1. Covert Channels Drew Hintz

2. At A Glance Definitions Who are you? Who are “they”? A Couple Good Solutions A Couple Really Good Solutions Demo Tool

3. Definitions Steganography vs. Covert Channel

4. Steganography the art of communication through obscurity High Tech: flipping the low two bits in a jpeg Low Tech: Shaving your Head Getting a tattoo Growing your hair back

5. Covert Channel Subcategory of Stego –Communication Stream between hosts –Sent in the open/open for eavesdropping –Uses common internet protocols in imaginative ways

6. Who Are You? FUD Trojan Horses

7. Who are “they”? Dedicated Observer –All portions of traffic closely monitored –Are aware of all the tricks in the book Casual Observer –Automated systems sifting on keywords –Focusing mainly on Payload

8. How covert is covert-enough? Semi-Covert: Fooling the Casual Observer –Security through obscurity –Breaks common implementation standards –Assumes “they” won’t bother looking Truly Covert: Fooling Everyone –Traffic appears normal –Does not stray from common implementation –Will work even if “they” know the procedure used

9. Methods in General Uses some amount of cover/permissible traffic Sender embeds covert message outbound Client receives traffic, retrieves message

10. A simple example Dick wants to send a message to Jane FTPs Jane a couple of old vacation pictures And encodes the secret formula for coke bit by bit using the PSH flag

11. Rating A Method Fault Tolerance Bandwidth Ease of Detection

12. Rating the PSH Example Fault Tolerance –IP Header may be rewritten by firewalls Bandwidth –Poor: one bit per packet Detection –Easy: PSH rarely used –ENTER SNORT RULE HERE

13. Semi-Covert Channels IP Identification Field TCP Checksum

14. What it is: –2 byte sum of the contents of the TCP packet How it’s exploited –YOU TELL ME

15. Details of How the TCP Checksum Works

16. Rating of TCP Checksum You tell me

17. IP Identification Field What it is –2 byte number in IP Header –Unique number assigned to each packet –Used in reassembling fragments How It’s Exploited –Straight encoding of message into field

18. IP ID Field Rating Fault Tolerance –Can get rewritten by NAT/Firewalls Bandwidth –Good: 2 Byte number on each packet Ease of Detection –Good Depending on Sender OS –Some OSs will increment each ID per session

19. Covert Channels TCP Timestamp ISN Field Method Addon: ISN Bounce