FINDING · DEFENSE
The authors enumerate 12 requirements a parrot system must satisfy simultaneously (Correct, SideProtocols, IntraDepend, InterDepend, Err, Network, Content, Patterns, Users, Geo, Soft, OS) while a censor need detect only one failure. They conclude 'unobservability by imitation is a fundamentally flawed approach' and recommend embedding covert traffic in genuine encrypted payloads of a real running protocol (e.g., FreeWave in Skype voice, SWEET in email), which constrains detection to OM adversaries performing large-scale multi-flow analysis.
From 2013-houmansadr-parrot — The Parrot is Dead: Observing Unobservable Network Communications · §XI · 2013 · Symposium on Security \& Privacy
Implications
- Design new transports to run the actual target protocol and embed covert content in its encrypted payload (voice, video, text) rather than synthesizing the protocol — this is the only approach empirically shown to withstand both passive and active detection.
- Partial imitation is worse than no imitation: a transport that attempts Skype mimicry but fails multiple requirements produces a more distinctive signature than plain Tor, because each violated requirement is an additional unique fingerprint.
Tags
Extracted by claude-sonnet-4-6 — review before relying.