Signal processing and math for malware RnD for fun and profit#

cocomelonc (independent researcher/author)

• Why: A covert channel that bypasses your entire network visibility stack — no socket, no flow record, no alert — plus an entropy-detection evasion trick that any data-DLP or AV pipeline should know about.
• What: An open-source PoC for Linux and Windows in two threat models: shellcode delivery (attacker speaker → air → victim mic → execute) and exfiltration (victim → attacker). The payload is FSK-encoded into audio tones and demodulated with the Goertzel algorithm; a DFT with a phase-shifted mathematical key means the shellcode exists only as complex floating-point coefficients — mathematically indistinguishable from sensor/audio noise — until the inverse DFT at runtime. Framing and synchronization problems for the acoustic link are solved as a real protocol.
• How: DFT-based keying defeats entropy/signature scanning (no high-entropy blob, no recognizable structure); the transport is physical acoustics, evaluated against ultrasonic (18–22 kHz), SDR/RF, and IR alternatives.
• Where applicable: Requires acoustic proximity, so realistic mainly for air-gapped or physically-adjacent scenarios — but the DFT-as-obfuscation half applies to ordinary in-memory payloads everywhere. Full source released after the session. (from abstract only)