bccstego: A Framework for Investigating Network Covert Channels

Abstract

Modern malware increasingly exploits information hiding to remain undetected while attacking. To this aim, network covert channels, i.e., hidden communication paths established within legitimate flows, can be used to exfiltrate data or exchange commands without getting noticed by firewalls, antivirus, and intrusion detection systems. Since the secret data can be directly injected in various portions of the stream or encoded via suitable alterations of the traffic, spotting hidden communications is a challenging and poorly generalizable task. Moreover, the majority of works addressed IPv4, thus leaving the detection of covert channels targeting IPv6 almost unexplored.This paper presents bccstego, i.e., an inspection framework for computing statistical indicators to reveal covert channels targeting the IPv6 header. The proposed approach has been designed to be easily extended, for instance to search for channels not known a priori. Numerical results demonstrate the effectiveness of our first tool in the bccstego framework as well as its ability to handle high-throughput IPv6 flows without adding additional delays. CCS CONCEPTS• Networks → Network performance evaluation; • Security and privacy → Network security; Domain-specific security and privacy architectures.

Code Layering for the Detection of Network Covert Channels in Agentless Systems

“…• Inspection Layer: it contains a set of eBPF programs that can create statistics on the usage of header fields and packet inter-arrival times for both IPv4/v6 traffic. Programs 3 collecting data to address storage channels are based on a modified version of bccstego, i.e., a suite of tools able to generate filters for inspecting network and higher-level protocols like TCP/UDP [22]. Instead, to address timing channels, we created a novel eBPF program 4 collecting time information and implementing the approach presented in [12] within the kernel; • Management Layer: to load and unload eBPF programs as well as to collect measures, we implemented ad-hoc scripts and user-land utilities taking advantage of the BPF Compiler Collection (BCC) library 5 .…”

Detecting and Locating Storage-Based Covert Channels in Internet Protocol Version 6

“…Luca et al [13] presented the use of code augmentation in eBPF inside the Linux kernel to collect the statistics of IPv6 header fields like Flow Label. Repetto et al [14] used the BCC tool for running eBPF programs to obtain statistics about IPv6 header fields viz. the Flow Label field, the Traffic Class field, and the Hop Limit field.…”

“…the Flow Label field, the Traffic Class field, and the Hop Limit field. The underlying concept in both [13] and [14] was to share a common technique for analyzing packets' headers and gathering data for hidden data analysis. The authors inferred that abnormal changes in the statistical values of these header fields can raise an alarm about the existence of a covert channel.…”

“…As countermeasures, few methods have been proposed by researchers to detect the existence of storage-based NCCs in IPv6. The detection approaches in [13] and [14] use statistical analysis of the IPv6 packet's header field using eBPF (extended Berkley Packet Filter) for IPv6-based covert channel detection. In these techniques, authors make use of changing number of bins (evaluated for a fixed time in IPv6 network traffic) as a metric to detect the existence of storage-based NCCs in IPv6.…”

“…In these techniques, authors make use of changing number of bins (evaluated for a fixed time in IPv6 network traffic) as a metric to detect the existence of storage-based NCCs in IPv6. The limitation of such approaches as discussed by the authors in their work [13], [14] are as follows.…”