Covert channels and countermeasures in computer network protocols [Reprinted from IEEE Communications Surveys and Tutorials]
---
paper_title: A note on the confinement problem

paper_content:

onfining a program during its execution so that it cannot transmit information to any other program except its caller. A set of examples attempts to stake out the boundaries of the problem. Necessary conditions for a solution are stated and informally justified.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Covert Channels in LAN's

paper_content:

An information transfer path that allows information to be transferred in a manner that violates the security policy of a trusted network is called a covert channel.
---
paper_title: Information hiding—A survey

paper_content:

Information-hiding techniques have recently become important in a number of application areas. Digital audio, video, and pictures are increasingly furnished with distinguishing but imperceptible marks, which may contain a hidden copyright notice or serial number or even help to prevent unauthorized copying directly. Military communications systems make increasing use of traffic security techniques which, rather than merely concealing the content of a message using encryption, seek to conceal its sender, its receiver, or its very existence. Similar techniques are used in some mobile phone systems and schemes proposed for digital elections. Criminals try to use whatever traffic security properties are provided intentionally or otherwise in the available communications systems, and police forces try to restrict their use. However, many of the techniques proposed in this young and rapidly evolving field can trace their history back to antiquity, and many of them are surprisingly easy to circumvent. In this article, we try to give an overview of the field, of what we know, what works, what does not, and what are the interesting topics for research.
---
paper_title: 20 years of covert channel modeling and analysis

paper_content:

Covert channels emerged in mystery and departed in confusion. Covert channels are a means of communication between two processes that are not permitted to communicate, but do so anyway, a few bits at a time, by affecting shared resources. Information hiding is slightly different: the two communicating parties are allowed to talk, but the content is censored and restricted to certain subjects. The trick is to "piggyback" some contraband data invisibly on the legitimate content. The canonical example of this is to use the low-order two bits of each pixel in a picture for your secret message, since no one would notice if they were changed. When a similar idea was applied to smuggle information in network headers, we called it a network covert channel, mostly because the term "information hiding" hadn't been invented yet. The article traces the history of covert channel modeling from 1980 to the present (1999).
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: On Public-Key Steganography in the Presence of an Active Warden

paper_content:

The so-called prisoners’ problem, in which two individuals attempt to communicate covertly without alerting a “warden” who controls the communications channel, has taken a number of forms, adorned with various assumptions or requirements which make the problem more or less difficult. One assumption which makes the problem considerably more managable is that the participants are allowed to share some secret information (such as an encryption key) prior to imprisonment. Another assumption, which makes the problem much more difficult, is that the warden be allowed to modify messages sent between the prisoners as well as read them. This paper describes techniques for pure steganography, in which no secret information needs to be shared before imprisonment. First, a modification of an existing protocol will be shown to admit pure steganography if the warden is not allowed to modify the contents of the channel. Then, a technique will be described that allows pure steganography between two prisoners in the presence in the presence of an active (content-modifying) warden.
---
paper_title: The Prisoners’ Problem and the Subliminal Channel

paper_content:

Two accomplices in a crime have been arrested and are about to be locked in widely separated cells. Their only means of communication after they are locked up will he by way of messages conveyed for them by trustees -- who are known to be agents of the warden. The warden is willing to allow the prisoners to exchange messages in the hope that he can deceive at least one of them into accepting as a genuine communication from the other either a fraudulent message created by the warden himself or else a modification by him of a genuine message. However, since he has every reason to suspect that the prisoners want to coordinate an escape plan, the warden will only permit the exchanges to occur if the information contained in the messages is completely open to him -- and presumably innocuous. The prisoners, on the other hand, are willing to accept these conditions, i.e., to accept some risk of deception in order to be able to communicate at all, since they need to coordinate their plans. To do this they will have to deceive the warden by finding a way of communicating secretly in the exchanges, i.e., of establishing a “subliminal channel” between them in full view of the warden, even though the messages themselves contain no secret (to the warden) information‡. Since they anticipate that the warden will try to deceive them by introducing fraudulent messages, they will only exchange messages if they are permitted to authenticate them.
---
paper_title: Syntax and Semantics-Preserving Application-Layer Protocol Steganography

paper_content:

Protocol steganography allows users who wish to communicate secretly to embed information within other messages and network control protocols used by common applications. This form of unobservable communication can be used as means to enhance privacy and anonymity as well as for many other purposes, ranging from entertainment to protected business communication or national defense. In this paper, we describe our approach to application-layer protocol steganography, describing how we can embed messages into a commonly used TCP/IP protocol. We also introduce the notions of syntax and semantics preservation, which ensure that messages after embedding still conform to the host protocol. Based on those concepts, we attempt to produce reasonably secure and robust stegosystems. To demonstrate the efficacy of our approach, we have implemented protocol steganography within the Secure Shell (SSH) protocol. Findings indicate that protocol steganographic system is reasonably secure if the statistical profile of the covermessages and the statistical profile of its traffic match their counterparts after embedding.
---
paper_title: Hiding Data in the OSI Network Model

paper_content:

Rather than searching for the holy grail of steganography, this paper presents the basis for development of a tool kit for creating and exploiting hidden channels within the standard design of network communications protocols. The Alice and Bob analogy, derived from cryptology, is used to present network protocols in a way that more clearly defines the problem. Descriptions of typical hidden channel design for each layer of the Open Systems Interconnect (OSI) network model are given. Methods of hiding and detection probabilities are summarized. Denying Bob and Alice the ability to communicate electronically may be the only absolute solution.
---
paper_title: Embedding Covert Channels into TCP/IP

paper_content:

It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number (ISN) or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naive embedding. Finally, we describe reversible transforms that map block cipher output onto TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden so that an attacker cannot demonstrate its existence without knowing a secret key.
---
paper_title: The Pump: a decade of covert fun

paper_content:

This paper traces the ten plus year history of the Naval Research Laboratory's Pump idea. The Pump was theorized, designed, and built at the Naval Research Laboratory's Center for High Assurance Computer Systems. The reason for the Pump is the need to send messages from a "low" enclave to a "high" enclave, in a secure and reliable manner. In particular, the Pump was designed to minimize the covert channel threat from the necessary message acknowledgements, without penalizing system performance and reliability. We review the need for the Pump, the design of the Pump, the variants of the Pump, and the current status of the Pump, along with manufacturing and certification difficulties
---
paper_title: Covert channels-here to stay?

paper_content:

We discuss the difficulties of satisfying high-assurance system requirements without sacrificing system capabilities. To alleviate this problem, we show how trade-offs can be made to reduce the threat of covert channels. We also clarify certain concepts in the theory of covert channels. Traditionally, a covert channel's vulnerability was measured by the capacity. We show why a capacity analysis alone is not sufficient to evaluate the vulnerability and introduce a new metric referred to as the "small message criterion". >
---
paper_title: Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics

paper_content:

A fundamental problem for network intrusion detection systems is the ability of a skilled attacker to evade detection by exploiting ambiguities in the traffic stream as seen by the monitor. We discuss the viability of addressing this problem by introducing a new network forwarding element called a traffic normalizer. The normalizer sits directly in the path of traffic into a site and patches up the packet stream to eliminate potential ambiguities before the traffic is seen by the monitor, removing evasion opportunities. We examine a number of tradeoffs in designing a normalizer, emphasizing the important question of the degree to which normalizations undermine end-to-end protocol semantics. We discuss the key practical issues of "cold start" and attacks on the normalizer, and develop a methodology for systematically examining the ambiguities present in a protocol based on walking the protocol's header. We then present norm, a publicly available user-level implementation of a normalizer that can normalize a TCP traffic stream at 100,000 pkts/sec in memory-to-memory copies, suggesting that a kernel implementation using PC hardware could keep pace with a bidirectional 100 Mbps link with sufficient headroom to weather a high-speed flooding attack of small packets.
---
paper_title: Transmission schedules to prevent traffic analysis

paper_content:

We propose scheduling strategies to determine transmission schedules that prevent traffic analysis and the creation of covert channels due to temporal variation in the transmission of packets. In addition to requiring the traffic matrix be neutral we require the transmission schedule be temporally neutral to eliminate that potential coved channel. The static scheduling policy generates temporally neutral transmission schedules. We extend this to develop an adaptive scheduling policy that can adapt to long term load fluctuations. The adaptive algorithm is expensive and there exists the possibility of a low bandwidth and noisy covert channel; we suggest mechanisms to reduce the bandwidth of the covert channel. The tradeoff is between the "adaptability" of the scheduling policy and the bandwidth of the covert channel. >
---
paper_title: The Pump: a decade of covert fun

paper_content:

This paper traces the ten plus year history of the Naval Research Laboratory's Pump idea. The Pump was theorized, designed, and built at the Naval Research Laboratory's Center for High Assurance Computer Systems. The reason for the Pump is the need to send messages from a "low" enclave to a "high" enclave, in a secure and reliable manner. In particular, the Pump was designed to minimize the covert channel threat from the necessary message acknowledgements, without penalizing system performance and reliability. We review the need for the Pump, the design of the Pump, the variants of the Pump, and the current status of the Pump, along with manufacturing and certification difficulties
---
paper_title: Embedding Covert Channels into TCP/IP

paper_content:

It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number (ISN) or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naive embedding. Finally, we describe reversible transforms that map block cipher output onto TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden so that an attacker cannot demonstrate its existence without knowing a secret key.
---

Title: Covert Channels and Countermeasures in Computer Network Protocols 

Section 1: INTRODUCTION
Description 1: Introduce the concept of covert channels and their significance in computer network protocols. Discuss the basis of covert channels, their increasing potential due to high-speed network technologies, their similarities to steganography, and the need to develop countermeasures.

Section 2: APPLICATION SCENARIOS
Description 2: Present various scenarios where covert channels can be utilized, such as by government agencies, hackers, and corporate spies. Discuss their use in evading detection and censorship, and the motivations behind employing such channels.

Section 3: TERMINOLOGY AND COMMUNICATION MODEL TERMINOLOGY
Description 3: Define key terms and concepts used in the context of covert channels, including distinctions between storage channels and timing channels.

Section 4: THE PRISONER PROBLEM
Description 4: Explain the prisoner problem by Simmons, which serves as the basic model for covert channel communication, and outline the different types of wardens encountered in this scenario.

Section 5: COMMUNICATION SCENARIOS
Description 5: Delve into various communication scenarios for covert communication, including overt and covert sender/receiver dynamics and the roles of middlemen in manipulating overt channels.

Section 6: COVERT CHANNELS
Description 6: Provide an overview of existing covert channel techniques, illustrating with examples and types, such as unused header bits, optional header fields, semantic overloading of header fields, and more.

Section 7: COVERT CHANNEL COUNTERMEASURES
Description 7: Discuss ways to identify, eliminate, and limit the capacity of covert channels. Highlight the challenges, possible impacts on system efficiency, and auditing for deterrence.

Section 8: ELIMINATING COVERT CHANNELS
Description 8: Explain specific methods for eliminating covert channels, such as securing hosts, blocking susceptible protocols, normalizing protocol headers, and preventing IP source address spoofing.

Section 9: LIMITING COVERT CHANNEL CAPACITY
Description 9: Explore strategies to limit the capacity of covert channels, including limiting address spaces, introducing packet/message noise, and fixing packet rates to reduce timing channels.

Section 10: AUDITING COVERT CHANNELS
Description 10: Explain the methods for auditing and detecting covert channels based on nonstandard or abnormal behavior, and describe the proposed detection methods for various types of channels.

Section 11: CONCLUSIONS AND FUTURE WORK
Description 11: Summarize the findings on covert channels and countermeasures, identify the limitations of current approaches, and suggest directions for future research to improve detection and elimination techniques.