Abstract
Covert channels enable stealthy communications over innocent appearing carriers. They are increasingly applied in the network context. However, little work is available that exploits cryptographic primitives in the networking context to establish such covert communications. We present a covert channel between two devices where one device authenticates itself with Lamport’s one-time passwords based on a cryptographic hash function. Our channel enables plausible deniability jointly with reversibility and is applicable in different contexts, such as traditional TCP/IP networks, CPS/IoT communication, blockchain-driven systems and local inter-process communications that apply hash chains. We also present countermeasures to detect the presence of such a covert channel, which are non-trivial because hash values are random-looking binary strings, so that deviations are not likely to be detected. We report on experimental results with MD5 and SHA-3 hash functions for two covert channel variants running in a localhost setup. In particular, we evaluate the channels’ time performance, conduct statistical tests using the NIST suite and run a test for matching hash values between legitimate and covert environments to determine our channels’ stealthiness.
Highlights
A covert channel (CC) is an unforeseen communication channel in a system design.While the first covert channels for local computers were described in the 1970s, the research of recent decades has discovered a plethora of new and sophisticated covert channels that aid the secret exchange of information between hosts, databases, network hosts and IoT devices
We present the first CC that exploits cryptographic hash chains, which have become popular because some form is used in cryptocurrencies, they had been used much earlier, e.g., by Lamport [2]
The exploitation of hash chains for covert channels is an attractive goal for attackers in several domains
Summary
A covert channel (CC) is an unforeseen communication channel in a system design. While the first covert channels for local computers were described in the 1970s (cf. [1]), the research of recent decades has discovered a plethora of new and sophisticated covert channels that aid the secret exchange of information between hosts, databases, network hosts and IoT devices. While the first covert channels for local computers were described in the 1970s (cf [1]), the research of recent decades has discovered a plethora of new and sophisticated covert channels that aid the secret exchange of information between hosts, databases, network hosts and IoT devices. Due to their stealthy and policy-breaking nature, covert channels enable several actions related to cybercrime, such as the secret extraction of confidential information, barely detectable botnet command and control channels, and unobservable communication for cybercriminals. Our covert channels can be considered an example of plausible deniability: Alice communicates with Bob over the covert channel Both can state that every possible hash value is likely to occur. We perform experiments with MD5 and SHA-3 as cryptographic hash functions in Lamport’s application of hash chains as one-time passwords, and give experimental results on the performance and detectability of CC use
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
