Systematic Engineering of Control Protocols for Covert Channels

Wendzel, Steffen; Keller, Jörg

doi:10.1007/978-3-642-32805-3_11

Cited by 11 publications

(13 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…covert channel-internal control protocols with reliability features [Ray and Mishra 2008]. Micro protocols have been well studied over the last years and optimized micro protocols are available [Wendzel and Keller 2012b;Backs et al 2012].…”

Section: Similar Approaches To Pattern Variationmentioning

confidence: 99%

Pattern-Based Survey and Categorization of Network Covert Channel Techniques

et al. 2015

Self Cite

View full text Add to dashboard Cite

Network covert channels are used to hide communication inside network protocols. Within the last decades, various techniques for covert channels arose. We surveyed and analyzed 109 techniques developed between 1987 and 2013 and show that these techniques can be reduced to only 11 different patterns. Moreover, the majority (69.7%) of techniques can be categorized in only four different patterns, i.e. most of the techniques we surveyed are very similar. We represent the patterns in a hierarchical catalog using a pattern language. Our pattern catalog will serve as a base for future covert channel novelty evaluation. Furthermore, we apply the concept of pattern variations to network covert channels. With pattern variations, the context of a pattern can change. For example, a channel developed for IPv4 can automatically be adapted to other network protocols. We also propose the pattern-based covert channel optimizations pattern hopping and pattern combination. Finally, we lay the foundation for pattern-based countermeasures: While many current countermeasures were developed for specific channels, a pattern-oriented approach allows to apply one countermeasure to multiple channels. Hence, future countermeasure development can focus on patterns, and the development of real-world protection against covert channels is greatly simplified.

show abstract

Section: Similar Approaches To Pattern Variationmentioning

confidence: 99%

Pattern-Based Survey and Categorization of Network Covert Channel Techniques

et al. 2015

Self Cite

View full text Add to dashboard Cite

show abstract

“…This is similar to existing network covert channel techniques which comprise an internal control header (the control channel) and a payload area (the data channel) like presented in [32], [33]. Table II summarizes the control and data channels of the covert channels discussed in this Section.…”

Section: B Covert Channel Setupmentioning

confidence: 84%

Hiding Privacy Leaks in Android Applications Using Low-Attention Raising Covert Channels

Lalande

Wendzel

2013

2013 International Conference on Availability, Reliability and Security

Self Cite

View full text Add to dashboard Cite

Covert channels enable a policy-breaking communication not foreseen by a system's design. Recently, covert channels in Android were presented and it was shown that these channels can be used by malware to leak confidential information (e.g., contacts) between applications and to the Internet. Performance aspects as well as means to counter these covert channels were evaluated. In this paper, we present novel covert channel techniques linked to a minimized footprint to achieve a high covertness. Therefore, we developed a malware that slowly leaks collected private information and sends it synchronously based on four covert channel techniques. We show that some of our covert channels do not require any extra permission and escape well know detection techniques like TaintDroid. Experimental results confirm that the obtained throughput is correlated to the user interaction and show that these new covert channels have a low energy consumption -both aspects contribute to the stealthiness of the channels. Finally, we discuss concepts for novel means capable to counter our covert channels and we also discuss the adaption of network covert channel features to Android-based covert channels.

show abstract

“…While the concept evolved in military contexts, today, the threats of covert communication have reached the mainstream and various implementations based on many different communication methods, such as IP, exist as research prototypes [9,20,25] and "in the wild" [1,5]. While the specific encoding and methods for creating covert channels were refined, the actual implementation almost always focuses on protocol layers at or above the data link layer [13,17,21,31]. Consequently defensive methods, i.e., attempts to detect a covert channel, usually assume a packet abstraction such as the one provided by the Internet Protocol [4,8,18,33].…”

Section: Related Workmentioning

confidence: 99%

Information leakage behind the curtain: Abusing anti-EMI features for covert communication

Bauer

Schinzel

Freiling

et al. 2016

2016 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)

View full text Add to dashboard Cite

Abstract-We present a new class of covert channels which can be created by utilizing common hardware but that cannot be detected by such. Our idea is to abuse anti-EMI features of a processor to create a covert channel on the physical layer. Thus, the sender uses the invariants in how digital signals are encoded over analog channels to covertly transport information. This leaked data is present on the wire bound connections of the compromised device, but is also by definition present in the vicinity of the device and can be picked up by radio equipment. As the covert channel is present only on the physical layer, the data on all layers above, as well as the timing behavior on those layers is indistinguishable from uncompromised devices. We present two example implementations of such channels using RS-232 as the carrier and use a common oscilloscope to decode the resulting covert channel. Using this setup, we observed symbol rates of around 5 baud. We derive the theoretical upper bound of the covert channels bandwidth and discuss the factors by which it is influenced.

show abstract

Systematic Engineering of Control Protocols for Covert Channels

Cited by 11 publications

References 17 publications

Pattern-Based Survey and Categorization of Network Covert Channel Techniques

Pattern-Based Survey and Categorization of Network Covert Channel Techniques

Hiding Privacy Leaks in Android Applications Using Low-Attention Raising Covert Channels

Information leakage behind the curtain: Abusing anti-EMI features for covert communication

Contact Info

Product

Resources

About