Conclusion

Data hiding is an old topic applied to new technologies. Even Hollywood and popular fiction have sensationalized the idea. In this chapter, we touched upon the essential concept of "hiding in plain sight," and introduced NDIS and TDI mechanisms that can be used to send and receive network data from a Microsoft Windows kernel driver.

Using the available technology, systems can be crafted to move data into and out of networks without detection. That may seem to be a lofty claim, but most networks are busy, overtaxed, and lack robust intrusion detection architectures. For the most part, the network admins just do their best to keep everything running, and a little trickle of covert data will simply be overlooked.