Covert Channel Research Articles

SnapCatch: Automatic Detection of Covert Timing Channels Using Image Processing and Machine Learning

With the rapid growth of data exfiltration carried out by cyber attacks, Covert Timing Channels (CTC) have become an imminent network security risk that continues to grow in both sophistication and utilization. These types of channels utilize inter-arrival times to steal sensitive data from the targeted networks. CTC detection relies increasingly on machine learning techniques, which utilize statistical-based metrics to separate malicious (covert) traffic flows from the legitimate (overt) ones. However, given the efforts of cyber attacks to evade detection and the growing column of CTC, covert channels detection needs to improve in both performance and precision to detect and prevent CTCs and mitigate the reduction of the quality of service caused by the detection process. In this article, we present an innovative image-based solution for fully automated CTC detection and localization. Our approach is based on the observation that the covert channels generate traffic that can be converted to colored images. Leveraging this observation, our solution is designed to automatically detect and locate the malicious part (i.e., set of packets) within a traffic flow. By locating the covert parts within traffic flows, our approach reduces the drop of the quality of service caused by blocking the entire traffic flows in which covert channels are detected. We first convert traffic flows into colored images, and then we extract image-based features for detection covert traffic. We train a classifier using these features on a large data set of covert and overt traffic. This approach demonstrates a remarkable performance achieving a detection accuracy of 95.83% for cautious CTCs and a covert traffic accuracy of 97.83% for 8 bit covert messages, which is way beyond what the popular statistical-based solutions can achieve.

Distributed data hiding in multi-cloud storage environment

Classical or traditional steganography aims at hiding a secret in cover media such as text, image, audio, video or even in network protocols. Recent research has improved this approach called distributed steganography by fragmenting the secret message and embedding each secret piece into a distinct cover media. The major interest of this approach is to make the secret message detection extremely difficult. However, these file modifications leave fingerprints which can reveal a secret channel to an attacker. Our contribution is a new steganography paradigm transparent to any attacker and resistant to the detection and the secret extraction. Two properties contribute to achieve these goals: the files do not undergo any modification while the distribution of the secret in the multi-cloud storage environment allows us to hide the existence of the covert channel between the communicating parties. Information’s are usually hidden inside the cover media. In this work, the covert media is a pointer to information. Therefore the file carries the information without being modified and the only way to access it is to have the key. Experiments show interesting comparison results with remarkable security contributions. The work can be seen as a new open direction for further research in the field.

Design of Transport Layer Based Hybrid Covert Channel Detection Engine

Design of Transport Layer Based Hybrid Covert Channel Detection Engine

Combating Enhanced Thermal Covert Channel in Multi-/Many-Core Systems With Channel-Aware Jamming

As a means to thwart thermal covert channel attack in a multi-/many-core system, a strong heat noise whose frequency band coincides with that occupied by the thermal covert channel is injected to jam the channel. However, this undiscriminating channel jamming-based countermeasure will fail if a thermal covert channel is allowed to change its transmission frequency dynamically in response to the jamming. To combat this enhanced thermal covert channel, a more advanced countermeasure is needed and thus proposed that checks the frequency spectrum and tracks any possible covert channel. Only after a channel is detected to be susceptible, a thermal noise with this channel frequency is then emitted to jam the covert channel. The communication protocols and frequency changing scheme pertaining to this enhanced thermal covert channel are described in this article. The experimental results confirm that, when the proposed countermeasure is applied, the enhanced thermal covert channel, much more resilient to jamming, suffers from an extremely high packet error rate (PER), which makes any meaningful data leakage practically impossible. As the proposed countermeasure method is poised to contain dangerous thermal covert channel attacks with an anti-jamming capability, it lends itself well to secure multi-/many-core systems.

Covert Channels in Cyber-Physical Systems

In this letter, using a control-theoretic approach, we present a covert channel technique, enabling a compromised networked controller to leak information to an eavesdropper who has access to the measurement channel. We demonstrate that this can be achieved without establishing any additional explicit communication channels by properly altering the control logic and exploiting robust reachability arguments. Finally, a dual-mode receding horizon model predictive control strategy is used as an illustrative example to show how such an undetectable covert channel can be established.

Transmission of Information in Channels Specified by Structures of Partial Erasure. Part 1

We investigate covert channels that use players moves to transmit information. We assume that there exits noise generated by periods of invisiblility of the transmitting player (due to network failures, game mechanics, etc.); thus there arises the problem of reliable transmission of information over a noisy channel. The formal model that addresses this problem is referred to as a structure of partial erasure. In the framework of the model we prove the criterion of equivalence of a pair of trajectories on the receiving end of the channel. We also discuss a number of methods that prevent organization of covert channels of the type considered.

Detecting DNS covert channels using stacking model

A covert channel is an information channel that is used by the computer process to exfiltrate data through bypassing security policies. The DNS protocol is one of the important ways to implement a covert channel. DNS covert channels are easily used by attackers for malicious purposes. Therefore, an effective detection approach of the DNS covert channels is significant for computer systems and network securities. Aiming at the difficulty of the DNS covert channel identification, we propose a DNS covert channel detection method based on a stacking model. The stacking model is evaluated on a campus network and the experimental results show that the detection based on the stacking model can detect the DNS covert channels effectively. Besides, it can identify unknown covert channel traffic. The area under the curve (AUC) of the proposed method reaches 0.9901, which outperforms existing detection methods.

TAMBUS: A novel authentication method through covert channels for securing industrial networks

Nowadays, many companies still use old and insecure protocols in Industrial Control Systems (ICSs). An example of such protocols is Modbus, one of the most employed industrial protocols. Also, companies are moving to Modbus/TCP when there are TCP devices involved in the facility. While remaining insecure, this migration also disrupts the assumption of air-gapped industrial networks, opening more attack surface to previously isolated systems. Due to legacy and efficiency constraint, the replacement of Modbus/TCP with secure protocols is not possible, generating big security issues.In this paper, we present TAMBUS (Transmitter Authentication and packet integrity in Modbus/TCP). This method is the first that at the same time: is not implemented in a secure by obscurity design and keeps the Modbus/TCP protocol compatible with legacy devices. TAMBUS allows detecting attacks with high statistical confidence, by leveraging two covert channels as a mean of providing security: 1) Storage-based, that hides authentication messages into the Modbus/TCP protocol fields; 2) Timing-based, that considers the inter-arrival time of packets. We demonstrate the feasibility and effectiveness of our method through a prototype implementation and testing in an industrial testbed environment. Our experiments confirm that TAMBUS introduces only a small overhead, negligible in most application, and it preserves the regular functioning of industrial systems. In particular, considering the storage-based covert channel, TAMBUS introduces an error into transmitted values of only 1.19×10−5%, without traffic overhead. On the other hand, TAMBUS can transmit correct security information through the timing-based covert channel with an accuracy of more than 99.99%.

Quantum steganography based on reflected gray code for color images

Digital steganography is the art and science of hiding information in covert channels, so as to conceal the information and prevent the detection of hidden messages. On the classic computer, the principle and method of digital steganography has been widely and deeply studied, and has been initially extended to the field of quantum computing. Quantum image steganography is a relatively active branch of quantum image processing, and the main strategy currently used is to modify the LSB of the cover image pixels. For the existing LSB-based quantum image steganography schemes, the embedding capacity is no more than 3 bits per pixel. Therefore, it is meaningful to study how to improve the embedding capacity of quantum image steganography. This work presents a novel steganography using reflected Gray code for color quantum images, and the embedding capacity of this scheme is up to 6 bits per pixel. In proposed scheme, the secret qubit sequence is considered as a sequence of 6-bit segments. For 6 bits in each segment, the first 3 bits are embedded into the second LSB of RGB channels of the cover image, and the remaining 3 bits are embedded into the LSB of RGB channels of the cover image using reflected-Gray code to determine the embedded bit from secret information. Following the transforming rule, the LSBs of stego-image are not always same as the secret bits and the differences are up to almost 50%. Experimental results confirm that the proposed scheme shows good performance and outperforms the previous ones currently found in the literature in terms of embedding capacity.

MAGNETO: Covert channel between air-gapped systems and nearby smartphones via CPU-generated magnetic fields

This papers shows that attackers can leak data from isolated, air-gapped computers to nearby smartphones via covert magnetic signals. The proposed covert channel works even if a smartphone is kept inside a Faraday shielding case, which aims to block any type of inbound and outbound wireless communication (Wi-Fi, cellular, Bluetooth, etc.). Malware is implemented to control the magnetic fields emanating from the computer by regulating workloads on the CPU cores. Sensitive data such as encryption keys, passwords, or keylogging data is encoded and transmitted over the magnetic signals. A smartphone located near the computer receives the covert signals with its magnetic sensor. I present technical background, discuss signal generation, data encoding, and signal reception. The proposed covert channel works from a user-level process, without requiring special privileges, and can successfully operate from within an isolated virtual machine (VM).

Efficient Physical Layer Key Agreement for FlexRay Networks

The FlexRay protocol provides deterministic and fault-tolerant communication for automotive applications with stringent requirements regarding reliability and real-time performance. But the lack of intrinsic security mechanisms makes FlexRay vulnerable to spoofing and DoS attacks while existing features are not sufficient to assure reliable communication in the presence of adversaries. Since adding cryptography mandates for secret shared keys, providing secure key establishment techniques is critical in assuring the intended security objectives. In this paper we propose a backward compatible key agreement scheme for FlexRay communication based on intrinsic characteristics of the FlexRay physical layer. In particular, we determine that the symbol window is suitable for implementing a covert channel based on physical properties of the bus which allows us to bootstrap a secure session key between two nodes or to re-enforce existing shared keys. We evaluate and discuss the performance of software-based implementations of the proposed mechanism on two different automotive embedded platforms relying only on the application level.

CANTO - Covert AutheNtication With Timing Channels Over Optimized Traffic Flows for CAN

Previous research works have endorsed the use of delays and clock skews for detecting intrusions or fingerprinting controllers that communicate on the CAN bus. Recently, timing characteristics of CAN frames have been also used for establishing a covert channel for cryptographic authentication, in this way cleverly removing the need for cryptographic material inside the short payload of data frames. However, the main drawback of this approach is the limited security level that can be achieved over existing CAN bus traffic. In this work we significantly improve on this by relying on optimization algorithms for scheduling CAN frames and deploy the covert channel on optimized CAN traffic. Under practical bus allocations, we are able to extract 3-5 bits of authentication data from each frame which leads to an efficient intrusion detection and authentication mechanism. By accumulating covert channel data over several consecutive frames, we can achieve higher security levels that are in line with current real-world demands. To prove the correctness of our approach, we present experiments on automotive-grade controllers, i.e., Infineon Aurix, and bus measurements with the use of industry standard tools, i.e., CANoe.

DNA Privacy: Analyzing Malicious DNA Sequences Using Deep Neural Networks.

Recent advances in next-generation sequencing technologies have led to the successful insertion of video information into DNA using synthesized oligonucleotides. Several attempts have been made to embed larger data into living organisms. This process of embedding messages is called steganography and it is used for hiding and watermarking data to protect intellectual property. In contrast, steganalysis is a group of algorithms that serves to detect hidden information from covert media. Various methods have been developed to detect messages embedded in conventional covert channels. However, conventional steganalysis algorithms are mostly limited to common covert media. Most common detection approaches, such as frequency analysis-based methods, often overlook important signals when directly applied to DNA steganography and are easily bypassed by recently developed steganography techniques. To address the limitations of conventional approaches, a sequence-learning-based malicious DNA sequence analysis method based on neural networks has been proposed. The proposed method learns intrinsic distributions and identifies distribution variations using a classification score to predict whether a sequence is to be a coding or non-coding sequence. Based on our experiments and results, we have developed a framework to safeguard security against DNA steganography.

A Survey of Key Technologies for Constructing Network Covert Channel

In order to protect user privacy or guarantee free access to the Internet, the network covert channel has become a hot research topic. It refers to an information channel in which the messages are covertly transmitted under the network environment. In recent years, many new construction schemes of network covert channels are proposed. But at the same time, network covert channel has also received the attention of censors, leading to many attacks. The network covert channel refers to an information channel in which the messages are covertly transmitted under the network environment. Many users exploit the network covert channel to protect privacy or guarantee free access to the Internet. Previous construction schemes of the network covert channel are based on information steganography, which can be divided into CTCs and CSCs. In recent years, there are some covert channels constructed by changing the transmission network architecture. On the other side, some research work promises that the characteristics of emerging network may better fit the construction of the network covert channel. In addition, the covert channel can also be constructed by changing the transmission network architecture. The proxy and anonymity communication technology implement this construction scheme. In this paper, we divide the key technologies for constructing network covert channels into two aspects: communication content level (based on information steganography) and transmission network level (based on proxy and anonymity communication technology). We give an comprehensively summary about covert channels at each level. We also introduce work for the three new types of network covert channels (covert channels based on streaming media, covert channels based on blockchain, and covert channels based on IPv6). In addition, we present the attacks against the network covert channel, including elimination, limitation, and detection. Finally, the challenge and future research trend in this field are discussed.

ChildShield: A rating system for assessing privacy and security of internet of toys

The wave of IoT has spread across the toy market providing designers opportunities for bringing innovation into children’s play in the form of toys that can adapt, connect and communicate referred to as Internet of Toys (IoToys). Research and media reports have underscored the potential misuse by threat actors for surveillance, theft of children’s personal information, opening a covert channel of communication with children and influencing their thoughts and actions. Currently there is a lack of standard labelling system for internet safety of toys that makes it difficult for parents to make the right choice while purchasing. Consumer awareness is critical in this area because of the vulnerability of children, who are the ultimate users. This research identifies the factors affecting privacy and security of IoToys and proposes a methodology for evaluation of toys based on these factors. ChildShield, a privacy and security label, has been recommended as a communication tool between toy manufacturers and consumers.

Flow Misleading: Worm-Hole Attack in Software-Defined Networking via Building In-Band Covert Channel

Link Layer Discovery Protocol (LLDP), which is widely used by the controller in Software-Defined Networking to discover the network topology, has been demonstrated to be unable to guarantee the integrity of its messages. Attackers could exploit this vulnerability to fabricate LLDP packets to declare a false link connecting two distant switches to the controller. By doing so, the controller would be misled to route flows to the false links, which leads to further DoS, eavesdropping and even hijacking attacks. This attack seems very similar to the well-known Worm-Hole Attack in wireless sensor networking (WSN). Nevertheless, in WSN, attackers are assumed to leverage an out-of-band wired channel to achieve the true packet transmission between the two cheating sensor nodes. Unfortunately, in SDN, there usually does not exist any out-of-band channels between the distant cheating switches. Flows misguided to the fake link will cause 100% packet loss, and thus be detected soon. In this article, we address this problem and propose the first True worm-hole attack in SDN, which could achieve packet transmission over the forged link without using any out-of-band channels. Instead, it introduces a relay host in the networks to build a completely in-band covert channel between the two cheating switches. Unlike the existing studies, a relay host is not required to be directly linked to them. Moreover, attackers are only assumed to poss the remote read and write privileges of the flow tables of the both cheating switches and do not have to alter any of their software or hardware. Our extensive experiments demonstrate the high feasibility of this attack. Both the increases of transmission delays and packet loss rates are within a reasonable range. We finally present and evaluate the countermeasures against the proposed attack.

Covert timing channel detection method based on time interval and payload length analysis

Information leakage is becoming increasingly serious in today’ s network environment. Faced with increasingly forceful network defence strategies, attackers are also constantly trying to steal important information from systems. As for security researchers, the most troublesome way of information stealing is the covert channel. Generally, the covert channel is divided into the covert storage channel (CSC) and the covert timing channel (CTC). For the covert storage channel, there are already many effective methods to detect it. However, the detection of the covert timing channel is still in the research stage. The basis for implementing the covert timing channel is to control the sending time of packets, so most researches about the covert timing channel detection are based on the time interval between packets. Based on this idea, we refer to the method adopted in the researches of the malicious traffic detection and propose a covert timing channel detection method based on the k-NearestNeighbor (kNN) algorithm. This method uses a series of statistics related to the time interval and payload length as features to train a machine learning model and using 10-fold cross-validation to improve model performance. The experiment result proves that the model has a great detection effect, the detection accuracy is 0.96, and the Area Under Curve (AUC) value the model is 0.9737.

JackHammer: Efficient Rowhammer on Heterogeneous FPGA-CPU Platforms

After years of development, FPGAs are finally making an appearance on multi-tenant cloud servers. Heterogeneous FPGA-CPU microarchitectures require reassessment of common assumptions about isolation and security boundaries, as they introduce new attack vectors and vulnerabilities. In this work, we analyze the memory and cache subsystem and study Rowhammer and cache attacks enabled by two proposed heterogeneous FPGA-CPU platforms from Intel: the Arria 10 GX with an integrated FPGA-CPU platform, and the Arria 10 GX PAC expansion card which connects the FPGA to the CPU via the PCIe interface. We demonstrate JackHammer, a novel, efficient, and stealthy Rowhammer from the FPGA to the host’s main memory. Our results indicate that a malicious FPGA can perform twice as fast as a typical Rowhammer from the CPU on the same system and causes around four times as many bit flips as the CPU attack. We demonstrate the efficacy of JackHammer from the FPGA through a realistic fault attack on the WolfSSL RSA signing implementation that reliably causes a fault after an average of fifty-eight RSA signatures, 25% faster than a CPU Rowhammer. In some scenarios our JackHammer attack produces faulty signatures more than three times more often and almost three times faster than a conventional CPU Rowhammer. Finally, we systematically analyze new cache attacks in these environments following demonstration of a cache covert channel across FPGA and CPU.

Cache-Zoomer: On-demand High-resolution Cache Monitoring for Security

Information leakage through timing channels is an increasing threat in most computer systems. Among various hardware components, the CPU caches expose the largest attack surface for timing channels since they are usually shared among multiple processor cores. Recently, cache-based covert timing channels have been exploited by well-known attacks, such as Meltdown, for information leakage. Prior works have explored use of existing hardware performance counters linked to caches in order to detect covert channels. Unfortunately, current hardware performance counters only capture a single cache-wide statistic relating to the activities of an entire cache. As a result, such coarse-grained cache monitoring is very unlikely to capture the adversaries that typically work with limited subsets of cache blocks. To solve the resolution problem in existing cache hardware performance counters, we propose Cache-Zoomer, a framework that provides on-demand high-resolution cache monitoring. Cache-Zoomer uses a small set of configuration registers for on-demand monitoring of specific regions in the cache. At runtime, Cache-Zoomer dynamically selects the cache sub-areas with high frequency of miss patterns for improved monitoring. We demonstrate the efficiency of Cache-Zoomer on various types of cache timing channel attacks with different bandwidths. Our results show that Cache-Zoomer is able to swiftly detect all the cache timing channels studied, while incurring negligible (< 1%) area and power overheads. Our proposed Cache-Zoomer is versatile and can be adapted to other applications such as performance analysis as well.

A Robust Packet-Dropout Covert Channel over Wireless Networks

Wireless communication is the most important carrier for covert channels because increasing security threats have made covert channels an alternative to transmitting confidential information in untrusted wireless communications. As a solution for next-generation mobile communication, voice over LTE (VoLTE) is developed using a high-speed packet-switched core network to provide high-quality end-to-end communication services. Unlike traditional circuit-switched communication technologies, both inter-packet delays and packet orders in VoLTE traffic are limited by specific rules. Even minor modifications to the overt traffic can be detected, so the existing solutions do not apply to VoLTE. To solve this problem, we build a robust packet-dropout covert timing channel through parity casecade coding. Hash-based inter-codewords verification, cyclic redundancy check based codeword self-verification, and an adaptive mapping matrix are designed to ensure robustness and undetectability. In our scheme, the covert message is modulated into the sequence numbers of the actively dropped packets, which can be retrieved by the receiver. With the help of the verification section, the actual codewords combination can be identified to retrieve the embedded covert message. Several experiments are performed to evaluate the performance of the scheme, and the parameters of the covert timing channel (CTC) are adjusted to estimate robustness and throughput. Finally, the CTC scheme is proved to be feasible since both average bit error rate and throughput are acceptable while the covert message is stealthily transmitted.