This TCP-related concept is used by attackers to distribute the payload and to create covert channels.

This TCP-related concept is used by attackers to distribute the payload and to create covert channels.

• A. DNS tunneling
• B. IP Identification Field
• C. TCP parameters
• D. TCP Initial Sequence Number

Answer: (C)

Attackers hide data and distribute payloads by exploiting the characteristics of a TCP connection itself. TCP parameters—the values and fields that define a connection such as the sequence number progression, the advertised window size, and various options—can be manipulated to encode information or to time the delivery of payload chunks. By subtly adjusting these values or the timing of packets, data can be sent covertly within normal TCP traffic, creating a hidden channel for exfiltration or staged payload delivery without raising obvious alarms. The other options refer to specific, separate mechanisms (DNS protocol, an IP header field, or a single TCP parameter) rather than the broader technique of using TCP flow characteristics to establish covert channels.

Attackers hide data and distribute payloads by exploiting the characteristics of a TCP connection itself. TCP parameters—the values and fields that define a connection such as the sequence number progression, the advertised window size, and various options—can be manipulated to encode information or to time the delivery of payload chunks. By subtly adjusting these values or the timing of packets, data can be sent covertly within normal TCP traffic, creating a hidden channel for exfiltration or staged payload delivery without raising obvious alarms. The other options refer to specific, separate mechanisms (DNS protocol, an IP header field, or a single TCP parameter) rather than the broader technique of using TCP flow characteristics to establish covert channels.