Length based network steganography using UDP protocol

Nair, Anand S.; Kumar, Abhishek; Sur, Arijit; Nandi, Sukumar

doi:10.1109/iccsn.2011.6014994

Cited by 21 publications

(9 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this way, multiple IP IDs correspond to the same symbol (see the example in Figure , left). Total length , protocol , and time to live (TTL) or even the destination address have also been used to hide covert symbols by a similar technique. In , the author proposes some types of covert channels with value to symbol correspondence: setting the IP identification with a value equal to the covert byte multiplied by 256, or the initial sequence number (ISN) with a value equal to the covert byte multiplied by 65536·256.…”

Section: Covert Channelsmentioning

confidence: 99%

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

Iglesias

Annessi

Zseby

2016

Security Comm Networks

View full text Add to dashboard Cite

Covert channels provide means to conceal information transfer between hosts and bypass security barriers in communication networks. Hidden communication is of paramount concern for governments and companies, because it can conceal data leakage and malware communication, which are crucial building blocks used in cyber crime. We propose detectors based on descriptive analytics of traffic (DAT) to facilitate revealing network and transport layer covert channels originated from a wide spectrum of published data‐hiding techniques. DAT detectors transform communication data into flexible feature vectors that represent traffic by a set of extracted calculations and estimations. For the case of covert channels, the core of the detection is performed by the combined application of autocorrelation calculations and multimodality measures built upon kernel density estimations and Pareto charts. DAT detectors are devised to be embedded as extensions of network intrusion detection systems, being able to perform fast, lightweight analysis of numerous flows. The present paper focuses specifically on TCP/IP traffic and provides suitable classifications of TCP/IP fields and related covert channel techniques from the perspective of the statistical detection. The proposed methodology is evaluated with public traffic datasets as well as covert channels generated according to main techniques described in the related literature. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Section: Covert Channelsmentioning

confidence: 99%

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

Iglesias

Annessi

Zseby

2016

Security Comm Networks

View full text Add to dashboard Cite

show abstract

“…Other transport layer protocols, such as UDP, can also be subjects of network steganography. Such a method has been presented in [ 31 ]—the covert data is embedded in the length of UDP datagram—and authors claim to achieve 456

of bandwidth of the covert channel established with that method.…”

Section: Related Workmentioning

confidence: 99%

StegoFrameOrder—MAC Layer Covert Network Channel for Wireless IEEE 802.11 Networks

Sawicki

Bieszczad

Piotrowski

2021

Sensors

View full text Add to dashboard Cite

The proposed StegoFrameOrder (SFO) method enables the transmission of covert data in wireless computer networks exploiting non-deterministic algorithms of medium access (such as the distributed coordination function), especially in IEEE 802.11 networks. Such a covert channel enables the possibility of leaking crucial information outside secured network in a manner that is difficult to detect. The SFO method embeds hidden bits of information in the relative order of frames transmitted by wireless terminals operating on the same radio channel. The paper presents an idea of this covert channel, its implementation, and possible variants. The paper also discusses implementing the SFO method in a real environment and the experiments performed in the real-world scenario.

show abstract

“…Before the Smart Config, similar solutions have already been presented. A network-based steganography approach, based on the length-field of UDP packets, has been proposed in [21]. More advanced and detection-proof techniques are presented in [17,24,28,30].…”

Section: Related Workmentioning

confidence: 99%

A (in)Secure-by-Design IoT Protocol

Salzillo

Rak

2020

Proceedings of the 2020 Joint Workshop on CPS&IoT Security and Privacy

View full text Add to dashboard Cite

The number of IoT devices designed and marketed in these last years is continuously growing. These smart things are more often managed through the cloud, therefore more and more devices are connected both to the customer's local networks and to the Internet. Among the several network pairing mechanisms designed for the IoT domain, we examined the Smart Config family of protocols, a clever technology that allows an IoT device to be associated with an existing WiFi network by receiving special packets from an already network-paired smartphone. We investigate the threats and the technical details behind the ESP Touch protocol, a Smart Config implementation developed by Espressif Systems for its ESP32/8266 family of chips. Additionally, we present a security analysis of the same protocol implemented by the ITEAD Sonoff smart switches (and also by many other ESP-based devices), that we conducted by reverse-engineering the eWeLink mobile companion application. In conclusion, we describe a vulnerability (published as CVE-2020-12702) we found in the Quick Pairing mode of the eWeLink SDK that leads to a full WiFi credential disclosure during the device pairing process.

show abstract

Length based network steganography using UDP protocol

Cited by 21 publications

References 10 publications

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

DAT detectors: uncovering TCP/IP covert channels by descriptive analytics

StegoFrameOrder—MAC Layer Covert Network Channel for Wireless IEEE 802.11 Networks

A (in)Secure-by-Design IoT Protocol

Contact Info

Product

Resources

About