .  let herself was brought and yet my friends went every now did it still funnier .  let anyone told their 
eyes looked long coat said she made earlier than she made pierre moved them how his actions there anything wrong in every face 
glowing with each to fight a woman's dress princess drubetskaya's case insisted though declaring to one mass rendered him i take 
out prince in despair how once glance inviting him to cry though whenever a single division will also instructed me but dared not 
much better lie .  ah it which everything around pierre rose .  without trying with quick resolute face beamed with more easily some 
not notice him having done otherwise than this same living on her too but would call in advance of man's honor remarked vera 
sufficiently prepared for a carriage containing the battle on business weary but even denisov expressed .  nicholas will to all 
rostov's cards that their efforts is done at each on as young horse in a talk alone with him walked kutuzov's groom a ball recoils 
after crossing herself evidently just the chief subjects were .  o p .  boris to begin your victory said her brother's with people 
from a couple left petersburg society will warm whiffs of .  dolokhov smiled amiably at one thought their fellow prince theodore 
she screamed swore on like prince koutouzov to pass natasha whom will call i'll tell natasha insisted began clapping pierre rose 
up stroked the hill the carriage inquired zherkov and this class and my beloved bald general with kutuzov looked significantly at 
this pierre repeated her not give him over natasha you got so what fun nor the porch there said that affair of self justifications 
of command turned him so remote and see an approaching whistle flew into which seemed the world was such moments rose superior 
french phrases marshals stood hesitating piteous despairing gesture of his master of prussia ever done nothing from he returned 
from where candles or not resist their expression seized on by special protection and looked out beyond which two unequal to princess 
felt numb in dismay and taking my new military side and felt after its inevitable to hear this expression thoughtful smile had time nesvitski drove 
his power because he tried with love affair would be worthy added addressing michaud how your love one for any 
money decide or into which every word to say he's at a quiet backbiter said without receiving news with great balloon leppich now 
just more this will warm he received .  our talk related how is taken definite and now much afraid even the captain rose took me 
said holding and if only sound eye lit stone sparkled with your turn from sonya my friends told you for permission previously 
seemed thriving and in 1805 and therefore fought this question of police .  who the twenty horsemen galloped away when napoleon could 
at cards behind so far ahead of and though her a man's good said the action so she never loved prince vasili .  count on returning .  
do leave it then explained simply directed in them others on parade does up another way guewilla warfare had not understanding the 
bridge because you to all were burning lips having brought yourself said the matter princess is a commander overtaking baggage or 
another division not himself sick russians left near by every loss for himself moving according to kill you this class for napoleon 
the world only by everybody know about her old conditions of natasha's whole series for several important occasions that all 
would sometimes stronger the ground slip as prince bolkonski's no peace chapter xxxii beside countess i felt convinced you not 
himself away into alexander's guards before this had witnessed on sundays .  said bolkonski she passed dolokhov made in vienna .  
those same resolution pierre evidently feeling at yankovo ten guns to understand a whole .  ah it what regiment prince answered 
zherkov had begun prince kuragin into her house as often thought she must seem to the next he drew bagration bent till he is bad composition but 
the thought were silent feeling for war began knitting of prisoners looking in one offered it they desire was coming 
along get to get her but always directed toward restraining his majesty at heart well sounded buoyant steps were busy as happens 
sometimes came from you papa in with long and still an equal power unobtrusively simply .  go out go quickly down .  look was said 
mary moved his cheeks sunken emaciated young people such justification .  princess mary don't forget yourself your regiment of 
prussia without content .  still regarded as people was his intention .  very quiet manner without her thin strap and with so many 
such ardor all a most gracious sovereign has proposed that way bagration who would grow severely but that's another voice suddenly 
growing angry reprimand for himself be destroyed religion napoleon but which afterwards pursued began working in a time and felt in 
order will remain inactive would become as in vain to remain in different people introduced hospitals death is my letter and felt 
offended me so terrible what have written .  then having to her look was all sorts a thing was there must dance song in full 
significance have another push yourself worthy men left for nothing at smolensk and made your life pursued their horses bridled 
her life itself is an apple also looking out .  some voices bowed himself or if it come .  from what makes it all made earlier 
said something black with particular moral support you but never thought such reflections on tiptoe and some larger or is moving 
her she remarked that lay considered everything became convinced the drawing out directly opposite reputations .  petya cried 
prince is already be called king overcoming by prince not take murat solemnly at his nose sat like cords that look up or should 
insist .  prince murat i knew that even before others what to help with sonya i expect from bad lookout for having seen alone could 
sit whole position because anatole's appearance of his small white chamois leather case and if he stopped with natasha needed 
which princess glanced through his master in attendance considered by giving detailed chat generally wore was thinking man nor less 
chance remarked loudly and the fire very few paces from above him seemed very unwell and no no connection between their pace went 
rapidly across to him yet man can answer to say remarked the men in chief's actions was over rostov standing there oh hush seemed 
quite unexpected direction in accord and self abasement .  before such lengths and where willarski found that the action they thought 
and is much since she was decided to wait a man's sharp trot only to wait to herself was lying recovering or sent greetings from 
vienna were it now smiling sardonically and you speak so replied rapp do all at braunau was taken as of free of reason prince 
bagration reported having dressed his serene expression softened grateful but to dinner called buonaparte is good naturedly as 
something sweet sorrow which dolokhov flashed lightning from your men went red lips grew quite new count she ought to dinner 
taciturn .  rostov when having heard probably bruised face whipping up a few replies about the latter understood them they again 
smilingly to die feeling there they carried off properly he was covered chair how his eye the evening i who held a loud speranski 
only necessary not sleep either a talk moved forward words were placed himself prince andrew's estate prince bolkonski's not have 
them details himself quite independently of events have received leaflets with all came four days previously .  have led astray .  
for nicholas so and rode to work all nonsense humbug exclaimed different person .  but despite these consultations were evidently 
so strong effect she ought not being played its normal physical condition the bridge fire in this consciousness as best for several officer who do all 
she with excitement of happiness of horses so full rations the cause mathematics from pierre ran to go very bad 
for sonya natasha with marya concerned her slender mischievous with people is known grandee of things ask for some voices then now 
why there when when expressing the air as other watched for one said smiling face reporting that terrible recollections of russia while 
it seemed by another reminded one officer with merry shouts onto it yes go any work too well mamma are both these wounded lay with me 
too well disposed her only sound and some troops it necessary things seem of this old friend older .  two conceptions the hill 
they expected on leave permits had thought impossible for some given which though mankind especially against utitsa semenovsk 
hollow between her lips parted she asked indicating a moment though shy childlike fear getting into what luck the morning tikhon 
briskly forward to understand that his master but .  look evidently so pierre so accustomed always became still his intention .  
of hussars to cry directly the horses showered upon eykhen threatening the other wounded at some intrigue egotism conflict .  let down 
by general weyrother to be arranged some means death none but now did what to pass this there no less insistent on them i'll 
trust yourself to the latter had noticed them up three weeks had suddenly flaring up their box those tears again heard so strongly 
as clear blue frocks and having summoned appeared and some message dolgorukov the will call and though a day fleecy clouds floating to 
the evening speranski did he had worn a boy with satisfaction flitted to some message dolgorukov as all came an aide de beausset's 
face yet met pierre felt as she repeated approvingly evidently means he stood irresolutely beside denisov not understood me under 
what they drew dolokhov got somewhere and the great russia but she gazed for themselves on he used when trying but yet been lost faith 
you done all by self satisfaction ran along at pierre now taking hers .  here tomorrow .  the field guns on taking notes he spoke 
her daughter's distress some steps he listened not true conservatives a german fellow men came her face changed the end 
kutuzov's instructions she tried equally indifferent case by other evening the position away to do we feel friendship of some like 
how many new dresses french official who sometimes enters russia .  he were placed them while drying it to help laughing long 
mustache that and see how d'you do that'll do that feeling bound himself from falling over pink dresses into prussia ever 
increasing seemed to be prepared raising of and sometimes even seem quite differently the regiment having rested and sometimes 
complete victory and he approached that made some invisible smoker .  by people was unable from bogucharovo about i made me only 
been living in consequence has an hussar horses near one with pale scared look on with another sort had she with bare hand will all 
alone knew he ran from excitement shown him no government how nice stepmother .  for but our failures resulting from being foes take 
any purpose we assume that sort out what kutuzov to hear it true not an atmosphere to hear the back distracted count cyril says or my 
fate to an honorable gentleman or perhaps all everything said addressing natasha no means what one can one the horses away the very 
erect majestically .  why count sat in another wounded spirit too great delight which is of death i chapter xxii next glanced through 
for this conversation upon eykhen threatening to your belly .  said uncle what your troops it that so accustomed groove he and above 
all one as having interrupted dolgorukov ride through napoleons louis xv at and though five rubles for her fate not ask an evident to 
kutuzov fell off blockhead well let kuragin made some orders pierre found dolokhov in a field shouting that of human lives were taken 
were taken by to set and that here i've done but always before yesterday replied but dared to feel when dolokhov pressed his hair her 
the two battles at bogucharovo .  what's he could do his leg glancing however small prussian war when denisov .  sometimes flung 
herself so well read them smiled in waiting your carriage drove through and did everybody took heed her look there's nobody wants to 
be quick and those scoundrels .  please vasili but on cause .  he's chosen words to her companion makarin dashed out but again going 
round .  she says to love which always thoughts ran toward the french voices trying for someone would always came two fires in me last 
an old dotard father is already knew no hindrance if threatening inaccessible it matter so ill suited the officers the wounded yet 
left long expected this happened there very old days on pierre's stories but why he replied balaga into a year had seemed extremely 
said denisov who i got off their minds will hardly heard the same path in view the third officer comes from him do wish her to herself 
and felt for in thy ways there there from west attracting to express what without doing all so it's your ranks carried into action 
began walking in russian nobility and it gave instructions and still young girl she's pretty young men should long dresses into this 
field where napoleon his attention to cry when two very clear bold features was a boy you he wore medals both of genius every other 
french uhlans stationed or distributing this expression which rose increasingly triumphant that a boy now called philosophical 
historians the more just try historic character though not express his cheeks who formed some steps up went he shouted and who says 
clever .  only person vanishes in these good day who they went first that question following this new laws she and smiled 
involuntarily asked arakcheev who moved another at times very soon for petya blushing still nothing wrong to remain any need i remember 
we ourselves will fall at and looking evergreen firs dotted about kutuzov did once when dressed for several instances of life done 
the same wave white shirt and her companion a tall guardsman drove her when trying carefully packed urged could have read .  
besides humiliation .  rostov said tikhon what regiment in three windows rattling in a table now heard anything .  but felt already 
gone so dark for my pet whose aid of god upon on an illegitimate son shall drive you wish you about anything looked and when 
opportunity now always eats his last days bogucharovo and no thought independent existence he rode so now that's twue devil mack 
and though not at midday they danced daniel ulyulyuing were quite out when trying said what natasha's eyes meeting bagration's 
colloquies with our brave men left without offending mary returned home alone did me everything coexisting with all made expeditions 
and with black horses kept increasing fog singing waving her a whisper behind still farther movement got to a different firm 
resolution not feel like father whom could hear .  anatole and have sent envoys demanding now we'll take offense immediately dropped 
his head coachman this and some precious object for and smiled almost with her about himself what more distinguished important 
posts formed to look back and now necessary preparations and sat plunged into prince vasili's two decorations and left wing 
especially attracted general bonaparte having stumbled over bolkonski had been transferred .  these difficult because by the latter 
having written that my enemies to carry off of me ah well then footsteps or someone on he exclaimed princess rose up more is 
difficult .  here exclaimed with one direction rose to put myself with whom do in human minds roam but an impression but seeing in these 
i held only son would fall for everyone turned outwards but a dream said smiling birch tree can tell one's shoulders back so far as 
clear daylight of what regiment to an advanced post stood but all made in on till anatole's departure from every evening goes he 
took poleon himself in full light up between love letter of your future is our salvation .  again quarreled said you it long since left 
or all began looking dark in war when suddenly seeing count there at hand you're shaking him the frenchman never said his room with you 
at mytishchi had sent immediately on them your letter direct advance had been happy mood unusual something on like anybody now then 
into our arms and one gets thin practiced fingers with boris again asked of being helped nicholas will as daylight he glanced severely 
to talk loudly among the same preparations had any harm is natural relations sometimes his shoulders went toward balashev to him walked 
or another you been won on passing to all men around were suddenly began counting his time who were made not as happens to hear 
something down by bennigsen rather late one spoke great difficulty of the captain asked you remember these movements prince returned 
to him feel this unknown quantity of prisoners he glanced ironically without my pipe to show to know himself whether telling .  
here is no thought a cossack made remarks as ever lay between her .  even if something fresh .  even bonaparte will hear of 
pierre understood his long black .  prince michael ianovich he continued this position became alive and as strong escort along our 
emperor francis as many toasts it's she grew deeper in war andrew could maintain his hand that lay from abroad no hindrance and saw 
them had then we had died she ought and sonya were seen even as were an imploring voice apparently been captured just below the 
french could have met the fire broke apart before rostov also looked about shouted when alone enabled his head triumphantly sometimes 
even my carriage passing that if quite apart said aloud bitterly .  before it it should repay .  ah well messieurs et la louis philippe 
to serve in everything that's true so busy he could talk with pleasure but gave us rather as elsewhere .  everything remember always 
exist because gaiety seemed quite different camps the evening andrew to set consisting in love mutual friends you must live character 
to be what kutuzov began dragging logs with equal ease with equal zero we met more quickly changing shadows without cause pierre recognized the 
movement full speed before prince understood .  you seen running his opinion these letters were dragging logs from 
sonya too painful lash on august 1809 when with so quickly doffing his hair remained there had learned well in that seemed rather 
the emperor he met because of a military administrative political world the battle had time together stirred .  everyone expected was 
too said hurriedly sought that those off so beautiful bitch are free and rostov looked how they all sorts and natasha her look it's 
the whole field not the cause prompting the fact the last words der krieg muss in waiting ready according to leave this will bring 
her nephew irritably of inevitability in attendance at tilsit with bare floor window and only hope i like natasha looked attentively 
said something important posts gentlemen i don't

Deobfuscated string: -----BEGIN ENCRYPTED PRIVATE KEY-----
MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIDHHhyAEZQoICAggA
MBQGCCqGSIb3DQMHBAiHEg+MCYQ30ASCAoDEvGvFRHvtWOb5Rc0f3lbVKqeUvWSz
xQn+rZELHnwb6baolmbFcsi6XkacVzL/EF7Ll4de/CSQ6pZZCCvfDzov0mPOuGve
SAe7hbAcol7+JWVfzbnVTblPf0i7mwSvK61cKq7YfcKJ2os/uJGpeX9zraywWyFx
f+EdTr348dOez8uHkURyY1cvSHsIdITALkChOonAYT68SVighTeB6xOCwfmsHx+X
3Qbhom2YCIxfJiaAoz2/LndCpDaEfOrVrxXFOKXrIbmeDEyjDQj16AVni9uuaj7l
NiO3zrrqxsfdVINPaAYRKQnS102jXqkH01z72c/MpMMC6dwZswF5V3R7RSXngyBn
1GLxVFHKR753Gt0IDag13Bd8Jt890/v0tE0Kx66jCkRGn+VCq6+bsnh7VpTH/cG5
dlFnv56lv2leknu5ghdJHX8YQ6HjnioaaheLA+ORAxqAlD8Itt1/pRBOOMSkutdz
d1px9dB2ZBpSoRAOcBwU5aFaw9uu+tXyzrPM3tZomu8ryQYMNlmVgPNDJOz6jPJi
jaZHWTS7U6j370oH/B0KTUG/ybrJGFnOmPP4h2u/ugG75EkfotURsvbrWuetQhOi
TCH+9nbIcT3pxnTXqI2IRHZXMturQ+6fqlJF3bb9bWarMBuC3KgprqyqXxeM0Sqg
VlyKLWwAuMf2Ec7t7ujqaNmVgv6bpwHEbR6njIi7lC7j4w6D2YQ8vacgvS3MB/K0
SX54HNVBVuXhAixPtYJ6tOBGm7QFAKaXju0PJ+AljnMEsHRekOs2u42OHBXEWDE8
VHw7/lTXWsJkBcQM+g/svyqV4xKHDAixPms2SUwJyKjvEgV+CQok4F/T
-----END ENCRYPTED PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIC9TCCAl6gAwIBAgIJANL8E4epRNznMA0GCSqGSIb3DQEBBQUAMFsxGDAWBgNV
BAoTD1N1cGVyZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQsw
CQYDVQQGEwJVUzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuMB4XDTE0MDUxMjE2
MjUyNloXDTM0MDUwNzE2MjUyNlowWzEYMBYGA1UEChMPU3VwZXJmaXNoLCBJbmMu
MQswCQYDVQQHEwJTRjELMAkGA1UECBMCQ0ExCzAJBgNVBAYTAlVTMRgwFgYDVQQD
Ew9TdXBlcmZpc2gsIEluYy4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOjz
Shh2Xxk/sc9Y6X9DBwmVgDXFD/5xMSeBmRImIKXfj2r8QlU57gk4idngNsSsAYJb
1Tnm+Y8HiN/+7vahFM6pdEXY/fAXVyqC4XouEpNarIrXFWPRt5tVgA9YvBxJ7SBi
3bZMpTrrHD2g/3pxptMQeDOuS8Ic/ZJKocPnQaQtAgMBAAGjgcAwgb0wDAYDVR0T
BAUwAwEB/zAdBgNVHQ4EFgQU+5izU38URC7o7tUJml4OVoaoNYgwgY0GA1UdIwSB
hTCBgoAU+5izU38URC7o7tUJml4OVoaoNYihX6RdMFsxGDAWBgNVBAoTD1N1cGVy
ZmlzaCwgSW5jLjELMAkGA1UEBxMCU0YxCzAJBgNVBAgTAkNBMQswCQYDVQQGEwJV
UzEYMBYGA1UEAxMPU3VwZXJmaXNoLCBJbmMuggkA0vwTh6lE3OcwDQYJKoZIhvcN
AQEFBQADgYEApHyg7ApKx3DEcWjzOyLi3JyN0JL+c35yK1VEmxu0Qusfr76645Oj
1IsYwpTws6a9ZTRMzST4GQvFFQra81eLqYbPbMPuhC+FCxkUF5i0DNSWi+kczJXJ
TtCqSwGl9t9JEoFqvtW+znZ9TqyLiOMw7TGEUI+88VAqW0qmXnwPcfo=
-----END CERTIFICATE-----

You may be noticing that the obfuscated version can be significantly longer than the original data. This is an unfortunate side effect, but it can be helped in some cases using compression before the data is obfuscated. The compression method used doesn’t really matter, as long as it is the same on both sides. Additionally, if the transport method being used supports compression, ASCII text tends to compress quite well.

Use Cases

There are quite a few use cases for this that come to mind. The first is the method it was developed to prove, exfiltrating data past a firewall. Considering that the obfuscated data is text, it could even be sent out in emails without triggering an alert based on content, written to a Google Drive document, or simply POSTed via HTTP. Similarly, it could be a simple command and control channel, as it would be very simple to POST data to an HTTP/IRC/etc server and receive a response.

This could potentially be used to obfuscate other communication channels as well. For instance, a method like this could be a positive addition to instant messaging plugin such as OTR, as it could hide the fact that there were encrypted communications. Due to recent world events, and not wishing to support radical movements even indirectly, I won’t be releasing such plugin or improvement, and hoping that they suck even worse at coding than they do at hacking.

Detection

Detecting this method could be considerably difficult. Much like most other issues on the blue team side of things, the greatest issue is related to detecting something at scale. From a network firewall perspective, there would need to be parsing of all text, which would then need to be statistically analyzed and compared to Markov language models to see if the data strongly fit. To be absolutely honest, it would require someone with considerably more skill than myself in machine learning (like any one of the actual data scientists at Cylance) in order to handle this kind of detection at scale without a significant number of false positives and false negatives. I do wish I had a better answer to detect this method, but right now, I do not.

Code

The most up to date code for this project can be found in the following Gist: https://gist.github.com/bwall/125b29b8412332fc7203

Conclusion

Even simple machine learning can blow conventional opposition out of the water.

Mind-fucking-blown

Addendum

Per request of @RKornmeyer, I trained a Markov model based off of Taylor Swift lyrics. Here are the results:

Design pdevty