CoCo: Coding-Based Covert Timing Channels for Network Flows

Houmansadr, Amir; Borisov, Nikita

doi:10.1007/978-3-642-24178-9_22

Cited by 33 publications

(32 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…inter-packet delays. In [13], the authors present the CoCo covert channel which modulates the covert message in the inter-packet delays of the network flows, with a coding algorithm that is used to ensure the robustness of the covert message to different perturbations.…”

Section: Related Workmentioning

confidence: 99%

A Novel Class of Robust Covert Channels Using Out-of-Order Packets

El-Atawy

Duan

Al-Shaer

2017

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Covert channels are usually used to circumvent security policies and allow information leakage without being observed.In this paper, we propose a novel covert channel technique using the packet reordering phenomenon as a host for carrying secret communications. Packet reordering is a common phenomenon on the Internet. Moreover, it is handled transparently from the user and application-level processes. This makes it an attractive medium to exploit for sending hidden signals to receivers by dynamically manipulating packet order in a network flow. In our approach, specific permutations of successive packets are selected to enhance the reliability of the channel, while the frequency distribution of their usage is tuned to increase stealthiness by imitating real Internet traffic. It is very expensive for the adversary to discover the covert channel due to the tremendous overhead to buffer and sort the packets among huge amount of background traffic. A simple tool is implemented to demonstrate this new channel. We studied extensively the robustness and capabilities of our proposed channel using both simulation and experimentation over large varieties of traffic characteristics. The reliability and capacity of this technique have shown promising results. We also investigated a practical mechanism for distorting and potentially preventing similar novel channels.Index Terms-covert channels, data-hiding, packet reordering, packet sequence, protocol-based steganography.

show abstract

Section: Related Workmentioning

confidence: 99%

A Novel Class of Robust Covert Channels Using Out-of-Order Packets

El-Atawy

Duan

Al-Shaer

2017

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

show abstract

“…Network covert channels have been demonstrated that are provably undetectable from normal "overt" traffic [25]. Such channels are comprised of a sender process exfiltrating secret data through inter-packet timing or packet sizes, for example.…”

Section: Formal Model For Covert Channelsmentioning

confidence: 99%

Understanding contention-based channels and using them for defense

Hunger

Kazdagli

Rawat

et al. 2015

2015 IEEE 21st International Symposium on High Performance Computer Architecture (HPCA)

View full text Add to dashboard Cite

Microarchitectural resources such as caches and predictors can be used to leak information across security domains. Significant prior work has demonstrated attacks and defenses for specific types of such microarchitectural side and covert channels. In this paper, we introduce a general mathematical study of microarchitectural channels using information theory. Our conceptual contribution is a simple mathematical abstraction that captures the common characteristics of all microarchitectural channels. We call this the Bucket model and it reveals that microarchitectural channels are fundamentally different from side and covert channels in networking.We then quantify the communication capacity of several microarchitectural covert channels (including channels that rely on performance counters, AES hardware and memory buses) and measure bandwidths across both KVM based heavy-weight virtualization and light-weight operating-system level isolation. We demonstrate channel capacities that are orders of magnitude higher compared to what was previously considered possible.Finally, we introduce a novel way of detecting intelligent adversaries that try to hide while running covert channel eavesdropping attacks. Our method generalizes a prior detection scheme (that modeled static adversaries) by introducing noise that hides the detection process from an intelligent eavesdropper. 639978-1-4799-8930-0/15/$31.00 ©2015 IEEE

show abstract

“…The goal of a covert channel is to conceal the very existence of a covert message by communicating it through legitimate channels [16].…”

Section: Related Workmentioning

confidence: 99%

“…Another difference is that with Jitterbug the receiver must be able to intercept network traffic, while our approach can be used by any unprivileged user. CoCo, introduced in [16] by Houmansadr et al, is a framework for establishing covert channels via inter-packet delays. The sender generates a traffic flow directed to the receiver, then manipulates the flow according to the covert message and a key, shared between the two parties.…”

Section: Related Workmentioning

confidence: 99%

Covert ephemeral communication in named data networking

Ambrosin

Conti

Gasti

et al. 2014

Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security

View full text Add to dashboard Cite

Abstract-In the last decade, there has been a growing realization that the current Internet Protocol is reaching the limits of its senescence. This has prompted several research efforts that aim to design potential next-generation Internet architectures. Named Data Networking (NDN), an instantiation of the contentcentric approach to networking, is one such effort. In contrast with IP, NDN routers maintain a significant amount of userdriven state. In this paper we investigate how to use this state for covert ephemeral communication (CEC). CEC allows two or more parties to covertly exchange ephemeral messages, i.e., messages that become unavailable after a certain amount of time. Our techniques rely only on network-layer, rather than application-layer, services. This makes our protocols robust, and communication difficult to uncover. We show that users can build high-bandwidth CECs exploiting features unique to NDN: innetwork caches, routers' forwarding state and name matching rules. We assess feasibility and performance of proposed cover channels using a local setup and the official NDN testbed.

show abstract

CoCo: Coding-Based Covert Timing Channels for Network Flows

Cited by 33 publications

References 15 publications

A Novel Class of Robust Covert Channels Using Out-of-Order Packets

A Novel Class of Robust Covert Channels Using Out-of-Order Packets

Understanding contention-based channels and using them for defense

Covert ephemeral communication in named data networking

Contact Info

Product

Resources

About