A survey of covert channels and countermeasures in computer network protocols
---
paper_title: A note on the confinement problem

paper_content:

onfining a program during its execution so that it cannot transmit information to any other program except its caller. A set of examples attempts to stake out the boundaries of the problem. Necessary conditions for a solution are stated and informally justified.
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: Covert Communications Despite Traffic Data Retention

paper_content:

We show that Alice and Bob can communicate covertly and anonymously, despite Eve having access to the traffic data of most machines on the Internet. Our protocols take advantage of small amounts of shared state that exist in many TCP/IP stacks, and use them to construct a covert channel. Techniques inspired from Direct Sequence Spread Spectrum (DSSS) are used to make sure that the communication is covert and resistant to noise. We implement a prototype based on ICMP Echo (ping) to illustrate the practicality of our approach and discuss how a more complex protocol would modulate information through the use of TCP features to make communication detection very difficult. The feasibility of covert communications despite stringent traffic data retention, has far reaching policy consequences. © 2011 Springer-Verlag.
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---
paper_title: Limitations of End-to-End Encryption in Secure Computer Networks

paper_content:

Abstract : End-to-end encryption is not sufficient to prevent compromise of information in a network that employs untrusted subnet (network interface) processors. Addresses, message lengths, and timing of transmissions furnish channels whose bandwidth can be significant.
---
paper_title: Data exfiltration and covert channels

paper_content:

Within an organization, the possibility of a confidential information leak ranks among the highest fears of any executive. Detecting information leaks is a challenging problem, since most organizations depend on a broad and diverse communications network. It is not always straightforward to conclude which information is leaving the organization legitimately, and which communications are malicious data exfiltrations. Sometimes it is not even possible to tell that a communication is occurring at all. The set of all possible exfiltration methods contains, at a minimum, the set of all possible information communication methods, and possibly more. This article cannot possibly cover all such methods; however, several notable examples are given, and a taxonomy of data exfiltration is developed. Such a taxonomy cannot ever be exhaustive, but at the very least can offer a framework for organizing methods and developing defenses.
---
paper_title: Information hiding—A survey

paper_content:

Information-hiding techniques have recently become important in a number of application areas. Digital audio, video, and pictures are increasingly furnished with distinguishing but imperceptible marks, which may contain a hidden copyright notice or serial number or even help to prevent unauthorized copying directly. Military communications systems make increasing use of traffic security techniques which, rather than merely concealing the content of a message using encryption, seek to conceal its sender, its receiver, or its very existence. Similar techniques are used in some mobile phone systems and schemes proposed for digital elections. Criminals try to use whatever traffic security properties are provided intentionally or otherwise in the available communications systems, and police forces try to restrict their use. However, many of the techniques proposed in this young and rapidly evolving field can trace their history back to antiquity, and many of them are surprisingly easy to circumvent. In this article, we try to give an overview of the field, of what we know, what works, what does not, and what are the interesting topics for research.
---
paper_title: Infranet: Circumventing Web censorship and surveillance

paper_content:

An increasing number of countries and companies routinely block or monitor access to parts of the Internet. To counteract these measures, we propose Infranet, a system that enables clients to surreptitiously retrieve sensitive content via cooperating Web servers distributed across the global Internet. These Infranet servers provide clients access to censored sites while continuing to host normal uncensored content. Infranet uses a tunnel protocol that provides a covert communication channel between its clients and servers, modulated over standard HTTP transactions that resemble innocuous Web browsing. In the upstream direction, Infranet clients send covert messages to Infranet servers by associating meaning to the sequence of HTTP requests being made. In the downstream direction, Infranet servers return content by hiding censored data in uncensored images using steganographic techniques. We describe the design, a prototype implementation, security properties, and performance of Infranet. Our security analysis shows that Infranet can successfully circumvent several sophisticated censoring techniques.
---
paper_title: IP traceback solutions based on time to live covert channel

paper_content:

Due to its stateless nature, the Internet protocol (IP) requires forwarding devices to only know each packet's next hop to correctly route any IP datagram towards its final destination. Thus, since identification of the source solely relies on the information provided by the sender itself, IP makes it extremely difficult to correctly identify the real origin of any datagram. We propose a novel way to locate the entry point of an IP flow into a given network domain based on a marking method using the IP header time to live (TTL) field as a covert channel to carry the information. The proposed solution overcomes drawbacks that undermine previous traceback schemes based on overloading various IP header fields and does not rely on attack signatures.
---
paper_title: RIFLE: An Architectural Framework for User-Centric Information-Flow Security

paper_content:

Even as modern computing systems allow the manipulation and distribution of massive amounts of information, users of these systems are unable to manage the confidentiality of their data in a practical fashion. Conventional access control security mechanisms cannot prevent the illegitimate use of privileged data once access is granted. For example, information provided by a user during an online purchase may be covertly delivered to malicious third parties by an untrustworthy web browser. Existing information-flow security mechanisms do provide this assurance, but only for programmer-specified policies enforced during program development as a static analysis on special-purpose type-safe languages. Not only are these techniques not applicable to many commonly used programs, but they leave the user with no defense against malicious programmers or altered binaries. In this paper, we propose RIFLE, a runtime information-flow security system designed from the user's perspective. By addressing information-flow security using architectural support, RIFLE gives users a practical way to enforce their own information-flow security policy on all programs. We prove that, contrary to statements in the literature, run-time systems like RIFLE are no less secure than existing language-based techniques. Using a model of the architectural framework and a binary translator, we demonstrate RIFLE's correctness and illustrate that the performance cost is reasonable.
---
paper_title: Improved port knocking with strong authentication

paper_content:

It is sometimes desirable to allow access to open ports on a firewall only to authorized external users and present closed ports to all others. We examine ways to construct an authentication service to achieve this goal, and then examine one such method, "port knocking", and its existing implementations, in detail. We improve upon these existing implementations by presenting a novel port knocking architecture that provides strong authentication while addressing the weaknesses of existing port knocking systems
---
paper_title: SecSyslog: an approach to secure logging based on covert channels

paper_content:

Today log traces are widely used to identify and prevent violations of corporate information systems. The most recent logging trend is to manage most level 3 ISO/OSI traffic via pcap-compatible output. But use of syslog is still very widespread, as are the security issues it entails, especially in its 'pure' version. This paper outlines the basic syslog problems as foreseen in the RFCs, examines the 'secure' alternatives to the protocol (and relative implementations) and proposes a transmission approach based on covert channels which, applied on the LINUX platform, might answer some of the intrinsic reliability problems which undermine its effectiveness as a digital forensic tool.
---
paper_title: Keyboards and covert channels

paper_content:

This paper introduces JitterBugs, a class of inline interception mechanisms that covertly transmit data by perturbing the timing of input events likely to affect externally observable network traffic. JitterBugs positioned at input devices deep within the trusted environment (e.g., hidden in cables or connectors) can leak sensitive data without compromising the host or its software. In particular, we show a practical Keyboard JitterBug that solves the data exfiltration problem for keystroke loggers by leaking captured passwords through small variations in the precise times at which keyboard events are delivered to the host. Whenever an interactive communication application (such as SSH, Telnet, instant messaging, etc) is running, a receiver monitoring the host's network traffic can recover the leaked data, even when the session or link is encrypted. Our experiments suggest that simple Keyboard JitterBugs can be a practical technique for capturing and exfiltrating typed secrets under conventional OSes and interactive network applications, even when the receiver is many hops away on the Internet.
---
paper_title: New security and control protocol for VoIP based on steganography and digital watermarking

paper_content:

In this paper new, lightweight security and control protocol for Voice over Internet Protocol (VoIP) service is presented. It is the alternative for the IETF's (Internet Engineering Task Force) RTCP (Real-Time Control Protocol) for real-time application's traffic. Additionally this solution offers authentication and integrity of voice send and it is capable of exchanging and verifying QoS and security parameters. It is based on two information hiding techniques: digital watermarking and steganography. That is why it does not consume additional bandwidth and the data transmitted is inseparably bound to the voice content.
---
paper_title: A note on the confinement problem

paper_content:

onfining a program during its execution so that it cannot transmit information to any other program except its caller. A set of examples attempts to stake out the boundaries of the problem. Necessary conditions for a solution are stated and informally justified.
---
paper_title: A Practical Approach to Identifying Storage and Timing Channels

paper_content:

Recognizing and dealing with storage and timing channels when performing the security analysis of a computer system is an elusive task. Methods of discovering and dealing with these channels for the most part have been ad hoc, and those that are not are restricted to a particular specification language. This paper outlines a practical methodology for discovering storage and timing channels that can be used through all phases of the software life cycle to increase the assurance that all channels have been identified. The methodology is presented and its application to three different descriptions (English, formal specification, and high order language implementation) are discussed.
---
paper_title: 20 years of covert channel modeling and analysis

paper_content:

Covert channels emerged in mystery and departed in confusion. Covert channels are a means of communication between two processes that are not permitted to communicate, but do so anyway, a few bits at a time, by affecting shared resources. Information hiding is slightly different: the two communicating parties are allowed to talk, but the content is censored and restricted to certain subjects. The trick is to "piggyback" some contraband data invisibly on the legitimate content. The canonical example of this is to use the low-order two bits of each pixel in a picture for your secret message, since no one would notice if they were changed. When a similar idea was applied to smuggle information in network headers, we called it a network covert channel, mostly because the term "information hiding" hadn't been invented yet. The article traces the history of covert channel modeling from 1980 to the present (1999).
---
paper_title: Information hiding—A survey

paper_content:

Information-hiding techniques have recently become important in a number of application areas. Digital audio, video, and pictures are increasingly furnished with distinguishing but imperceptible marks, which may contain a hidden copyright notice or serial number or even help to prevent unauthorized copying directly. Military communications systems make increasing use of traffic security techniques which, rather than merely concealing the content of a message using encryption, seek to conceal its sender, its receiver, or its very existence. Similar techniques are used in some mobile phone systems and schemes proposed for digital elections. Criminals try to use whatever traffic security properties are provided intentionally or otherwise in the available communications systems, and police forces try to restrict their use. However, many of the techniques proposed in this young and rapidly evolving field can trace their history back to antiquity, and many of them are surprisingly easy to circumvent. In this article, we try to give an overview of the field, of what we know, what works, what does not, and what are the interesting topics for research.
---
paper_title: The Prisoners’ Problem and the Subliminal Channel

paper_content:

Two accomplices in a crime have been arrested and are about to be locked in widely separated cells. Their only means of communication after they are locked up will he by way of messages conveyed for them by trustees -- who are known to be agents of the warden. The warden is willing to allow the prisoners to exchange messages in the hope that he can deceive at least one of them into accepting as a genuine communication from the other either a fraudulent message created by the warden himself or else a modification by him of a genuine message. However, since he has every reason to suspect that the prisoners want to coordinate an escape plan, the warden will only permit the exchanges to occur if the information contained in the messages is completely open to him -- and presumably innocuous. The prisoners, on the other hand, are willing to accept these conditions, i.e., to accept some risk of deception in order to be able to communicate at all, since they need to coordinate their plans. To do this they will have to deceive the warden by finding a way of communicating secretly in the exchanges, i.e., of establishing a “subliminal channel” between them in full view of the warden, even though the messages themselves contain no secret (to the warden) information‡. Since they anticipate that the warden will try to deceive them by introducing fraudulent messages, they will only exchange messages if they are permitted to authenticate them.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Syntax and Semantics-Preserving Application-Layer Protocol Steganography

paper_content:

Protocol steganography allows users who wish to communicate secretly to embed information within other messages and network control protocols used by common applications. This form of unobservable communication can be used as means to enhance privacy and anonymity as well as for many other purposes, ranging from entertainment to protected business communication or national defense. In this paper, we describe our approach to application-layer protocol steganography, describing how we can embed messages into a commonly used TCP/IP protocol. We also introduce the notions of syntax and semantics preservation, which ensure that messages after embedding still conform to the host protocol. Based on those concepts, we attempt to produce reasonably secure and robust stegosystems. To demonstrate the efficacy of our approach, we have implemented protocol steganography within the Secure Shell (SSH) protocol. Findings indicate that protocol steganographic system is reasonably secure if the statistical profile of the covermessages and the statistical profile of its traffic match their counterparts after embedding.
---
paper_title: Covert Channels in LAN Protocols

paper_content:

Encryption is generally understood as being the basic mechanisms for LAN security. However, usage of encryption finds its limitations in case of an unauthorized information flow via covert channels. Some covert storage and timing channels inherent in a LAN's architecture are already described in the literature. This paper takes a more general approach. It shows, that there is a potential of unused bandwidth in commonly used LAN protocols (IEEE 802.2, 802.3, 802.4, 802.5), which might be exploitable as covert channel. The key point is, that exploitation of this potential of unused bandwidth is not a question of a LAN's architecture, but is strongly dependent on the design of its internal interfaces and on its implementations.
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Covert Channels in LAN Protocols

paper_content:

Encryption is generally understood as being the basic mechanisms for LAN security. However, usage of encryption finds its limitations in case of an unauthorized information flow via covert channels. Some covert storage and timing channels inherent in a LAN's architecture are already described in the literature. This paper takes a more general approach. It shows, that there is a potential of unused bandwidth in commonly used LAN protocols (IEEE 802.2, 802.3, 802.4, 802.5), which might be exploitable as covert channel. The key point is, that exploitation of this potential of unused bandwidth is not a question of a LAN's architecture, but is strongly dependent on the design of its internal interfaces and on its implementations.
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---
paper_title: Traceroute based IP channel for sending hidden short messages

paper_content:

The paper proposes a novel IP channel for sending hidden short messages, based mainly on the use of the “traceroute” command and the IP header Record route options. Instead of encrypting a hidden message or embedding it into a multimedia object, as in traditional multimedia steganography, we process the entire message and generate several IP packets with different types to carry the secret message. Thereby we foil an eavesdropper who is primarily applying statistical tests to detect encrypted communication channels. We show that our approach provides more protection against Steganalysis and sniffing attacks. A friendly graphical tool has been implemented to demonstrate the proposed secret IP channel.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Covert Communications Despite Traffic Data Retention

paper_content:

We show that Alice and Bob can communicate covertly and anonymously, despite Eve having access to the traffic data of most machines on the Internet. Our protocols take advantage of small amounts of shared state that exist in many TCP/IP stacks, and use them to construct a covert channel. Techniques inspired from Direct Sequence Spread Spectrum (DSSS) are used to make sure that the communication is covert and resistant to noise. We implement a prototype based on ICMP Echo (ping) to illustrate the practicality of our approach and discuss how a more complex protocol would modulate information through the use of TCP features to make communication detection very difficult. The feasibility of covert communications despite stringent traffic data retention, has far reaching policy consequences. © 2011 Springer-Verlag.
---
paper_title: Data Hiding in Identification and Offset IP Fields

paper_content:

Steganography is defined as the art and science of hiding information, it takes one piece of information and hides it within another. The piece more used to hide information are the digital images. In this paper we present a way to use unused fields in the IP header of TCP/IP packets in order to send information between to nodes over Internet.
---
paper_title: Practical Data Hiding in TCP/IP

paper_content:

This work relates the areas of steganography, network protocols and security for practical data hiding in communication networks employing TCP/IP. Two approaches are proposed based on packet header manipulation and packet ordering within the IPSec framework. For the former the Internet protocol IPv4 header is analyzed to identify covert channels by exploiting redundancy and multiple interpretations of protocol strategies; by passing supplementary information through IPv4 headers we demonstrate how security mechanisms can be enhanced in routers, firewalls, and for services such as authentication, audit and logging without considerable additions to software or hardware. For the latter approach, we show the use of packet sorting for steganographic embedding with IPSec can allow for enhanced network security.
---
paper_title: Embedding Covert Channels into TCP/IP

paper_content:

It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number (ISN) or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naive embedding. Finally, we describe reversible transforms that map block cipher output onto TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden so that an attacker cannot demonstrate its existence without knowing a secret key.
---
paper_title: IP traceback solutions based on time to live covert channel

paper_content:

Due to its stateless nature, the Internet protocol (IP) requires forwarding devices to only know each packet's next hop to correctly route any IP datagram towards its final destination. Thus, since identification of the source solely relies on the information provided by the sender itself, IP makes it extremely difficult to correctly identify the real origin of any datagram. We propose a novel way to locate the entry point of an IP flow into a given network domain based on a marking method using the IP header time to live (TTL) field as a covert channel to carry the information. The proposed solution overcomes drawbacks that undermine previous traceback schemes based on overloading various IP header fields and does not rely on attack signatures.
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---
paper_title: A typical noisy covert channel in the IP protocol

paper_content:

Previous studies have exploited a number of noiseless covert channels in the IPv4 protocol by using some fields in the IP header including the identification, the header checksum and the padding fields. These channels can transmit covert information correctly between two Internet nodes, but will be eliminated after the adoption of the IPv6 protocol. To construct a covert channel which can survive in the IPv6 protocol, a noisy covert channel is designed by using the TTL field in the IPv4 header. The channel can be exploited in the IPv6 protocol because the TTL field will be substituted by the Hop Limit field with a similar function. Two methods are presented including one-bit-per-packet method and TTL partition method. The maximal attainable bandwidth of the channel is discussed and a formula is given to calculate the maximal attainable bandwidth. The maximal attainable bandwidth is inversely proportional to the expectation and variance of the distribution of the average hop number between two communication nodes. The correlation between the maximal attainable bandwidth and the selection of the code error rate is also analyzed. Some statistics data from real networks are collected to estimate the bandwidth of the channel in practice. The result shows that the covert channel is effective in most situations.
---
paper_title: Covert Channels in the IP Time To Live Field

paper_content:

Covert channels are used for the secret transfer of information. Unlike encryption, which only protects the information from unauthorised observers, covert channels aim to hide the very existence of the communication. The huge amount of data and vast number of different network protocol s in the Internet makes it an ideal high-capacity vehicle for covert communication. Covert channels pose a serious security threat as they can be used for a number of malicious activities. In this paper we present a novel covert channel inside the IP header’s Time To Live (TTL) field. The sender manipulates the TTLs of subsequent packets transmitting covert information to the receiver. Since network elements along the path also modify the TTL, the capacity and stealth of this channel depend on the “natural” TTL variation. We analyse this variation in multiple traffic traces and propose an encoding scheme, which makes the TTL covert channel look similar to “natural” variation. We also discuss methods to eliminate and detect this covert channel
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: Limitations of End-to-End Encryption in Secure Computer Networks

paper_content:

Abstract : End-to-end encryption is not sufficient to prevent compromise of information in a network that employs untrusted subnet (network interface) processors. Addresses, message lengths, and timing of transmissions furnish channels whose bandwidth can be significant.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Covert messaging through TCP timestamps

paper_content:

Covert channels exist in most communications systems and allow individuals to communicate truly undectably. However, covert channels are seldom used due to their complexity. A protocol for sending data over a common class of low-bandwidth covert channels has been developed. The protocol is secure against attack by powerful adversaries. The design of a practical system implementing the protocol on a standard platform (Linux) exploiting a channel in a common communications system (TCP timestamps) is presented. A partial implementation of this system has been accomplished.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: Hot or not: revealing hidden services by their clock skew

paper_content:

Location-hidden services, as offered by anonymity systems such as Tor, allow servers to be operated under a pseudonym. As Tor is an overlay network, servers hosting hidden services are accessible both directly and over the anonymous channel. Traffic patterns through one channel have observable effects on the other, thus allowing a service's pseudonymous identity and IP address to be linked. One proposed solution to this vulnerability is for Tor nodes to provide fixed quality of service to each connection, regardless of other traffic, thus reducing capacity but resisting such interference attacks. However, even if each connection does not influence the others, total throughput would still affect the load on the CPU, and thus its heat output. Unfortunately for anonymity, the result of temperature on clock skew can be remotely detected through observing timestamps. This attack works because existing abstract models of anonymity-network nodes do not take into account the inevitable imperfections of the hardware they run on. Furthermore, we suggest the same technique could be exploited as a classical covert channel and can even provide geolocation.
---
paper_title: Detection of Covert Channel Encoding in Network Packet Delays

paper_content:

Covert channels are mechanisms for communicating information in ways that are difficult to detect. Data exfiltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet interarrival times, not header or payload embedded information, to encode covert messages. This paper investigates the channel capacity of Internet-based timing channels and proposes a methodology for detecting covert timing channels based on how close a source comes to achieving that channel capacity. A statistical approach is then used for the special case of binary codes.
---
paper_title: Limitations of End-to-End Encryption in Secure Computer Networks

paper_content:

Abstract : End-to-end encryption is not sufficient to prevent compromise of information in a network that employs untrusted subnet (network interface) processors. Addresses, message lengths, and timing of transmissions furnish channels whose bandwidth can be significant.
---
paper_title: IP covert timing channels: design and detection

paper_content:

A network covert channel is a mechanism that can be used to leak information across a network in violation of a security policy and in a manner that can be difficult to detect. In this paper, we describe our implementation of a covert network timing channel, discuss the subtle issues that arose in its design, and present performance data for the channel. We then use our implementation as the basis for our experiments in its detection. We show that the regularity of a timing channel can be used to differentiate it from other traffic and present two methods of doing so and measures of their efficiency. We also investigate mechanisms that attackers might use to disrupt the regularity of the timing channel, and demonstrate methods of detection that are effective against them.
---
paper_title: Covert Channels in LAN Protocols

paper_content:

Encryption is generally understood as being the basic mechanisms for LAN security. However, usage of encryption finds its limitations in case of an unauthorized information flow via covert channels. Some covert storage and timing channels inherent in a LAN's architecture are already described in the literature. This paper takes a more general approach. It shows, that there is a potential of unused bandwidth in commonly used LAN protocols (IEEE 802.2, 802.3, 802.4, 802.5), which might be exploitable as covert channel. The key point is, that exploitation of this potential of unused bandwidth is not a question of a LAN's architecture, but is strongly dependent on the design of its internal interfaces and on its implementations.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Statistical covert channels through PROXY server

paper_content:

The paper is devoted to creating a covert channel through a PROXY server. The channel is based upon data permutation in server buffer using the sequence of packets coming from the router connected to the PROXY server. The resulting data flow allows to create a statistical covert channel that transfers information by manipulating expectation and dispersion of the number of increasing pairs in the sequence of network addresses.
---
paper_title: Communication using phantoms: covert channels in the Internet

paper_content:

We consider the problem of determining the transport capacity of point-to-point and broadcast channels implemented on top of a network that enforces max-min fair bandwidth allocations in its routers. Our main finding is that the use of inefficient codes to represent data that is intended to be used solely for network control operations (such as routing, sequencing, etc.), gives rise to the unintended creation of a covert channel. Sources can encode some information for their destinations into network control bits (on top of the standard method of encoding data into payload bits), by means of a mechanism which we refer to as the generation of "phantom" packets. Although phantoms provide only a marginal bandwidth increase, they could have potentially vast reaching implications in terms of security issues.
---
paper_title: Communication Through Jamming Over a Slotted ALOHA Channel

paper_content:

This correspondence derives bounds on the jamming capacity of a slotted ALOHA system. A system with n legitimate users, each with a Bernoulli arrival process is considered. Packets are temporarily stored at the corresponding user queues, and a slotted ALOHA strategy is used for packet transmissions over the shared channel. The scenario considered is that of a pair of illegitimate users that jam legitimate transmissions in order to communicate over the slotted ALOHA channel. Jamming leads to binary signaling between the illegitimate users, with packet collisions due to legitimate users treated as (multiplicative) noise in this channel. Further, the queueing dynamics at the legitimate users stochastically couples the jamming strategy used by the illegitimate users and the channel evolution. By considering various independent and identically distributed (i.i.d.) jamming strategies, achievable jamming rates over the slotted ALOHA channel are derived. Further, an upper bound on the jamming capacity over the class of all ergodic jamming policies is derived. These bounds are shown to be tight in the limit where the offered system load approaches unity.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: A covert channel in MAC protocols based on splitting algorithms

paper_content:

We investigate a covert channel implemented on top of MAC protocols that are based on splitting algorithms. Covert information is embedded in nodes' splitting decisions. The covert channel can operate in three modes. The conservative mode is the safest in the sense that use of the covert channel is undetectable. The aggressive mode generates best throughput, but is more vulnerable to detection. A strategic mode is also available which allows the covert users to make a tradeoff between detectability and covert capacity. Simulation shows that the covert throughput ranges from 0 to as high as 0.3 bits per slot, depending on various parameters. It is easy to implement and very difficult to detect.
---
paper_title: Covert Information Transmission through the Use of Standard Collision Resolution Algorithms

paper_content:

The objective of this paper is to demonstrate the potential of the wireless medium to host covert channels. We do so by considering a simple covert channel and evaluating its performance. The channel is based on the First Come First Serve (FCFS) spliting algorithm, which is a standard collision resolution algorithm [1,2] that operates in a distributed fashion and coordinates access to a standard collision channel (possibly wireless medium or multi access cable) shared by a large number of users.
---
paper_title: WLAN steganography: a first practical review

paper_content:

Two different approaches for constructing a steganographic channel in an IEEE 802.11 (WLAN) network are introduced in this paper. First test results on the reliability, undetectability and capacity of a prototypical implementation of both approaches are described and discussed.
---
paper_title: Infranet: Circumventing Web censorship and surveillance

paper_content:

An increasing number of countries and companies routinely block or monitor access to parts of the Internet. To counteract these measures, we propose Infranet, a system that enables clients to surreptitiously retrieve sensitive content via cooperating Web servers distributed across the global Internet. These Infranet servers provide clients access to censored sites while continuing to host normal uncensored content. Infranet uses a tunnel protocol that provides a covert communication channel between its clients and servers, modulated over standard HTTP transactions that resemble innocuous Web browsing. In the upstream direction, Infranet clients send covert messages to Infranet servers by associating meaning to the sequence of HTTP requests being made. In the downstream direction, Infranet servers return content by hiding censored data in uncensored images using steganographic techniques. We describe the design, a prototype implementation, security properties, and performance of Infranet. Our security analysis shows that Infranet can successfully circumvent several sophisticated censoring techniques.
---
paper_title: Deception on the Network: Thinking Differently About Covert Channels

paper_content:

The concept of covert channels has been visited frequently by academia in a quest to analyse their occurrence and prevention in trusted systems. This has lead to a wide variety of approaches being developed to prevent and identify such channels and implement applicable countermeasures. However, little of this research has actually trickled down into the field of operational security management and risk analysis. Quite recently a number of covert channels and enabling tools have appeared that did have a significant impact on the operational security of organizations. This paper identifies a number of those channels and shows the relative ease with which new ones can be devised. It identifies how risk management processes do not take this upcoming threat into account and suggests where improvements would be helpful.
---
paper_title: Application layer covert channel analysis and detection.

paper_content:

The specification of Internet protocol stack was developed to be as universal as possible, providing various optional features to the network programmers. Consequently the existent implementations of this specification use different methods to implement the same functionality. This created situation where optional fields and variables are often transmitted only to be ignored or discarded at the receiving end. It is considered that transmission of these fields significantly reduces the bandwidth available to data transfers, however the redesign of the network protocols from various reasons is considered impossible at the present time, and this downfall of Internet protocol stack is silently accepted. Since the optional fields discussed are of no real value anymore, they are often left unmonitored. This in turn allows for implementation of covert channels. ::: ::: Techniques of information hiding in covert channels have been known some time now. By definition it involves hiding information in the medium, which is not usually used for any form of information transfer. For an instance the purpose of the envelope in the standard mail communication is to enclose the message and provide space for addressing. However, even if the messages were under strict surveillance, information hidden under the stamp on the envelope could go unnoticed to the examiner. This is how covert channels operate. They use resources often perceived as safe, and unable to carry data, to hide covert payload. ::: ::: This dissertation investigated Internet protocol stack and identified Application Layer as the level most vulnerable to covert channel operations. Out of the commonly used protocols, SMTP, DNS and HTTP have been recognized as those, which may carry hidden payload in and out secure perimeters. Thus, HTTP, the protocol which is often wrongly perceived as text based information transfer protocol, due to its innocently sounding name was further investigated. Since there is no tool available on the market for HTTP monitoring, a set of test tools have been developed in this project using C# programming language, which is starting to become a new networking industry standard for application deployment. The analysis of the current trends in covert channel detection and the statistic collected on the current implementations of the protocol lead to design and implementation of suitable HTTP covert channel detection system. The system is capable of detecting most of the covert channel implementations, which do not mimic the operation of HTTP browser driven by a user. However, the experiments also proved that for a successful system to operate it must fully understand HTTP protocol, recognise signatures of different HTTP implementations and be capable of anomaly analysis.
---
paper_title: Negative Caching of DNS Queries (DNS NCACHE)

paper_content:

[RFC1034] provided a description of how to cache negative responses. It however had a fundamental flaw in that it did not allow a name server to hand out those cached responses to other resolvers, thereby greatly reducing the effect of the caching. This document addresses issues raise in the light of experience and replaces [RFC1034 Section 4.3.4].
---
paper_title: Syntax and Semantics-Preserving Application-Layer Protocol Steganography

paper_content:

Protocol steganography allows users who wish to communicate secretly to embed information within other messages and network control protocols used by common applications. This form of unobservable communication can be used as means to enhance privacy and anonymity as well as for many other purposes, ranging from entertainment to protected business communication or national defense. In this paper, we describe our approach to application-layer protocol steganography, describing how we can embed messages into a commonly used TCP/IP protocol. We also introduce the notions of syntax and semantics preservation, which ensure that messages after embedding still conform to the host protocol. Based on those concepts, we attempt to produce reasonably secure and robust stegosystems. To demonstrate the efficacy of our approach, we have implemented protocol steganography within the Secure Shell (SSH) protocol. Findings indicate that protocol steganographic system is reasonably secure if the statistical profile of the covermessages and the statistical profile of its traffic match their counterparts after embedding.
---
paper_title: File Transfer Protocol

paper_content:

This memo is the official specification of the File Transfer Protocol ::: (FTP) for the DARPA Internet community. The primary intent is to ::: clarify and correct the documentation of the FTP specification, not to ::: change the protocol. The following new optional commands are included ::: in this edition of the specification: Change to Parent Directory ::: (CDUP), Structure Mount (SMNT), Store Unique (STOU), Remove Directory ::: (RMD), Make Directory (MKD), Print Directory (PWD), and System (SYST). ::: Note that this specification is compatible with the previous edition.
---
paper_title: New security and control protocol for VoIP based on steganography and digital watermarking

paper_content:

In this paper new, lightweight security and control protocol for Voice over Internet Protocol (VoIP) service is presented. It is the alternative for the IETF's (Internet Engineering Task Force) RTCP (Real-Time Control Protocol) for real-time application's traffic. Additionally this solution offers authentication and integrity of voice send and it is capable of exchanging and verifying QoS and security parameters. It is based on two information hiding techniques: digital watermarking and steganography. That is why it does not consume additional bandwidth and the data transmitted is inseparably bound to the voice content.
---
paper_title: Research Report: Covert Channels

paper_content:

Covert channels have been topic of discussion within both academic and non-academic communities for more than two decades now. Traditionally, research on this topic focussed on storage and timing channels within singular systems. As more systems became interconnected in the last decade, the scope expanded to network-based covert channels. Numerous designs and implementations of such covert channels have been suggested, altogether leaving the world with valuable pieces of knowledge scattered around the Internet. By aggregating the essentials and representing them in a structured format, we attempt to provide clarity on the current state of research. In addition, a (non-exhaustive) overview of contemporary trends in network-based covert channels is given, explaining common channels within IP, TCP, ICMP, HTTP and DNS. Lastly, several implementations were evaluated to gain insight in their eciency and performance, and the influences to which they’re prone. We conclude that they pose a security issue that needs proper attention when defining and enforcing security policies, and expect more sophisticated covert channels to appear in the future.
---
paper_title: Detecting HTTP Tunneling Activities

paper_content:

In this paper we present a novel intrusion detection sys- tem which makes use of behavior proflles to identify HyperText Transfer Protocol (HTTP) tunneling activities. Behavior proflles correspond to inherent attributes of application network sessions. Our system evaluates network behaviors at two difierent levels: a local multi-packet level and a session level. When suspicious behav- ior is detected, a veriflcation module performs a detailed analysis of the corresponding session data. Currently, our system detects both malicious and unauthorized HTTP tunneling activities. Our experi- mental results show the efiectiveness of our system and demonstrate the validity of using packet features for anomaly detection.
---
paper_title: Web tap: detecting covert web traffic

paper_content:

As network security is a growing concern, system administrators lock down their networks by closing inbound ports and only allowing outbound communication over selected protocols such as HTTP. Hackers, in turn, are forced to find ways to communicate with compromised workstations by tunneling through web requests. While several tools attempt to analyze inbound traffic for denial-of-service and other attacks on web servers, Web Tap's focus is on detecting attempts to send significant amounts of information out via HTTP tunnels to rogue Web servers from within an otherwise firewalled network. A related goal of Web Tap is to help detect spyware programs, which often send out personal data to servers using HTTP transactions and may open up security holes in the network. Based on the analysis of HTTP traffic over a training period, we designed filters to help detect anomalies in outbound HTTP traffic using metrics such as request regularity, bandwidth usage, inter-request delay time, and transaction size. Subsequently, Web Tap was evaluated on several available HTTP covert tunneling programs as well as a test backdoor program, which creates a remote shell from outside the network to a protected machine using only outbound HTTP transactions. Web Tap's filters detected all the tunneling programs tested after modest use. Web Tap also analyzed the activity of approximately thirty faculty and students who agreed to use it as a proxy server over a 40 day period. It successfully detected a significant number of spyware and aware programs. This paper presents the design of Web Tap, results from its evaluation, as well as potential limits to Web Tap's capabilities.
---
paper_title: Covert Channel Detection in the ICMP Payload Using Support Vector Machine

paper_content:

ICMP traffic is ubiquitous to almost TCP/IP based network. As such, many network devices consider ICMP traffic to be benign and will allow it to pass through, unmolested. So, attackers can generate arbitrary information tunneling in the payload of ICMP packets. To detect a ICMP covert channel, we used SVM which has excellent performance in pattern classification problems. Our experiments showed that the proposed method could detect the ICMP covert channel from normal ICMP traffic using SVM.
---
paper_title: Security Policies and Security Models

paper_content:

We assune that the reader is familiar with the ubiquity of information in the modern world and is sympathetic with the need for restricting rights to read, add, modify, or delete information in specific contexts. This need is particularly acute for systems having computers as significant components.
---
paper_title: Information Flow Analysis of Formal Specifications

paper_content:

A method is given to enumerate the flows between variables in systems specified in a non-procedural language. It finds all flows that would exist according to a deductive theory of information flow. It is presented in the form of an attribute grammar for the specification language. The effect of system invariants is discussed.
---
paper_title: Shared resource matrix methodology: an approach to identifying storage and timing channels

paper_content:

Recognizing and dealing with storage and timing channels when performing the security analysis of a computer system is an elusive task. Methods for discovering and dealing with these channels have mostly been informal, and formal methods have been restricted to a particular specification language. A methodology for discovering storage and timing channels that can be used through all phases of the software life cycle to increase confidence that all channels have been identified is presented. The methodology is presented and applied to an example system having three different descriptions: English, formal specification, and high-order language implementation.
---
paper_title: Covert flow trees: a visual approach to analyzing covert storage channels

paper_content:

The authors introduce a technique for detecting covert storage channels using a tree structure called a covert flow tree (CFT). CFTs are used to perform systematic searches for operation sequences that allow information to be relayed through attributes and eventually detected by a listening process. When traversed, the paths of a CFT yield a comprehensive list of operation sequences which support communication via a particular resource attribute. These operation sequences are then analyzed and either discharged as benign or determined to be covert communication channels. Algorithms for automating the construction of CFTs and potential covert channel operation sequences are presented. To illustrate this technique, two example systems are analyzed and their results compared to two currently accepted analysis techniques performed on identical systems. This comparison shows that the CFT approach not only identified all covert storage channels found by the other analysis techniques, but discovered a channel not detected by the other techniques. >
---
paper_title: A lattice model of secure information flow

paper_content:

This paper investigates mechanisms that guarantee secure information flow in a computer system. These mechanisms are examined within a mathematical framework suitable for formulating the requirements of secure information flow among security classes. The central component of the model is a lattice structure derived from the security classes and justified by the semantics of information flow. The lattice properties permit concise formulations of the security requirements of different existing systems and facilitate the construction of mechanisms that enforce security. The model provides a unifying view of all systems that restrict information flow, enables a classification of them according to security objectives, and suggests some new approaches. It also leads to the construction of automatic program certification mechanisms for verifying the secure flow of information through a program.
---
paper_title: A practical approach to identifying storage and timing channels: twenty years later

paper_content:

Secure computer systems use both mandatory and discretionary access controls to restrict the flow of information through legitimate communication channels such as files, shared memory and process signals. Unfortunately, in practice one finds that computer systems are built such that users are not limited to communicating only through the intended communication channels. As a result, a well-founded concern of security-conscious system designers is the potential exploitation of system storage locations and timing facilities to provide unforeseen communication channels to users. These illegitimate channels are known as covert storage and timing channels. Prior to the presentation of this paper twenty years ago the covert channel analysis that took place was mostly ad hoc. Methods for discovering and dealing with these channels were mostly informal, and the formal methods were restricted to a particular specification language. This paper presents a methodology for discovering storage and timing channels that can be used through all phases of the software life cycle to increase confidence that all channels have been identified. In the original paper the methodology was presented and applied to an example system having three different descriptions: English, formal specification, and high order language implementation. In this paper only the English requirements are considered. However the paper also presents how the methodology has evolved and the influence it had on other work.
---
paper_title: An Integrated View of Security Analysis and Performance Evaluation: Trading QoS with Covert Channel Bandwidth

paper_content:

Security analysis and performance evaluation are two fundamental activities in the system design process, which are usually carried out separately. Unfortunately, a purely qualitative analysis of the security requirements is not sufficient in the case of real systems, as they suffer from unavoidable information leaks that need to be quantified. In this paper we propose an integrated and tool-supported methodology encompassing both activities, thus providing insights about how to trade the quality of service delivered by a system with the bandwidth of its covert channels. The methodology is illustrated by assessing the effectiveness and the efficiency of the securing strategy implemented in the NRL Pump, a trusted device proposed to secure the replication of information from a low-security level enclave to a high-security level enclave.
---
paper_title: Covert channels-here to stay?

paper_content:

We discuss the difficulties of satisfying high-assurance system requirements without sacrificing system capabilities. To alleviate this problem, we show how trade-offs can be made to reduce the threat of covert channels. We also clarify certain concepts in the theory of covert channels. Traditionally, a covert channel's vulnerability was measured by the capacity. We show why a capacity analysis alone is not sufficient to evaluate the vulnerability and introduce a new metric referred to as the "small message criterion". >
---
paper_title: Limitations of End-to-End Encryption in Secure Computer Networks

paper_content:

Abstract : End-to-end encryption is not sufficient to prevent compromise of information in a network that employs untrusted subnet (network interface) processors. Addresses, message lengths, and timing of transmissions furnish channels whose bandwidth can be significant.
---
paper_title: Reducing timing channels with fuzzy time

paper_content:

Fuzzy time is a collection of techniques that reduces the bandwidths of covert timing channels by making all clocks available to a process noisy. Developed in response to the problems posed by high-speed hardware timing channels, fuzzy time has been implemented in the VAX security kernel. Fuzzy time has proven to be highly effective against the timing channels in the VAX security kernel. Not only does fuzzy time close the high-speed channels, it does so at a much lower-than-anticipated performance cost. It is believed that the VAX security kernal managed to meet the covert channel guidelines while maintaining a good balance between security and performance. >
---
paper_title: Transport and Application Protocol Scrubbing

paper_content:

This paper describes the design and implementation of a protocol scrubber, a transparent interposition mechanism for explicitly removing network attacks at both the transport and application protocol layers. The transport scrubber supports downstream passive network-based intrusion detection systems; whereas the application scrubbing mechanism supports transparent fail-closed active network-based intrusion detection systems. The transport scrubber's role is to convert ambiguous network flows into well-behaved flows that are unequivocally interpreted by all downstream endpoints. As an example, this paper presents the implementation of a TCP/IP scrubber that eliminates insertion and evasion attacks-attacks that use ambiguities to subvert detection-on passive network-based intrusion detection systems, while preserving high performance. The application protocol scrubbing mechanism is used as a substrate for building fail-closed active network based intrusion detections systems that can respond to attacks by eluding or modifying application data flows in real-time. This paper presents the high performance implementation of a general purpose transparent application-level scrubbing toolkit in the FreeBSD kernel.
---
paper_title: Eliminating Steganography in Internet Traffic with Active Wardens

paper_content:

Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels.
---
paper_title: Covert Channels in IPv6

paper_content:

A covert channel is a communication path that allows transferring information in a way that violates a system security policy. Because of their concealed nature, detecting and preventing covert channels are obligatory security practices. In this paper, we present an examination of network storage channels in the Internet Protocol version 6 (IPv6). We introduce and analyze 22 different covert channels. In the appendix, we define three types of active wardens, stateless, stateful, and network-aware, who differ in complexity and ability to block the analyzed covert channels.
---
paper_title: Reducing timing channels with fuzzy time

paper_content:

Fuzzy time is a collection of techniques that reduces the bandwidths of covert timing channels by making all clocks available to a process noisy. Developed in response to the problems posed by high-speed hardware timing channels, fuzzy time has been implemented in the VAX security kernel. Fuzzy time has proven to be highly effective against the timing channels in the VAX security kernel. Not only does fuzzy time close the high-speed channels, it does so at a much lower-than-anticipated performance cost. It is believed that the VAX security kernal managed to meet the covert channel guidelines while maintaining a good balance between security and performance. >
---
paper_title: Covert Channel Capacity

paper_content:

Techniques for detecting covert channels are based on information flow models. This paper establishes a connection between Shannon's theory of communication and information flow models, such as the Goguen-Meseguer model, that view a reference monitor as a state-transition automaton. The channel associated with a machine and a compromise policy is defined, and the capacity of that channel is taken as a measure of covert channel information rate.
---
paper_title: Communication Through Jamming Over a Slotted ALOHA Channel

paper_content:

This correspondence derives bounds on the jamming capacity of a slotted ALOHA system. A system with n legitimate users, each with a Bernoulli arrival process is considered. Packets are temporarily stored at the corresponding user queues, and a slotted ALOHA strategy is used for packet transmissions over the shared channel. The scenario considered is that of a pair of illegitimate users that jam legitimate transmissions in order to communicate over the slotted ALOHA channel. Jamming leads to binary signaling between the illegitimate users, with packet collisions due to legitimate users treated as (multiplicative) noise in this channel. Further, the queueing dynamics at the legitimate users stochastically couples the jamming strategy used by the illegitimate users and the channel evolution. By considering various independent and identically distributed (i.i.d.) jamming strategies, achievable jamming rates over the slotted ALOHA channel are derived. Further, an upper bound on the jamming capacity over the class of all ergodic jamming policies is derived. These bounds are shown to be tight in the limit where the offered system load approaches unity.
---
paper_title: Detection of Covert Channel Encoding in Network Packet Delays

paper_content:

Covert channels are mechanisms for communicating information in ways that are difficult to detect. Data exfiltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet interarrival times, not header or payload embedded information, to encode covert messages. This paper investigates the channel capacity of Internet-based timing channels and proposes a methodology for detecting covert timing channels based on how close a source comes to achieving that channel capacity. A statistical approach is then used for the special case of binary codes.
---
paper_title: Limitations of End-to-End Encryption in Secure Computer Networks

paper_content:

Abstract : End-to-end encryption is not sufficient to prevent compromise of information in a network that employs untrusted subnet (network interface) processors. Addresses, message lengths, and timing of transmissions furnish channels whose bandwidth can be significant.
---
paper_title: Capacity estimation and auditability of network covert channels

paper_content:

Classical covert channel analysis has focused on channels available on a single computer: timing channels and storage channels. We characterize network covert channels. Potential network covert channels are exploited by modulating transmission characteristics. We distinguish between spatial covert channels, caused by a variation in the relative volume of communication between nodes in the network, and temporal covert channels caused by a variation in transmission characteristics over time, extending the work of Girling (1987). A model for obtaining a spatially neutral transmission schedule was given by Newman-Wolfe and Venkatraman (1991, 1992). Temporally neutral transmissions are characterized and scheduling policies to generate temporally neutral transmission schedules were given by Venkatraman and Newman-Wolfe (1993). We estimate the covert channel capacity using an adaptive scheduling policy, modeling the system as a mode secure system. Based on our measurements on the University of Florida campus-wide backbone network (UFNET), we discuss the auditability of network covert channels and suggest some handling policies to reduce the capacity of these covert channels to TCSEC acceptable levels. >
---
paper_title: IP covert timing channels: design and detection

paper_content:

A network covert channel is a mechanism that can be used to leak information across a network in violation of a security policy and in a manner that can be difficult to detect. In this paper, we describe our implementation of a covert network timing channel, discuss the subtle issues that arose in its design, and present performance data for the channel. We then use our implementation as the basis for our experiments in its detection. We show that the regularity of a timing channel can be used to differentiate it from other traffic and present two methods of doing so and measures of their efficiency. We also investigate mechanisms that attackers might use to disrupt the regularity of the timing channel, and demonstrate methods of detection that are effective against them.
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: Limitations of End-to-End Encryption in Secure Computer Networks

paper_content:

Abstract : End-to-end encryption is not sufficient to prevent compromise of information in a network that employs untrusted subnet (network interface) processors. Addresses, message lengths, and timing of transmissions furnish channels whose bandwidth can be significant.
---
paper_title: High level prevention of traffic analysis

paper_content:

The paper gives a mathematical model for prevention of traffic analysis in network security and suggests an approach for prevention of unauthorized release of information concerning traffic patterns. The model assumes that an eavesdropper may read the contents of all links, including the source and destination, and that all countermeasures are performed at the transport layer. The goal of the countermeasures is to prevent the eavesdropper from gaining any useful information regarding the traffic patterns in a cost efficient and feasible manner. Countermeasures performed at the transport level include encryption a limited form of message rerouting delaying messages and sending dummy messages as needed within resource capacities. By formulating the problem in terms of systems of equalities and systems of inequalities linear programming methods may be used to find solutions to the traffic analysis security problem. >
---
paper_title: Reducing timing channels with fuzzy time

paper_content:

Fuzzy time is a collection of techniques that reduces the bandwidths of covert timing channels by making all clocks available to a process noisy. Developed in response to the problems posed by high-speed hardware timing channels, fuzzy time has been implemented in the VAX security kernel. Fuzzy time has proven to be highly effective against the timing channels in the VAX security kernel. Not only does fuzzy time close the high-speed channels, it does so at a much lower-than-anticipated performance cost. It is believed that the VAX security kernal managed to meet the covert channel guidelines while maintaining a good balance between security and performance. >
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: Using covert channels to evaluate the effectiveness of flow confidentiality measures

paper_content:

With an increasing amount of Internet traffic becoming encrypted, traffic analysis attacks have become a more important topic lately. One of the most common and effective ways to prevent traffic analysis is link padding, where dummy traffic is added to hide the real traffic pattern. In principle, link padding can perfectly hide the underlying traffic. In practice however, it has been shown to be very difficult to implement correctly and has also been shown to be ineffective if not correctly implemented. In this paper we provide an information theoretic analysis of the effectiveness of a link padding implementation. We represent the imperfections of a padding implementation as a covert channel and determine the capacity of the information leakage. We show experimental results and present models that describe how practical aspects, such as cross-traffic and network congestion affect the information leakage of link padding.
---
paper_title: Transmission schedules to prevent traffic analysis

paper_content:

We propose scheduling strategies to determine transmission schedules that prevent traffic analysis and the creation of covert channels due to temporal variation in the transmission of packets. In addition to requiring the traffic matrix be neutral we require the transmission schedule be temporally neutral to eliminate that potential coved channel. The static scheduling policy generates temporally neutral transmission schedules. We extend this to develop an adaptive scheduling policy that can adapt to long term load fluctuations. The adaptive algorithm is expensive and there exists the possibility of a low bandwidth and noisy covert channel; we suggest mechanisms to reduce the bandwidth of the covert channel. The tradeoff is between the "adaptability" of the scheduling policy and the bandwidth of the covert channel. >
---
paper_title: The jamming game for packet timing channels

paper_content:

This work focuses on covert timing channels, in which information is conveyed in the timing of packets. Jamming strategies and coding strategies are developed for various timing channel models.
---
paper_title: Secure Computer Systems: Mathematical Foundations

paper_content:

This paper reports the first results of an investigation into solutions to problems of security in computer systems; it establishes the basis for rigorous investigation by providing a general descriptive model of a computer system.
---
paper_title: Automatic Covert Channel Analysis of a Multilevel Secure Component

paper_content:

The NRL Pump protocol defines a multilevel secure component whose goal is to minimize leaks of information from high level systems to lower level systems, without degrading average time performances. We define a probabilistic model for the NRL Pump and show how a probabilistic model checker (FHP-murϕ) can be used to estimate the capacity of a probabilistic covert channel in the NRL Pump. We are able to compute the probability of a security violation as a function of time for various configurations of the system parameters (e.g. buffer sizes, moving average size, etc). Because of the model complexity, our results cannot be obtained using an analytical approach and, because of the low probabilities involved, it can be hard to obtain them using a simulator.
---
paper_title: A network version of the Pump

paper_content:

A designer of reliable MLS networks must consider covert channels and denial of service attacks in addition to traditional network performance measures such as throughput, fairness, and reliability. We show how to extend the NRL data Pump to a certain MLS network architecture in order to balance the requirements of congestion control, fairness, good performance, and reliability against those of minimal threats from covert channels and denial of service attacks. We back up our claims with simulation results. >
---
paper_title: Syntax and Semantics-Preserving Application-Layer Protocol Steganography

paper_content:

Protocol steganography allows users who wish to communicate secretly to embed information within other messages and network control protocols used by common applications. This form of unobservable communication can be used as means to enhance privacy and anonymity as well as for many other purposes, ranging from entertainment to protected business communication or national defense. In this paper, we describe our approach to application-layer protocol steganography, describing how we can embed messages into a commonly used TCP/IP protocol. We also introduce the notions of syntax and semantics preservation, which ensure that messages after embedding still conform to the host protocol. Based on those concepts, we attempt to produce reasonably secure and robust stegosystems. To demonstrate the efficacy of our approach, we have implemented protocol steganography within the Secure Shell (SSH) protocol. Findings indicate that protocol steganographic system is reasonably secure if the statistical profile of the covermessages and the statistical profile of its traffic match their counterparts after embedding.
---
paper_title: Embedding Covert Channels into TCP/IP

paper_content:

It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number (ISN) or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naive embedding. Finally, we describe reversible transforms that map block cipher output onto TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden so that an attacker cannot demonstrate its existence without knowing a secret key.
---
paper_title: Network Based Detection of Passive Covert Channels in TCP/IP

paper_content:

A new method of covert channel detection in initial sequence number (ISN) of TCP/IP is proposed in the paper. The detection is based on ISN generation model of original OS. Whenever any statistical deviations of ISN network packet from the ISN model are discovered; it is considered that this ISN packet is generated by malicious software, which tries to create a covert channel. The method was tested using experimental data generated by NUSHU covert channel creation tool, which has been developed by Joanna Rutkowska
---
paper_title: Embedding Covert Channels into TCP/IP

paper_content:

It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number (ISN) or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naive embedding. Finally, we describe reversible transforms that map block cipher output onto TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden so that an attacker cannot demonstrate its existence without knowing a secret key.
---
paper_title: Application layer covert channel analysis and detection.

paper_content:

The specification of Internet protocol stack was developed to be as universal as possible, providing various optional features to the network programmers. Consequently the existent implementations of this specification use different methods to implement the same functionality. This created situation where optional fields and variables are often transmitted only to be ignored or discarded at the receiving end. It is considered that transmission of these fields significantly reduces the bandwidth available to data transfers, however the redesign of the network protocols from various reasons is considered impossible at the present time, and this downfall of Internet protocol stack is silently accepted. Since the optional fields discussed are of no real value anymore, they are often left unmonitored. This in turn allows for implementation of covert channels. ::: ::: Techniques of information hiding in covert channels have been known some time now. By definition it involves hiding information in the medium, which is not usually used for any form of information transfer. For an instance the purpose of the envelope in the standard mail communication is to enclose the message and provide space for addressing. However, even if the messages were under strict surveillance, information hidden under the stamp on the envelope could go unnoticed to the examiner. This is how covert channels operate. They use resources often perceived as safe, and unable to carry data, to hide covert payload. ::: ::: This dissertation investigated Internet protocol stack and identified Application Layer as the level most vulnerable to covert channel operations. Out of the commonly used protocols, SMTP, DNS and HTTP have been recognized as those, which may carry hidden payload in and out secure perimeters. Thus, HTTP, the protocol which is often wrongly perceived as text based information transfer protocol, due to its innocently sounding name was further investigated. Since there is no tool available on the market for HTTP monitoring, a set of test tools have been developed in this project using C# programming language, which is starting to become a new networking industry standard for application deployment. The analysis of the current trends in covert channel detection and the statistic collected on the current implementations of the protocol lead to design and implementation of suitable HTTP covert channel detection system. The system is capable of detecting most of the covert channel implementations, which do not mimic the operation of HTTP browser driven by a user. However, the experiments also proved that for a successful system to operate it must fully understand HTTP protocol, recognise signatures of different HTTP implementations and be capable of anomaly analysis.
---
paper_title: Capacity estimation and auditability of network covert channels

paper_content:

Classical covert channel analysis has focused on channels available on a single computer: timing channels and storage channels. We characterize network covert channels. Potential network covert channels are exploited by modulating transmission characteristics. We distinguish between spatial covert channels, caused by a variation in the relative volume of communication between nodes in the network, and temporal covert channels caused by a variation in transmission characteristics over time, extending the work of Girling (1987). A model for obtaining a spatially neutral transmission schedule was given by Newman-Wolfe and Venkatraman (1991, 1992). Temporally neutral transmissions are characterized and scheduling policies to generate temporally neutral transmission schedules were given by Venkatraman and Newman-Wolfe (1993). We estimate the covert channel capacity using an adaptive scheduling policy, modeling the system as a mode secure system. Based on our measurements on the University of Florida campus-wide backbone network (UFNET), we discuss the auditability of network covert channels and suggest some handling policies to reduce the capacity of these covert channels to TCSEC acceptable levels. >
---
paper_title: Detection of Covert Channel Encoding in Network Packet Delays

paper_content:

Covert channels are mechanisms for communicating information in ways that are difficult to detect. Data exfiltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet interarrival times, not header or payload embedded information, to encode covert messages. This paper investigates the channel capacity of Internet-based timing channels and proposes a methodology for detecting covert timing channels based on how close a source comes to achieving that channel capacity. A statistical approach is then used for the special case of binary codes.
---
paper_title: IP covert timing channels: design and detection

paper_content:

A network covert channel is a mechanism that can be used to leak information across a network in violation of a security policy and in a manner that can be difficult to detect. In this paper, we describe our implementation of a covert network timing channel, discuss the subtle issues that arose in its design, and present performance data for the channel. We then use our implementation as the basis for our experiments in its detection. We show that the regularity of a timing channel can be used to differentiate it from other traffic and present two methods of doing so and measures of their efficiency. We also investigate mechanisms that attackers might use to disrupt the regularity of the timing channel, and demonstrate methods of detection that are effective against them.
---
paper_title: WLAN steganography: a first practical review

paper_content:

Two different approaches for constructing a steganographic channel in an IEEE 802.11 (WLAN) network are introduced in this paper. First test results on the reliability, undetectability and capacity of a prototypical implementation of both approaches are described and discussed.
---

Title: A survey of covert channels and countermeasures in computer network protocols

Section 1: APPLICATION SCENARIOS
Description 1: Describe various situations and motivations where covert channels are used and the different entities that might employ them.

Section 2: TERMINOLOGY AND COMMUNICATION MODEL
Description 2: Define key terms related to covert channels and explain the basic communication principles and models used to understand covert channels.

Section 3: THE PRISONER PROBLEM
Description 3: Discuss the prisoner problem, which is the de-facto model for covert channel communication, including its implications and typical use cases.

Section 4: COMMUNICATION SCENARIOS
Description 4: Outline different scenarios for covert communication, explaining the roles of senders and receivers, and the types of overt channels manipulated.

Section 5: COVERT CHANNELS
Description 5: Provide an overview and detailed descriptions of existing covert channel techniques in computer network protocols, grouped by their mechanisms.

Section 6: UNUSED HEADER BITS
Description 6: Explain how unused or reserved bits in frame or packet headers are used to create covert channels and provide examples.

Section 7: HEADER EXTENSIONS AND PADDING
Description 7: Describe techniques that use header extensions and padding to transmit covert data and discuss their implications.

Section 8: IP IDENTIFICATION AND FRAGMENT OFFSET
Description 8: Discuss how the IP Identification and Fragment Offset fields in the IP header can be exploited for covert communication.

Section 9: TCP INITIAL SEQUENCE NUMBER FIELD
Description 9: Explain techniques that use the TCP Initial Sequence Number field to establish covert channels, including direct and indirect methods.

Section 10: CHECKSUM FIELD
Description 10: Describe how the checksum fields in IP or TCP headers can be modified to encode covert information.

Section 11: MODULATING THE IP TIME TO LIVE FIELD
Description 11: Explain methods for embedding covert information into the IP Time to Live (TTL) field and their effectiveness.

Section 12: MODULATING ADDRESS FIELDS AND PACKET LENGTHS
Description 12: Discuss techniques that transmit covert information by modulating address fields and packet lengths in network protocols.

Section 13: MODULATING TIMESTAMP FIELDS
Description 13: Describe how timestamp fields are used to embed covert information and the impact on protocol behavior.

Section 14: PACKET RATE/TIMING
Description 14: Explain covert channels that encode information by varying packet rates and timing, detailing the mechanisms and challenges.

Section 15: MESSAGE SEQUENCE TIMING
Description 15: Discuss the creation of covert channels by modulating the timing of message sequences in network protocols.

Section 16: PACKET LOSS AND PACKET SORTING
Description 16: Describe methods that use intentional packet loss and packet sorting to transmit covert information.

Section 17: FRAME COLLISIONS
Description 17: Explain the exploitation of network frame collisions to establish covert channels and their applicability in various network protocols.

Section 18: AD-HOC ROUTING PROTOCOLS
Description 18: Discuss covert channels in ad-hoc routing protocols, including methods for encoding information in routing messages.

Section 19: WIRELESS LAN (WLAN)
Description 19: Describe covert channels in Wireless LAN protocols, including methods of embedding data in WLAN-specific fields.

Section 20: HYPERTEXT TRANSFER PROTOCOL (HTTP)
Description 20: Explain how covert channels are established within HTTP traffic and the use of HTTP requests and responses to transmit covert data.

Section 21: DOMAIN NAME SYSTEM (DNS) PROTOCOL
Description 21: Discuss the use of the DNS protocol to create covert channels, including tunneling techniques and data encoding methods.

Section 22: OTHER APPLICATION PROTOCOLS
Description 22: Describe the use of covert channels in various other application protocols, such as VoIP, SSH, and FTP.

Section 23: PAYLOAD TUNNELING
Description 23: Explain payload tunneling techniques that embed one protocol within another to create covert channels, focusing on protocol specifics and effectiveness.

Section 24: COVERT CHANNEL COUNTERMEASURES
Description 24: Provide an overview of countermeasures against covert channels, including identification, elimination, capacity limitation, auditing, and documentation.

Section 25: CONCLUSIONS AND FUTURE WORK
Description 25: Summarize the key findings of the survey, outline the challenges in mitigating covert channels, and suggest directions for future research.