Innovative Tunneling Techniques Leverage File Storage, IMAP, Meek, and NTP for Covert Connectivity
A fresh set of unconventional tunneling approaches has surfaced in the world of proxies and VPNs, expanding options for establishing covert network links through everyday services.
File Tunnel
The core idea is straightforward yet effective: when two hosts share access to the same file storage, ordinary files can serve as the medium for TCP connectivity. File-Tunnel listens on a local TCP port; incoming connections cause data to be appended to a file. The remote instance reads the same file, reconstructs the TCP stream, and forwards it to the intended destination. Return traffic flows through a second file. Files are periodically rotated to prevent unbounded growth.
Supported storage includes SMB or NFS shares, FTP servers, RDP or Citrix mounted disks, VirtualBox shared folders, WSL, Docker volumes, and Dropbox. Recent additions provide native S3 and WebDAV support. Because many providers offer inexpensive or free-tier S3-compatible buckets, the resulting tunnel traffic appears as routine object-storage requests. Example invocation on side A forwards RDP while side B acts as the remote endpoint:
- ft.exe --s3 --bucket mybucket --region ru-moscow-1 --access-key XXXXXXXX --secret-key XXXXXXXX -L 5000:192.168.1.20:3389
Environment variables FT_S3_ACCESS_KEY and FT_S3_SECRET_KEY keep credentials off the command line. WebDAV works with services such as Mail.ru Cloud using a simple URL and credentials.
True IMAP Tunnel (Secure)
Building on earlier serverless experiments, True IMAP Tunnel (Secure) uses an IMAP mailbox as the transport. Both tunnel endpoints authenticate to the same account and designate dedicated folders for each direction. Data frames are wrapped as draft messages via the APPEND command; they never traverse SMTP. The receiving side monitors via IDLE or polling, extracts frames, marks messages deleted, and issues EXPUNGE in batches. Optional AES-256-GCM encryption protects frames, and message appearance (subject, attachment filename) can be customized to reduce suspicion. Tested providers include Gmail, Outlook, Seznam, Mail.ru, Yandex, Timeweb, and Rambler. The single Go binary supports SOCKS5, VLESS, SSH, and can run as a Shadowsocks SIP003 plugin.
Meek
Meek, a legacy Tor pluggable transport, offers an alternative when XHTTP fails against certain CDNs. Clients issue HTTP POST requests (up to 64 KB) carrying an X-Session-Id header; the server maps sessions to TCP connections and returns responses in HTTP bodies. Empty POSTs maintain polling intervals that grow from 100 ms to 5 s. Because of its simplicity, Meek functions through shared hosting with small PHP or Python reflectors. Standalone operation is achieved by manually setting TOR_PT_* environment variables, bypassing Tor entirely. A Python wrapper converts the ephemeral SOCKS listener into a fixed TCP port for direct use with tools such as SSH.
ntptun
Extending the ICMP and DNS tunneling lineage, ntptun carries IP or UDP payloads inside NTP mode-3/4 packets using extension fields. The Linux TUN mode provides full IP-over-NTP connectivity; the Windows UDP mode maps multiple clients via port offsets. Recommended deployment places GOST with KCP between the application and ntptun, yielding an HTTP/SOCKS5 proxy whose traffic hides inside NTP. Downstream modes include honest poll (client-driven) and push (server-initiated) with keep-alives; active-probing resistance drops unexpected packets that do not match expected session behavior.
Related articles
OpenAI ChatGPT Computer History Feature on macOS Could Expose Detailed User Activity Logs to Infostealers
OpenAI has introduced the Computer History feature in its macOS ChatGPT app, which records application switches, clicks, keystrokes, and accessibility context to generate AI summaries and memories. The feature is disabled by default and requires explicit activation of Memories, with availability limited to Pro, Business, and Enterprise users outside the EEA, Switzerland, and the UK. While raw event files are deleted after 48 hours and not used for model training, the resulting Markdown memory files remain unencrypted on the local Mac. These files can be read by any process running under the same user account, creating a ready-made activity log for infostealers and other malware. OpenAI also warns about prompt injection risks where hidden instructions from websites or apps could influence ChatGPT or Codex behavior. Users retain controls to select participating apps, pause collection, or delete history, but the lack of encryption on stored memories raises significant privacy concerns.
AirTag and SmartTag: How to Detect If a Bluetooth Tracker Is Following You
Phones can now warn users when an unknown Bluetooth tracker such as an Apple AirTag or Samsung SmartTag is moving alongside them for an extended period. The alerts do not automatically confirm stalking, since the same tags can be left in taxis, rental cars or borrowed bags, yet they should never be ignored. AirTag and SmartTag rely on crowdsourced Bluetooth networks rather than built-in GPS or cellular connections, allowing them to report approximate locations only when nearby phones relay the signal. The article details differences from traditional GPS trackers, explains how to interpret notifications on iOS 17.5+ and Android 6.0+, and provides step-by-step guidance for locating hidden devices in clothing, vehicles or personal items. It also covers immediate safety actions, evidence preservation for police reports, and practical steps to reduce future tracking risks through account and permission hygiene.
VPN Encryption Alone Cannot Hide Traffic from Network Detection Systems
A Habr user known as mr_tom detailed why encrypted VPN connections remain detectable despite their encryption. Observers can identify connections through visible metadata such as server IP addresses, ports, transport protocols, handshake patterns, packet sizes, timing intervals, and overall flow behavior. Simple DPI systems block traffic by restricting known IPs or ports, while advanced filters build traffic fingerprints and use active probing to verify suspicious endpoints. The popular combination of VLESS, XHTTP, and REALITY operates across different layers rather than functioning as three equivalent VPN protocols. Even traffic on port 443 can be distinguished from standard HTTPS by analyzing handshake details and subsequent packet behavior. The core conclusion is that no universally unblockable VPN exists, as detection can rely on IP blocking, new signatures, or active verification regardless of encryption strength.
Browser Extension Anonymizes Sensitive Data Before Sending to AI Chatbots
A new browser extension automatically detects and replaces sensitive information such as names, INN numbers, bank cards, and emails with pseudonyms before any text or files reach AI chat services. The tool operates entirely locally in the browser, ensuring original data never leaves the user's device while allowing AI models to process anonymized placeholders. Responses from the AI are decrypted back to readable form only on the user's screen using an in-memory mapping that disappears when the browser closes. The solution supports over 70 file formats including DOCX, XLSX, and PDF, plus offline OCR for scanned documents to handle the most common leakage vectors used by HR, legal, and accounting teams. Multiple validation layers including checksums, Luhn algorithm, entropy checks, and normalization for Russian name declensions reduce false positives that plagued earlier regex-based attempts. The extension is available in a free version on the Chrome Web Store covering 33 data categories, with advanced file and scan features offered on request.