Out-of-Band Covert Channels—A Survey

Carrara, Brent; Adams, Carlisle

doi:10.1145/2938370

Cited by 27 publications

(10 citation statements)

References 111 publications

(114 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Covert channels have been proposed for several domains. For instance, Carrara and Adams surveyed out-of-band covert channels over physical media, such as light, sound and air [13] while other authors analyzed details of such channels, e.g., Hanspach and Goetz [14], Cronin et al [15] and Matyunin et al [16]. Network covert channel techniques have been summarized by Mazurczyk et al [17], Wendzel et al [9] and Zander et al [18].…”

Section: Related Workmentioning

confidence: 99%

Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains

Keller

Wendzel

2021

Applied Sciences

View full text Add to dashboard Cite

Covert channels enable stealthy communications over innocent appearing carriers. They are increasingly applied in the network context. However, little work is available that exploits cryptographic primitives in the networking context to establish such covert communications. We present a covert channel between two devices where one device authenticates itself with Lamport’s one-time passwords based on a cryptographic hash function. Our channel enables plausible deniability jointly with reversibility and is applicable in different contexts, such as traditional TCP/IP networks, CPS/IoT communication, blockchain-driven systems and local inter-process communications that apply hash chains. We also present countermeasures to detect the presence of such a covert channel, which are non-trivial because hash values are random-looking binary strings, so that deviations are not likely to be detected. We report on experimental results with MD5 and SHA-3 hash functions for two covert channel variants running in a localhost setup. In particular, we evaluate the channels’ time performance, conduct statistical tests using the NIST suite and run a test for matching hash values between legitimate and covert environments to determine our channels’ stealthiness.

show abstract

Section: Related Workmentioning

confidence: 99%

Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains

Keller

Wendzel

2021

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…In particular, Lampson defined covert channels as ''channels not intended for information transfer at all''. Similarly, the US Department of Defence (DoD) define covert channels as ''any communication channels that can be exploited by a process to transfer information in a manner that violates the system's security policy'' [10]. According to the 'Orange Book' [11] of the US DoD, system developers shall conduct a thorough search for covert channels and make a determination, either by actual measurement or by engineering estimation, of the maximum bandwidth of each identified channel.…”

Section: Related Workmentioning

confidence: 99%

Covert channels in stochastic cyber‐physical systems

Lúcia

Youssef

2021

IET Cyber-Phy Sys Theory & Ap

View full text Add to dashboard Cite

A covert channel is a communication channel that is not intended to exist, and that can be used to transfer information in a manner that violates the system security policy. Attackers can abuse such channels to exfiltrate sensitive information from cyber-physical systems (CPSs), for example to leak the confidential or proprietary parameters in a control system. Furthermore, attacks against CPSs can exploit the leaked information about the implementation of the control system, for example to determine optimal false data injection attack values that degrade the system performance while remaining undetected. In this study, a control theoretic approach for establishing covert channels in stochastic CPSs is presented. In particular, a scenario is considered where an attacker is able to inject malware into the networked controller and arbitrarily alter the control logic. By exploiting such capability, an attacker can establish an illegitimate communication channel, for example to transmit sensitive plant parameters, between the networked controller and an eavesdropper intercepting the sensor measurements. The authors show that such a channel can be established by exploiting the closed-loop system operations, a decoding mechanism based on an unknown input observer, and an error-correcting coding scheme that exploits the control loop to obtain an implicit acknowledgement. A simple proof of concept implementation of the covert channel is presented, and its performance is evaluated by resorting to a numerical example. Finally, some defences and countermeasures are proposed against the proposed covert channel.This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

show abstract

“…Side-channels can also be used for covert communication and collusion [26] , [28] – [30] . These variously employ modulation in domains such as those resulting from wavelet or cosine transforms, modulation techniques such as phase modulation and spread spectrum, recovery strategies such as blind detection, and encoding the side-channel to resist attempts to destroy it [31] .…”

Section: Side-channel Attacks In Cybmentioning

confidence: 99%

Side-Channel Sensing: Exploiting Side-Channels to Extract Information for Medical Diagnostics and Monitoring

Spence

Bangay

2020

IEEE J. Transl. Eng. Health Med.

View full text Add to dashboard Cite

Information within systems can be extracted through side-channels; unintended communication channels that leak information. The concept of side-channel sensing is explored, in which sensor data is analysed in non-trivial ways to recover subtle, hidden or unexpected information. Practical examples of side-channel sensing are well known in domains such as cybersecurity (CYB), but are not formally recognised within the domain of medical diagnostics and monitoring (MDM). This paper reviews side-channel usage within CYB and MDM, identifying techniques and methodologies applicable to both domains. We establish a systematic structure for the use of side-channel sensing in MDM that is comparable to existing structures in CYB, and promote cross-domain transferability of knowledge, mindsets, and techniques.

show abstract

Out-of-Band Covert Channels—A Survey

Cited by 27 publications

References 111 publications

Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains

Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains

Covert channels in stochastic cyber‐physical systems

Side-Channel Sensing: Exploiting Side-Channels to Extract Information for Medical Diagnostics and Monitoring

Contact Info

Product

Resources

About