This approach is quite difficult as it uses a bounce server that receives packets from the victim and sends it to an attacker. Here, one hidden character is relayed by the bounce server per packet.

This approach is quite difficult as it uses a bounce server that receives packets from the victim and sends it to an attacker. Here, one hidden character is relayed by the bounce server per packet.

• A. DNS tunneling
• B. TCP Acknowledgement Number
• C. IP Identification Field
• D. TCP Initial Sequence Number

Answer: (B)

Covert channels often hide information in parts of a protocol header that aren’t meant for payload data. In this scenario, the betrayal is in the TCP layer: responses carrying acknowledgments can be used as a vehicle for secretly transmitting data. The bounce server relays the victim’s traffic to the attacker, and each packet’s Acknowledgement Number can carry a small piece of hidden data. By encoding one character into the ACK number of every response, a per-packet covert channel is established, allowing a slow but steady exfiltration path without needing to modify the payload. This approach fits best because the Acknowledgement Number is inherent to TCP’s reliable delivery mechanism and is sent with each response, providing a convenient, observable channel for covert data without altering the payload itself. Other options describe different covert channels—DNS tunneling hides data in DNS queries, the IP Identification Field uses fragmentation-related headers, and the Initial Sequence Number is tied to connection setup and wasn’t designed to convey per-packet hidden data via a relay path. While those could be used in covert channels, the described method directly leverages the TCP ACK number as the carrier for one character per packet.

Covert channels often hide information in parts of a protocol header that aren’t meant for payload data. In this scenario, the betrayal is in the TCP layer: responses carrying acknowledgments can be used as a vehicle for secretly transmitting data. The bounce server relays the victim’s traffic to the attacker, and each packet’s Acknowledgement Number can carry a small piece of hidden data. By encoding one character into the ACK number of every response, a per-packet covert channel is established, allowing a slow but steady exfiltration path without needing to modify the payload.

This approach fits best because the Acknowledgement Number is inherent to TCP’s reliable delivery mechanism and is sent with each response, providing a convenient, observable channel for covert data without altering the payload itself. Other options describe different covert channels—DNS tunneling hides data in DNS queries, the IP Identification Field uses fragmentation-related headers, and the Initial Sequence Number is tied to connection setup and wasn’t designed to convey per-packet hidden data via a relay path. While those could be used in covert channels, the described method directly leverages the TCP ACK number as the carrier for one character per packet.