Covert Channels Drew Hintz

At A Glance Definitions Who are you? Who are “they”? A Couple Good Solutions A Couple Really Good Solutions Demo Tool

Definitions Steganography vs. Covert Channel

Steganography the art of communication through obscurity High Tech: flipping the low two bits in a jpeg Low Tech: Shaving your Head Getting a tattoo Growing your hair back

Covert Channel Subcategory of Stego –Communication Stream between hosts –Sent in the open/open for eavesdropping –Uses common internet protocols in imaginative ways

Who Are You? FUD Trojan Horses

Who are “they”? Dedicated Observer –All portions of traffic closely monitored –Are aware of all the tricks in the book Casual Observer –Automated systems sifting on keywords –Focusing mainly on Payload

How covert is covert-enough? Semi-Covert: Fooling the Casual Observer –Security through obscurity –Breaks common implementation standards –Assumes “they” won’t bother looking Truly Covert: Fooling Everyone –Traffic appears normal –Does not stray from common implementation –Will work even if “they” know the procedure used

Methods in General Uses some amount of cover/permissible traffic Sender embeds covert message outbound Client receives traffic, retrieves message

A simple example Dick wants to send a message to Jane FTPs Jane a couple of old vacation pictures And encodes the secret formula for coke bit by bit using the PSH flag

Rating A Method Fault Tolerance Bandwidth Ease of Detection

Rating the PSH Example Fault Tolerance –IP Header may be rewritten by firewalls Bandwidth –Poor: one bit per packet Detection –Easy: PSH rarely used –ENTER SNORT RULE HERE

Semi-Covert Channels IP Identification Field TCP Checksum

What it is: –2 byte sum of the contents of the TCP packet How it’s exploited –YOU TELL ME

Details of How the TCP Checksum Works

Rating of TCP Checksum You tell me

IP Identification Field What it is –2 byte number in IP Header –Unique number assigned to each packet –Used in reassembling fragments How It’s Exploited –Straight encoding of message into field

IP ID Field Rating Fault Tolerance –Can get rewritten by NAT/Firewalls Bandwidth –Good: 2 Byte number on each packet Ease of Detection –Good Depending on Sender OS –Some OSs will increment each ID per session

Covert Channels TCP Timestamp ISN Field Method Addon: ISN Bounce