Covert Communication Channel Research Articles

Covert channel‐internal control protocols: attacks and defense

AbstractNetwork covert channels have become a sophisticated means for transferring hidden information over the network. Covert channel‐internal control protocols, also called micro protocols, have been introduced in the recent years to enhance capabilities of the network covert channels. Micro protocols are usually placed within the hidden bits of a covert channel's payload and enable features such as reliable data transfer, session management, and dynamic routing for network covert channels. These features provide adaptive and stealthy covert communication channels. Some of the micro protocol based tools exhibit vulnerabilities and are susceptible to attacks. In this paper, we demonstrate some possible attacks on micro protocols, which are capable of breaking the sophisticated covert channel communication or jeopardizing the identity of peers in such a network. These attacks are based on the attacker's interaction with the micro protocol. We also present the defense techniques to safeguard micro protocols against such attacks. By using these techniques, micro protocol‐based tools can become immune to certain attacks and lead to robust covert communication. We present our results for two micro protocol‐based tools: Ping Tunnel and smart covert channel tool. Copyright © 2016 John Wiley & Sons, Ltd.

COMPARATIVE STUDY OF EDGE BASED LSB MATCHING STEGANOGRAPHY FOR COLOR IMAGES

Steganography is a very pivotal technique mainly used for covert transfer of information over a covert communication channel. This paper proposes a significant comparative study of the spatial LSB domain technique that focuses on sharper edges of the color as well as gray scale images for the purpose of data hiding and hides secret message first in sharper edge regions and then in smooth regions of the image. Message embedding depends on content of the image and message size. The experimental results illustrate that, for low embedding rate the method hides the message in sharp edges of cover image to get better stego image visualization quality. For high embedding rate, smooth regions and edges of the cover image are used for the purpose of data hiding. In this steganography method, color image and textured kind of image preserves better visual quality of stego image. The novelty of the comparative study is that, it helps to analyze the efficiency and performance of the method as it gives better results because it directly works on color images instead of converting to gray scale image

Audio steganalysis based on reversed psychoacoustic model of human hearing

During the last decade, audio information hiding has attracted lots of attention due to its ability to provide a covert communication channel. On the other hand, various audio steganalysis schemes have been developed to detect the presence of any secret messages. Basically, audio steganography methods attempt to hide their messages in areas of time or frequency domains where human auditory system (HAS) does not perceive. Considering this fact, we propose a reliable audio steganalysis system based on the reversed Mel-frequency cepstral coefficients (R-MFCC) which aims to provide a model with maximum deviation from HAS model. Genetic algorithm is deployed to optimize dimension of the R-MFCC-based features. This will both speed up feature extraction and reduce the complexity of classification. The final decision is made by a trained support vector machine (SVM) to detect suspicious audio files. The proposed method achieves detection rates of 97.8% and 94.4% in the targeted (Steghide@1.563%) and universal scenarios. These results are respectively 17.3% and 20.8% higher than previous D2-MFCC based method.

Circularly Polarized Light as a Communication Signal in Mantis Shrimps

Animals that communicate using conspicuous body patterns face a trade-off between desired detection by intended receivers and undesired detection from eavesdropping predators, prey, rivals, or parasites. In some cases, this trade-off favors the evolution of signals that are both hidden from predators and visible to conspecifics. Animals may produce covert signals using a property of light that is invisible to those that they wish to evade, allowing them to hide in plain sight (e.g., dragonfish can see their own, otherwise rare, red bioluminescence). The use of the polarization of light is a good example of a potentially covert communication channel, as very few vertebrates are known to use polarization for object-based vision. However, even these patterns are vulnerable to eavesdroppers, as sensitivity to the linearly polarized component of light is widespread among invertebrates due to their intrinsically polarization sensitive photoreceptors. Stomatopod crustaceans appear to have gone one step further in this arms race and have evolved a sensitivity to the circular polarization of light, along with body patterns producing it. However, to date we have no direct evidence that any of these marine crustaceans use this modality to communicate with conspecifics. We therefore investigated circular polarization vision of the mantis shrimp Gonodactylaceus falcatus and demonstrate that (1) the species produces strongly circularly polarized body patterns, (2) they discriminate the circular polarization of light, and (3) that they use circular polarization information to avoid occupied burrows when seeking a refuge.

On the Existence of Subliminal Channel in Instant Messaging Systems

Subliminal channel is a covert communication channel that can securely exchange secret information. By analyzing the communication protocols and encryption algorithms of two popular instant messaging systems QQ and Skype, this paper devotes the efforts to find whether they satisfy the condition of establishing subliminal channel or not. The broad-band subliminal channel can be established in Skype and QQ messages. Therefore, two subliminal channel schemes are proposed to embed and extract subliminal information. Finally, performances of the proposed subliminal channels are compared with those of the ones based on ElGamal digital signature and Newton channel. Experimental results and theoretical analysis show that they are easy to be implemented with large bandwidth and execute fast.

Towards the Certification of Covert Channel Freeness in Cloud-based Systems

The rapid transition to cloud-based infrastructures has introduced a number of uncharted risks, threats, and challenges that are faced by security experts. In particular, concerns surrounding the confidentiality of information in cloud-based systems and the existence of covert communication channels ought to be addressed.In this paper, we outline a schema for certifying covert channel freeness in cloud-based systems. The proposed schema provides an application of the formal foundation laid out in our previous work and is based on a strategy derived from the necessity and for- mal verification of the conditions for covert channel existence in cloud-based systems specified using the mathematical framework of Communicating Concurrent Kleene Algebra (C2KA). We also discuss how the proposed schema can be used for identifying ways in which an analyst may amend, modify, or redesign a system in order to make it more resilient to covert channels, and to potentially certify it to be free from covert channels on the basis of the non-existence of the potential for communication amongst its agents.

A Novel Approach Covert Channel for Secret Communications

This paper presents a novel covert channel for secret communications. It implements a new application layer covert channel, by applying multimedia steganography techniques to hide secret messages. This new channel method (called Under Your Radar (UYR)) provides a stealthiness method for the communication channel and an efficient method for hiding messages, as proved by our investigations. Such a covert channel will be used for transferring secret messages in two phases. In phase one, the message characters will be embedded randomly into the pixels of video frames. The choice of pixels is dependent on finding an identical value of the character ASCII representation from one of the pixel channels. The positions of pixels will form the steganography key, which will be used later to extract the message. Also, the steganography key will be embedded in an image using the LSB steganography technique. In phase two, the secret message will be exchanged between the sender and the receiver by sharing the video along with the steganography key over a public service (e.g. a social network), which serves as the new covert communication channel. The experiments outcomes have showed an improvement on the success of the proposed covert channel in exchanging secret messages without rising suspicion by observers or detection tools.

Research and Application of Information Hiding Algorithm

Along with the development of the computer technology and the Internet, information hiding is given increasing attention. All kinds of the important information, such as government information, business information, personal privacy etc, should be transmitted safely. In the future, information hiding will play a very important role in the network to protect the information from damage. The content of this thesis is presented as follows: The analysis of the basic theory and concept of information hiding; The analysis and application of the space domain algorithms, transform (frequency) domain algorithm, etc focusing on the technology of digital watermarking, covert channel and anonymous communications. The theory of wavelet analysis and the experimental models are discussed deeply, basing on which the research and application of the wavelet is explored in the field of information hiding.

A Formulation of the Potential for Communication Condition using C2KA

An integral part of safeguarding systems of communicating agents from covert channel communication is having the ability to identify when a covert channel may exist in a given system and which agents are more prone to covert channels than others. In this paper, we propose a formulation of one of the necessary conditions for the existence of covert channels: the potential for communication condition. Then, we discuss when the potential for communication is preserved after the modification of system agents in a potential communication path. Our approach is based on the mathematical framework of Communicating Concurrent Kleene Algebra (C2KA). While existing approaches only consider the potential for communication via shared environments, the approach proposed in this paper also considers the potential for communication via external stimuli.

Detection of hidden messages that are embedded in the audio signals using s-tools

There are a lot of variants of the covert communication channels formation during transmitting an usual, non- suspicious data that are possible with using current steganography methods. But these forms of communications are the problem for the state security, as well as for various organizations because they could be used for an illegal activities. Accessibility, spreading and improvement of steganography software and technologies led to a significant increase of interest to the steganographic detection methods in a cover media, in particular, in an audio signals. In this paper was investigated the effectiveness of the audio steganalysis method that based on the "negative resonance" phenomenon for detecting the stego signals, formed by program S-Tools. The important relations of this method were found: the dependence of steganalysis accuracy on the amount of elements in the SVM training set; on the method of training set forming; on steganographic capacity of the stego signals. Also in this paper were found distinguishing statistics for the S-Tools and the roles of the stegokey and of each elements of the signals characteristic vectors have been evaluated. This research allows the improvement of the estimates of accuracy of the method and allows to find their effectiveness in the different steganalysis conditions.

On the Necessary Conditions for Covert Channel Existence: A State-of-the-Art Survey

With the ability to leak confidential information in a secret manner, covert channels pose a significant threat to the confidentiality of a system. Due to this threat, the identification of covert channel existence has become an important part of the evaluation of secure systems. In this paper, we present a state-of-the-art survey discussing the conditions for covert channel existence found in the literature and we point to their inadequacy. We also examine how conditions for covert channel existence are handled by information theory. We propose a set of necessary and verifiable conditions for covert channel existence in systems of communicating agents. We aim to provide an improved understanding of covert channel communication and to build a foundation for developing effective and efficient mechanisms for mitigating covert channels in systems of communicating agents at the early stages of software development

A framework for avoiding steganography usage over HTTP

Steganographic techniques allow users to covertly transmit information, hiding the existence of the communication itself. These can be used in several scenarios ranging from evading censorship to discreetly extracting sensitive information from an organization. In this paper, we consider the problem of using steganography through a widely used network protocol (i.e. HTTP). We analyze the steganographic possibilities of HTTP, and propose an active warden model to hinder the usage of covert communication channels. Our framework is meant to be useful in many scenarios. It could be employed to ensure that malicious insiders are not able to use steganography to leak information outside an organization. Furthermore, our model could be used by web servers administrators to ensure that their services are not being abused, for example, as anonymous steganographic mailboxes. Our experiments show that steganographic contents can be successfully eliminated, but that dealing with high payload carriers such as large images may introduce notable delays in the communication process.

Application Collusion Attack on the Permission-Based Security Model and its Implications for Modern Smartphone Systems

We show that the way in which permission-based mechanisms are used on today's mobile platforms enables attacks by colluding applications that communicate over overt and covert communication channels. These attacks allow applications to indirectly execute operations that those applications, based on their declared permissions, should not be able to execute. Example operations include disclosure of users private data (e.g., phone book and calendar entries) to remote parties by applications that do not have direct access to such data or cannot directly establish remote connections. We further show that on today’s mobile platforms users are not made aware of possible implications of application collusion--quite the contrary--users are implicitly lead to believe that by approving the installation of each application independently, based on its declared permissions, they can limit the damage that an application can cause. In this work, we show that this is not correct and that application permissions should be displayed to the users differently (e.g., in their aggregated form), reflecting their actual implications. We demonstrate the practicality of application collusion attacks by implementing several applications and example covert channels on an Android platform and an example channel on a Windows Phone 7 platform. We study free applications from the Android market and show that the potential for application collusion is significant. Finally, we discuss countermeasures that can be used to mitigate these attacks.

Unicode Steganographic Exploits: Maintaining Enterprise Border Security

Unicode is rapidly becoming the preferred means for representing symbols used in creating multimedia content, especially for information that's presented in multiple languages. This article discusses a unicode vulnerability that makes such content susceptible to being used for creation of covert channel communications. We also developed a solution architecture, the unified secure message augmentation (USMA) service. The USMA service incorporates rules (in an XML vocabulary) that we can apply to unicode transmissions that will detect an attempt to transmit a potential exploit, alert network managers to the presence of the unicode anomaly, and take action to mitigate the exploit.

Covert Channel Forensics on the Internet: Issues, Approaches, and Experiences

The exponential growth of the Internet (WWW in particular) has opened-up several avenues for covert channel communication. Steganographic communication is one such avenue. Hiding secret messages in digital data such as images using steganographic software tools is becoming easier. These digital images posted in public Web sites can then be downloaded at the receiver and the hidden messages may be extracted securely. To thwart covert channels on the Internet new types of search engines that can identify, detect and track these channels are necessary. Traditional search algorithms will fail to identify these channels. In this paper, we discuss various key issues involved in developing a stego (forensic) Web search engine. We also propose approaches to address some of these issues. Finally, we discuss a prototype forensic search engine that we developed called STEALTH and discuss in detail its architecture. Some experimental results are also reported.

An analysis of the timed Z-channel

Golomb analyzed the Z-channel, a memoryless channel with two input symbols and two output symbols, where one of the input symbols is transmitted with noise while the other is transmitted without noise, and the output symbol transmission times are equal. We generalize to the timed Z-channel, where the output symbol transmission times are not equal. The timed Z-channel appears as the basis for a large class of covert (communication) channels appearing in multilevel secure computer systems. We give a detailed mathematical analysis of the timed Z-channel and report a result expressing the capacity of the timed Z-channel as the log of the root of a characteristic equation. This generalizes Shannon's work on noiseless channels for this special case. We also report a new result bounding the timed Z-channel's capacity from below. We show how an interesting observation that Golomb reported for the Z-channel also holds for the timed Z-channel.

Digital signature with a subliminal channel

A subliminal channel is a covert communication channel to send a message to an authorised receiver; this message cannot be discovered by any unauthorised receiver. There are some applications that can take advantage of this by hiding secret messages in this subliminal channel. For example, a credit card provider can hide the card holder's credit history and credit limit in a digital signature for an issued credit card. Simmons had found that El Gamal-type digital signature schemes can be easily used to establish a subliminal channel owing to their low information rate. Simmons had also found that in all broadband subliminal channels devised thus far the receiver needs to know the transmitter's secret signing key; subliminal channels that do not require the transmitter to entrust its secret key to the subliminal receiver are generally narrowband. This limits the practical usefulness of the subliminal channel. The paper shows how to construct a digital signature scheme with a broadband subliminal channel that does not require the subliminal receiver to share the transmitter's secret signing key. The subliminal channel can be constructed in either p-channel or q-channel, where p and q are two large primes as used in the RSA scheme. To any outsider, forging a legitimate signature requires solving both the factoring problem and the discrete logarithm problem. Implementation of the signature scheme based on the Lucas function is proposed to achieve greater efficiency.

Covert flow trees: a visual approach to analyzing covert storage channels

The authors introduce a technique for detecting covert storage channels using a tree structure called a covert flow tree (CFT). CFTs are used to perform systematic searches for operation sequences that allow information to be relayed through attributes and eventually detected by a listening process. When traversed, the paths of a CFT yield a comprehensive list of operation sequences which support communication via a particular resource attribute. These operation sequences are then analyzed and either discharged as benign or determined to be covert communication channels. Algorithms for automating the construction of CFTs and potential covert channel operation sequences are presented. To illustrate this technique, two example systems are analyzed and their results compared to two currently accepted analysis techniques performed on identical systems. This comparison shows that the CFT approach not only identified all covert storage channels found by the other analysis techniques, but discovered a channel not detected by the other techniques. >