Towards Reversible Storage Network Covert Channels

Mazurczyk, Wojciech; Szary, Przemysław; Wendzel, Steffen; Caviglione, Luca

doi:10.1145/3339252.3341493

Cited by 22 publications

(19 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Network covert channels are hidden communication paths allowing two remote endpoints to exchange information [42]. To this aim, the attacker manipulates specific behaviors of the traffic (e.g., the inter-packet time or the throughput) as to encode a secret [83] or injects a secret in the protocol data unit (e.g., in the unused fields of the header [85] or in the payload field [86]).…”

Section: Network Covert Channelsmentioning

confidence: 99%

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

Caviglione

Choraś

Corona³

et al. 2021

IEEE Access

Self Cite

100

View full text Add to dashboard Cite

Section: Network Covert Channelsmentioning

confidence: 99%

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

Caviglione

Choraś

Corona³

et al. 2021

IEEE Access

Self Cite

100

View full text Add to dashboard Cite

“…Being able to deploy wardens for protecting large-scale networks or running sophisticated detection software while delivering satisfactory performances could be unfeasible for small-medium actors. Therefore, a relevant effort should be done to explore Warden-as-a-Service approaches [3,4]; • reversibility: in reversible network covert channels, the two secret endpoints communicating are able to "restore" the traffic to its original form (i.e., before the injection of the hidden data) in order to avoid detection [67,68]. To spot this class of emerging threats, the warden should collect the traffic in different portions of the network and do some form of comparison.…”

Section: Trends and Challengesmentioning

confidence: 99%

Trends and Challenges in Network Covert Channels Countermeasures

Caviglione

2021

Applied Sciences

Self Cite

View full text Add to dashboard Cite

Network covert channels are increasingly used to endow malware with stealthy behaviors, for instance to exfiltrate data or to orchestrate nodes of a botnet in a cloaked manner. Unfortunately, the detection of such attacks is difficult as network covert channels are often characterized by low data rates and defenders do not know in advance where the secret information has been hidden. Moreover, neutralization or mitigation are hard tasks, as they require to not disrupt legitimate flows or degrade the quality perceived by users. As a consequence, countermeasures are tightly coupled to specific channel architectures, leading to poorly generalizable and often scarcely scalable approaches. In this perspective, this paper investigates trends and challenges in the development of countermeasures against the most popular network covert channels. To this aim, we reviewed the relevant literature by considering approaches that can be effectively deployed to detect general injection mechanisms or threats observed in the wild. Emphasis has been put on enlightening trajectories that should be considered when engineering mitigation techniques or planning the research to face the increasing wave of information-hiding-capable malware. Results indicate that many works are extremely specialized and an effective strategy for taming security risks caused by network covert channels may benefit from high-level and general approaches. Moreover, mechanisms to prevent the exploitation of ambiguities should be already considered in early design phases of both protocols and services.

show abstract

“…In man-in-the-middle scenarios, reversibility enables covert receivers to forward non-modified, i.e., innocent, original data to the overt receiver. As shown by Mazurczyk et al, reversibility is feasible for network covert channels: full reversibility refers to covert channels where the original carrier data can be restored completely, while quasireversibility refers to those covert channels that allow only the partial reconstruction of the original data [11]. Different categories of reversible data hiding are feasible.…”

Section: Fundamentalsmentioning

confidence: 99%

“…Different categories of reversible data hiding are feasible. In our case, intrinsic data-hiding is applied, in which the covert receiver is able to achieve full reversibility without guessing (implicit reversibility techniques) or embedding of additional information that describe the original message (explicit reversibility techniques) [11].…”

Section: Fundamentalsmentioning

confidence: 99%

See 1 more Smart Citation

Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains

Keller

Wendzel

2021

Applied Sciences

Self Cite

View full text Add to dashboard Cite

Covert channels enable stealthy communications over innocent appearing carriers. They are increasingly applied in the network context. However, little work is available that exploits cryptographic primitives in the networking context to establish such covert communications. We present a covert channel between two devices where one device authenticates itself with Lamport’s one-time passwords based on a cryptographic hash function. Our channel enables plausible deniability jointly with reversibility and is applicable in different contexts, such as traditional TCP/IP networks, CPS/IoT communication, blockchain-driven systems and local inter-process communications that apply hash chains. We also present countermeasures to detect the presence of such a covert channel, which are non-trivial because hash values are random-looking binary strings, so that deviations are not likely to be detected. We report on experimental results with MD5 and SHA-3 hash functions for two covert channel variants running in a localhost setup. In particular, we evaluate the channels’ time performance, conduct statistical tests using the NIST suite and run a test for matching hash values between legitimate and covert environments to determine our channels’ stealthiness.

show abstract

Towards Reversible Storage Network Covert Channels

Cited by 22 publications

References 16 publications

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

Trends and Challenges in Network Covert Channels Countermeasures

Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains

Contact Info

Product

Resources

About