Innovative Tunneling Techniques Leverage File Storage, IMAP, Meek, and NTP for Covert Connectivity
A fresh set of unconventional tunneling approaches has surfaced in the world of proxies and VPNs, expanding options for establishing covert network links through everyday services.
File Tunnel
The core idea is straightforward yet effective: when two hosts share access to the same file storage, ordinary files can serve as the medium for TCP connectivity. File-Tunnel listens on a local TCP port; incoming connections cause data to be appended to a file. The remote instance reads the same file, reconstructs the TCP stream, and forwards it to the intended destination. Return traffic flows through a second file. Files are periodically rotated to prevent unbounded growth.
Supported storage includes SMB or NFS shares, FTP servers, RDP or Citrix mounted disks, VirtualBox shared folders, WSL, Docker volumes, and Dropbox. Recent additions provide native S3 and WebDAV support. Because many providers offer inexpensive or free-tier S3-compatible buckets, the resulting tunnel traffic appears as routine object-storage requests. Example invocation on side A forwards RDP while side B acts as the remote endpoint:
- ft.exe --s3 --bucket mybucket --region ru-moscow-1 --access-key XXXXXXXX --secret-key XXXXXXXX -L 5000:192.168.1.20:3389
Environment variables FT_S3_ACCESS_KEY and FT_S3_SECRET_KEY keep credentials off the command line. WebDAV works with services such as Mail.ru Cloud using a simple URL and credentials.
True IMAP Tunnel (Secure)
Building on earlier serverless experiments, True IMAP Tunnel (Secure) uses an IMAP mailbox as the transport. Both tunnel endpoints authenticate to the same account and designate dedicated folders for each direction. Data frames are wrapped as draft messages via the APPEND command; they never traverse SMTP. The receiving side monitors via IDLE or polling, extracts frames, marks messages deleted, and issues EXPUNGE in batches. Optional AES-256-GCM encryption protects frames, and message appearance (subject, attachment filename) can be customized to reduce suspicion. Tested providers include Gmail, Outlook, Seznam, Mail.ru, Yandex, Timeweb, and Rambler. The single Go binary supports SOCKS5, VLESS, SSH, and can run as a Shadowsocks SIP003 plugin.
Meek
Meek, a legacy Tor pluggable transport, offers an alternative when XHTTP fails against certain CDNs. Clients issue HTTP POST requests (up to 64 KB) carrying an X-Session-Id header; the server maps sessions to TCP connections and returns responses in HTTP bodies. Empty POSTs maintain polling intervals that grow from 100 ms to 5 s. Because of its simplicity, Meek functions through shared hosting with small PHP or Python reflectors. Standalone operation is achieved by manually setting TOR_PT_* environment variables, bypassing Tor entirely. A Python wrapper converts the ephemeral SOCKS listener into a fixed TCP port for direct use with tools such as SSH.
ntptun
Extending the ICMP and DNS tunneling lineage, ntptun carries IP or UDP payloads inside NTP mode-3/4 packets using extension fields. The Linux TUN mode provides full IP-over-NTP connectivity; the Windows UDP mode maps multiple clients via port offsets. Recommended deployment places GOST with KCP between the application and ntptun, yielding an HTTP/SOCKS5 proxy whose traffic hides inside NTP. Downstream modes include honest poll (client-driven) and push (server-initiated) with keep-alives; active-probing resistance drops unexpected packets that do not match expected session behavior.
Related articles
Six Bitrix24 Disk Migration Errors That Force Portal Redesign After Six Months
A detailed analysis reveals that copying a legacy file share structure directly into Bitrix24 Disk creates persistent access control, ownership and performance problems that surface only after several quarters of operation. The article examines six specific mistakes including one-to-one folder replication, overuse of personal My Disk storage, assignment of rights to individual users instead of departments, dumping unclear documents into the common drive, attaching file copies rather than links to CRM and tasks, and enabling full desktop synchronization. Each error is illustrated with real symptoms, root causes from rushed migrations, and concrete remediation steps using REST and D7 API calls. A Toyota T-Connect case from 2013-2023 demonstrates how unmonitored open permissions can remain undetected for a decade. The guidance stresses pre-migration inventory, pilot testing on one department, named owners for every top-level section, and quarterly rights audits. The piece is aimed at integrators and IT leads who handle large Bitrix24 deployments.
TGLock 2.0 Restores Telegram Connectivity with Local MTProto Proxy Over WebSocket
Russian developer babin2002 has released TGLock 2.0, a free open-source application for Windows, macOS and Linux that helps users restore Telegram when the client remains stuck on the Connecting screen due to content filtering systems. The tool launches a local MTProto proxy and routes only Telegram traffic through an encrypted WebSocket tunnel to the messenger’s own web infrastructure, leaving all other network activity untouched. Unlike the first version, TGLock 2.0 now verifies that a working WebSocket tunnel has been established before displaying the “Telegram connected” status and automatically tries alternative routes when a connection drops. The application avoids disabling TLS verification, changing system DNS or importing third-party Cloudflare domain lists, although users may optionally supply their own Cloudflare Worker. A LAN mode allows a smartphone on the same network to use the computer as a proxy, but voice and video calls may fail because UDP traffic is not proxied. No Android version is currently available and the macOS build is not signed with a Developer ID certificate.
Smart Speakers Always Listen: Privacy Controls for Yandex Alice, Marusya, Salyut, Siri and Google Assistant
Voice assistants from Yandex, VK, Sber, Apple and Google keep microphones active in standby mode to detect wake words such as Alice, Marusya, Salyut or Hey Siri. No audio leaves the device until the activation phrase is recognized, yet false triggers, stored interaction histories and third-party app permissions create ongoing privacy exposure. Hardware mute buttons on Yandex Stations and VK Capsules cut microphones at the circuit level and display red indicators. Users can also disable voice activation, delete activity logs and turn off model-training options inside Yandex ID, Apple Settings and Google account controls. The article details exact steps for each platform and warns against placing always-listening devices in rooms where sensitive conversations occur.
Apple Updates Find My in iOS 27 to Automatically Switch Location Source to Apple Watch
Apple is enhancing the Find My application in the upcoming iOS 27 release to intelligently switch the source of a user's location data between devices. The current system relies on a single selected device, typically the iPhone, which causes inaccurate location reporting when the user leaves the phone at home. In iOS 27, the app will detect when paired Apple Watch devices move far from the iPhone and automatically begin transmitting coordinates from the watch instead. The feature supports both standard Apple Watch models and cellular variants, with LTE-equipped watches providing more reliable updates without depending on Wi-Fi or nearby iPhones. watchOS 27 will also consolidate the separate Find People, Find Devices, and Find Items apps into a single unified Locator application featuring a full-screen map and Digital Crown navigation. Both iOS 27 and watchOS 27 are currently in beta testing, with a public release expected in September.