Covert Channel Attacks Research Articles

Strong leakage-resilient encryption: enhancing data confidentiality by hiding partial ciphertext

Leakage-resilient encryption is a powerful tool to protect data confidentiality against side channel attacks. In this work, we introduce a new and strong leakage setting to counter backdoor (or Trojan horse) plus covert channel attack, by relaxing the restrictions on leakage. We allow bounded leakage at anytime and anywhere and over anything. Our leakage threshold (e.g., 10,000 bits) could be much larger than typical secret key (e.g., AES key or RSA private key) size. Under such a strong leakage setting, we propose an efficient encryption scheme which is semantic secure in standard setting (i.e., without leakage) and can tolerate strong continuous leakage.We manage to construct such a secure scheme under strong leakage setting, by hiding partial (e.g., $$1\%$$ ) ciphertext as secure as we hide the secret key using a small amount of more secure hardware resource, so that it is almost equally difficult for any adversary to steal information regarding this well-protected partial ciphertext or the secret key. We remark that the size of such well-protected small portion of ciphertext is chosen to be much larger than the leakage threshold. We provide concrete and practical examples of such more secure hardware resource for data communication and data storage. Furthermore, we also introduce a new notion of computational entropy, as a sort of computational version of Kolmogorov complexity. Our quantitative analysis shows that, hiding partial ciphertext is a powerful countermeasure, which enables us to achieve higher security level than existing approaches in case of backdoor plus covert channel attacks. We also show the relationship between our new notion of computational entropy and existing relevant concepts, including Shannon entropy, Yao entropy, Hill entropy, all-or-nothing Transform, and exposure-resilient function. This new computation entropy formulation may have independent interests.

Fusion-On-Field Security and Privacy Preservation for IoT Edge Devices: Concurrent Defense Against Multiple Types of Hardware Trojan Attacks

Internet of Things (IoT) devices have connected millions of houses around the globe via the internet. In the recent past, threats due to hardware Trojan (HT) in the integrated circuits (IC) have become a serious concern, which affects IoT edge devices (IoT-ED). In this paper, the possibility of the IoT-ED with embedded HT that can cause serious security, privacy, and availability problems to the IoT based Home Area Network (HAN) has been discussed. Conventional network attack detection techniques work at the network protocol layers, whereas IoT-ED with HT can lead to the peculiar manifestation of attack at the physical and/or firmware level. On the other hand, in the IC design, most of the HT-based attack detection techniques require design time intervention, which is expensive for many of the IoT-ED and cannot guarantee 100% immunity. The argument in this paper is that the health of modern IoT-ED requires a final line of defense against possible HT-based attacks that goes undetected during IC design and test. The approach is to utilize power profiling (PP) and network traffic (NT) data without intervening into the IC design to detect malicious activity in HAN. The proposed technique is to effectively identify multiple attacks concurrently and to differentiate between different types of attacks. The IoT-ED behaviors for five different types of random attacks have been studied, including covert channel, DoS, ARQ, power depletion, and impersonation attacks. Data fusion has been leveraged by combining the PP and NT data and is able to detect, without design time intervention, each of the five attacks individually with up to 99% accuracy. Moreover, the proposed technique can also detect all the attacks concurrently with 92% accuracy. To the best of authors' knowledge, this is the first work where multiple HT based attacks are concurrently detected in IoT-ED without requiring any design time intervention.

Survey of Microarchitectural Side and Covert Channels, Attacks, and Defenses

Over the last two decades, side and covert channel research has shown a variety of ways of exfiltrating information for a computer system. Processor microarchitectural timing-based side and covert channel attacks have emerged as some of the most clever attacks, and ones which are difficult to deal with, without impacting system performance. Unlike electromagnetic or power-based channels, microarchitectural timing-based side and covert channel do not require physical proximity to the target device. Instead, only malicious or cooperating spy applications need to be co-located on the same machine as the victim. And in some attacks even co-location is not needed, only timing of the execution of the victim application, as measured by a remote attacker, can lead to information leaks. This survey extracts the key features of the processor’s microarchitectural functional units which make the channels possible, presents an analysis and categorization of the variety of microarchitectural side and covert channels others have presented in literature, and surveys existing defense proposals. With advent of cloud computing and ability to launch microarchitectural side and covert channels even across virtual machines, understanding of these channels is critical for cybersecurity.

Security Policy Violations in SDN Data Plane

Software-defined networking (SDN) utilizes a centralized controller to distribute packet processing rules to network switches. However, rules are often generated by the applications developed by different organizations, so they may conflict with each other in data plane and lead to violations with security rules. The problem is similar to firewall conflicts in IP networks. Rule conflict resolution should incur negligible process delay, such that all rules can be correctly and safely enforced in the data plane in real time. However, since SDN allows users to use more than 35 fields to specify rules (including field transition rules), it is much more complicated to prevent enforcement of SDN rules from violating with security rules than to resolve firewall rule violation, and in particular, field transition rules are enforced. Therefore, it is extremely difficult to resolve such rule conflicts in real time before the rules are installed in SDN data plane. In this paper, we investigate the rule conflict problem in SDN and identify new covert channel attacks due to rule conflicts. To the end, we propose the covert channel defender (CCD) that prevents covert channel attacks by verifying and resolving rule conflicts. Specifically, CCD tracks all rule insertion and modification messages from applications running on the controller. It analyzes the correlation among rules based on multiple packet header fields and resolves any identified rule conflict in real time before rule installation. We implement CCD with the Floodlight controller and evaluate its performance with the real-world Stanford topology. We show that CCD can efficiently detect and prevent rule conflicts in the data plane that may raise covert channels within hundreds of microseconds and brings small overhead to the packet delivery.

DroidAuditor: A framework for auditing covert communication on Android

SummaryExploitation of covert channels in smartphone operating systems may lead to furtive data transmission between applications with different permissions, which might threaten users' privacy. Restricting the access to shared system resources can effectively prevent the exploitation of known covert channels. However, it inevitably limits the normal usage of those resources. In this paper, we propose a general method that detects covert channel attack at runtime without impacting the accessibility of shared resources in the system. The main idea of the method is to track and audit the use of system resources known as potential covert channel variables and impose interferences on those channels to reduce their capacity once violations are detected. We implement a prototype framework, which is able to audit and interfere covert communication both in the application layer and in the native layer of Android. The experimental results demonstrate that our method can effectively reduce the data rate of user‐defined covert channels while the overhead is negligible.

A Data Owner Controlled Model for Co tenant Covert Channel Protection

The emerging technology cloud Computing has became as a popular choice for small and medium enterprises for their infrastructural needs. It has many services providing support like computing, storing etc. Virtualization is the key technology to provide features like scalability and elasticity using multi tenancy. In multi tenant cloud architecture malicious co tenants use covert channels like RAM, bus and other shared devices to hijack the sensitive data. Literature is available for identifying and preventing these kinds of attacks in matured cloud providers. Immature or lazy cloud service providers will suffer from these kinds of problems profoundly. Our novel model tries to suggest measures in protection of covert channel protection. It uses a simple technique of split and sharing data to store multiple regions in multiple places. We have taken factor called as missing data which is inaccessible data in the case of compromised co tenant covert channel attack. Experiments were done in the Amazon S3 cloud with different accounts in different regions and multiple buckets for storing split data and results were analyzed. We come across with best number of splits to maximize missing data factor with less impact over the time cost for upload and download operations from our result analysis satisfactorily.

Exploiting Content Delivery Networks for covert channel communications

Content Delivery Networks (CDNs) became an important infrastructure in today’s Internet architecture. More and more content providers use CDNs to improve their service quality and reliability. However, providing better quality of service (QoS) by using CDNs could also be abused by attackers to commit network crimes. In this paper, we show that CDNs can be used as a covert communication channel to circumvent network censorships. Specifically, we propose the CDN covert channel attack, where accessing contents through different CDN nodes can form a unique pattern, which can be used in encoding secret messages. We implemented a proof-of-concept covert channel based on our proposed attack on CloudFront, a commercial CDN service provided by Amazon Web Service. We showed that our constructed covert channel can transmit messages with various lengths with an average transmission efficiency as 2.29 bits per request (i.e., each penetration request transmits 2.29 bits of secret message on average). After presenting the CDN covert channel attack, we also discuss possible countermeasures.

CovertInspector: Identification of Shared Memory Covert Timing Channel in Multi-tenanted Cloud

Memory deduplication improves the memory efficiency of common multi-tenanted cloud. Due to the cross-VM memory sharing, malicious users can mount covert channel attack to steal secret information. While this kind of attack does not break the normal restrictions, it is very hard to detect and defend. In the paper, we present the design, implementation and evaluation of CovertInspector--a VMM-based system to identify and eliminate a covert timing channel constructed on shared memory. Our proof-of-concept prototype is built on KVM and Kernel Samepage Merging (KSM), with minor modification to KVM hypervisor (about 300 LOC). Further evaluation shows that CovertInspector is able to fully identify and eliminate such kind of covert channel with tolerable impact to the performance of guest VMs.

Whispers in the Hyper-Space: High-Bandwidth and Reliable Covert Channel Attacks Inside the Cloud

Privacy and information security in general are major concerns that impede enterprise adaptation of shared or public cloud computing. Specifically, the concern of virtual machine (VM) physical co-residency stems from the threat that hostile tenants can leverage various forms of side channels (such as cache covert channels) to exfiltrate sensitive information of victims on the same physical system. However, on virtualized x86 systems, covert channel attacks have not yet proven to be practical, and thus the threat is widely considered a potential risk. In this paper, we present a novel covert channel attack that is capable of high-bandwidth and reliable data transmission in the cloud. We first study the application of existing cache channel techniques in a virtualized environment and uncover their major insufficiency and difficulties. We then overcome these obstacles by: 1) redesigning a pure timing-based data transmission scheme, and 2) exploiting the memory bus as a high-bandwidth covert channel medium. We further design and implement a robust communication protocol and demonstrate realistic covert channel attacks on various virtualized x86 systems. Our experimental results show that covert channels do pose serious threats to information security in the cloud. Finally, we discuss our insights on covert channel mitigation in virtualized environments.

Novel Packet Size-Based Covert Channel Attacks against Anonymizer

In this paper, we present a study on the anonymity of Anonymizer, a well-known commercial anonymous communication system. We discovered the architecture of Anonymizer and found that the size of web packets in the Anonymizer network can be very dynamic at the client. Motivated by this finding, we investigated a class of novel packet size-based covert channel attacks against Anonymizer. The attacker between a website and the Anonymizer server can manipulate the web packet size and embed secret signal symbols into the target traffic. An accomplice at the user side can sniff the traffic and recognize the secret signal. In this way, the anonymity provided by Anonymizer is compromised. We developed intelligent and robust algorithms to cope with the packet size distortion incurred by Anonymizer and Internet. We developed techniques to make the attack harder to detect: 1) We pick up right packets of web objects to manipulate to preserve the regularity of the TCP packet size dynamics, which can be measured by the Hurst parameter; 2) We adopt the Monte Carlo sampling technique to preserve the distribution of the web packet size despite manipulation. We have implemented the attack over Anonymizer and conducted extensive analytical and experimental evaluations. It is observed that the attack is highly efficient and requires only tens of packets to compromise the anonymous web surfing via Anonymizer. The experimental results are consistent with our theoretical analysis.

Covert channel resistant information leakage protection using a multi-agent architecture

Covert channel attacks utilise shared resources to indirectly transmit sensitive information to unauthorised parties. Current operating systems (e.g. SELinux) rely on tagging the filesystem with security labels and enforcing security policies at the time of access to a file or resource. However, such mechanisms do not provide strong protection against information laundering via covert channels. Colored Linux, an extension to SELinux, utilises watermarking algorithms to ‘colour’ the contents of each file with their respective security classification, or context, to enhance resistance to information laundering attacks. In this study, the authors propose a mobile agent-based approach to automate the process of detecting and colouring receptive hosts' filesystems and monitoring the coloured filesystem for instances of potential information leakage. Implementation details and execution results are included to illustrate the merits of the proposed approach. The authors have also evaluated the performance of their agent-based system over a single host as well as a local network of machines. Finally, using formal method techniques, the authors have proved correctness properties about the agent-based approach and identified and corrected a flaw in their initial implementation.

Privacy from Promises to Protection

Privacy issues are becoming more and more important especially since the cyber and the real world are converging up to certain extent when using mobile devices. Means that really protect privacy are still missing. The problem is, as soon as a user provides data to a service provider the user looses control over her data. The simple solution is not to provide any data but then many useful services, e.g. navigation applications, cannot be used. In order to solve this problem, we propose privacy guaranteeing execution containers (PGEC). Basically the concept is that the application obtains access to the user data in a specially protected and certified environment, the PGEC. PGECs enable applications to access private user data and guarantee that the user data is deleted as soon as the service is quit. The PGEC also restricts the communication between the application and the service provider to what is explicitly allowed by the service user. In addition to those means the PGEC also implements countermeasures against malicious attacks such as modified host systems and covert channel attacks, which might be misusing CPU load to signal data out of the PGEC. Thus, the PGEC guarantees a "one time use" of the provided private data.