If you’re writing a paper, I recommend citing real-world exfiltration incidents (from PS3 hacking forums) and performing a controlled test in a sandboxed environment to demonstrate the attack surface.
