Telepath: A Minecraft-based Covert Communication System

Covert, censorship-resistant communication in the presence of nation-state adversaries requires unobservable channels whose operation is difficult to detect via networktraffic analysis. Traffic substitution, i.e., replacing data transmitted by a "cover" application with covert content, takes advantage of already-existing encrypted channels to produce traffic that is statistically indistinguishable from the traffic of the cover application and thus difficult to censor.

Online games are a promising platform for building circumvention channels due to their popularity in many censored regions. We show, however, that previously proposed traffic substitution methods cannot be directly applied to games. Their traces, even if statistically similar to game traces, may violate game-specific invariants and are thus easy to detect because they could not have been generated by an actual gameplay.

We explain how to identify non-disruptive content whose substitution does not result in client-server inconsistencies and use these ideas to design and implement TELEPATH, a covert communication system that uses Minecraft as the platform. TELEPATH takes advantage of (1) Minecraft's encrypted clientserver channel, (2) decentralized architecture that enables individual users to run their own servers, and (3) popularity of "mods" that add functionality to Minecraft clients and servers. TELEPATH runs a Minecraft game but substitutes non-disruptive in-game messages with covert content, without changing the game's interaction with the network manager.

We measure performance of TELEPATH for Web browsing and audio streaming, and show that network traffic generated by TELEPATH resists statistical traffic analysis that aims to distinguish it from popular Minecraft bots.