Embedding Covert Channels into TCPIP S J Murdoch

Embedding Covert Channels into TCP/IP S. J. Murdoch, S. Lewis University of Cambridge, United Kingdom 7 th Information Hiding Workshop, June 2005 Sweety Chauhan October 26, 2005 CMSC 691 I Clandestine Channels

Overview New and Significant n Overview of Covert Channels n TCP/IP based Steganography n Detection of TCP/IP Steganography n Conclusion n CMSC 691 I Clandestine Channels 2

New and Significant Proposed a scheme “Lathra” for encoding data in TCP/IP header not detected by warden n A message can be hidden so that an attacker cannot demonstrate its existence without knowing a secret key n CMSC 691 I Clandestine Channels 3

Covert Channels Communication in a non-obvious manner n Potential methods - to get information out of the security perimeter n Two Types: n n Storage n Timing CMSC 691 I Clandestine Channels 4

Types of Covert Channels Storage Timing Information conveyed by writing or abstaining by the timing of events from writing Clock not needed CMSC 691 I Receiver needs clock Clandestine Channels 5

Where is this relevant? n The use of covert channels is relevant in organizations that: n restrict the use of encryption in their systems n have privileged or private information n wish to restrict communication n monitor communications CMSC 691 I Clandestine Channels 6

Network Covert Channels n Information hiding n placed in network headers AND/OR n conveyed through action/reaction Goal - channel undetectable or unobservable n Network watchers (sniffer, IDS, . . ) will not be aware that data is being transmitted n CMSC 691 I Clandestine Channels 7

Taxonomy (I) n Network covert channels can be n Storage-based n Timing-based n Frequency-based n Protocol-based n any CMSC 691 I combination of the above Clandestine Channels 8

Taxonomy (II) n Each of the above categories constitute a dimension of data n Information hiding in packet payload is outside the realm of network covert channels n These cases fit into the broader field of steganography CMSC 691 I Clandestine Channels 9

Packet Header Hiding 20 -64 bytes 0 -65, 488 bytes IP Header TCP Header DATA This is Information Assurance Class TCP Source Port TCP Destination Port IP Source Address TCP/IP Header can serve as a carrier for a steganographic covert channel IP Destination Address CMSC 691 I Clandestine Channels 10

IP Header 0 -44 bytes Fields that may be used to embed steganographic data CMSC 691 I Clandestine Channels 11

TCP Header 0 -44 bytes Timestamp CMSC 691 I Clandestine Channels 12

Storage Based n Information is leaked by hiding data in packet header fields n n n IP identification Offset Options TCP Checksum TCP Sequence Numbers CMSC 691 I Clandestine Channels 13

Timing Channels (I) n Information is leaked by triggering or delaying events at specific time intervals CMSC 691 I Clandestine Channels 14

Timing Channels (II) CMSC 691 I Clandestine Channels 15

Frequency Based (I) Information is encoded over many channels of cover traffic n The order or combination of cover channel access encodes information n CMSC 691 I Clandestine Channels 16

Frequency Based (II) CMSC 691 I Clandestine Channels 17

Protocol Based n Exploits ambiguities or non-uniform features in common protocol specifications CMSC 691 I Clandestine Channels 18

Traditional Detection Mechanisms Statistical methods n Storage-based n n n Time-based n n Data analysis Time analysis Frequency-based n Flow analysis CMSC 691 I Clandestine Channels 19

Threat Model n Passive Warden Threat Model n Active Warden Threat Model CMSC 691 I Clandestine Channels 20

IP Covert Channel IP allows fragmentation and reassembly of long datagrams, requiring certain extra headers n For IP Networks: n n n Data hidden in the IP header Data hidden in ICMP Echo Request and Response Packets Data tunneled through an SSH connection “Port 80” Tunneling, (or DNS port 53 tunneling) In image files CMSC 691 I Clandestine Channels 21

IP ID and TCP ISN Implementation Two fields which are commonly used to embed steganographic data are the IP ID and TCP ISN n Due to their construction, these fields contain some structure n n Partially unpredictable CMSC 691 I Clandestine Channels 22

Detection of TCP/IP Steganography n Each operating system exhibits well defined characteristics in generated TCP/IP fields n n can be used to identify anomalies that may indicate the use of steganography suite of tests n applied to network traces to identify whether the results are consistent with known operating systems CMSC 691 I Clandestine Channels 23

IP ID Characteristics 1. 2. 3. 4. Sequential Global IP ID Sequential Per-host IP ID IP-ID MSB Toggle IP-ID Permutation CMSC 691 I Clandestine Channels 24

TCP ISN Characteristics 5. 6. 7. 8. 9. 10. 11. Rekey Timer Rekey Counter ISN MSB Toggle ISN Permutation Zero bit 15 Full TCP Collisions Partial TCP Collisions CMSC 691 I Clandestine Channels 25

Explicit Steganography Detection 12. Nushu Cryptography encrypts data before including it in the ISN field n results in a distribution which is different from normally generated by Linux and so will be detected by the other TCP tests n CMSC 691 I Clandestine Channels 26

13. TCP Timestamp If a low bandwidth TCP connection is being used to leak information n a randomness test can be applied to the least significant bits of the timestamps in the TCP packets n If “too much“ randomness is detected in the LSBs → a steganographic covert channel is in use n CMSC 691 I Clandestine Channels 27

14. Other Anomalies unusual flags (e. g. DF when not expected, To. S set) n excessive fragmentation n use of IP options n non-zero padding n unexpected TCP options (e. g. timestamps from operating systems which do not generate them) n excessive re-ordering n CMSC 691 I Clandestine Channels 28

Results CMSC 691 I Clandestine Channels 29

Detection-Resistant TCP Steganography Schemes Lathra - Robust scheme, using the TCP ISNs generated by Open. BSD and Linux as a steganographic carrier n Simply encoding data within the least significant 24 bits of the ISN could be detected by the warden n CMSC 691 I Clandestine Channels 30

Conclusion TCP/IP header fields can be used as a carrier for a steganographic covert channel n Two schemes for encoding data with ISNs generated by Open. BSD and Linux n n indistinguishable from those generated by a genuine TCP stack CMSC 691 I Clandestine Channels 31

Future Work Flexible covert channel scheme which can be used in many channels n Create a protocol for jumping between multiple covert channels n New schemes to detect different encoding mechanisms in TCP/IP Header fields n CMSC 691 I Clandestine Channels 32

References Hide and Seek: An Introduction to Steganography, Niels Provos, Peter Honeyman, IEEE Security and Privacy Journal, May-June 2003 2. Embedding Covert Channels into TCP/IP, Steven J. Murdoch, Stephen Lewis, 7 th Information Hiding Workshop, Barcelona, Catalonia (Spain) June 2005 1. CMSC 691 I Clandestine Channels 33

Thanks a lot … For Your Presence CMSC 691 I Clandestine Channels 34

Any Questions CMSC 691 I Clandestine Channels 35

Homework Presentation Slides and Research Papers are available at : www. umbc. edu/~chauhan 2/CMSC 691 I/ CMSC 691 I Clandestine Channels 36

Covert Channel Tools n n SSH (SCP, FTP Tunneling, Telnet Tunneling, XWindows Tunneling, . . . ) - can be set to operate on any port (<1024 usually requires root privilege). Loki (ICMP Echo R/R, UDP 53) NT - Back Orifice (BO 2 K) plugin BOSOCK 32 Reverse WWW Shell Server - looks like a HTTP client (browser). App headers mimic HTTP GET and response commands. CMSC 691 I Clandestine Channels 37

Linux 2. 0 ISN Generator CMSC 691 I Clandestine Channels 38

Linux ISN and ID generator CMSC 691 I Clandestine Channels 39

Open BSD ISN generator CMSC 691 I Clandestine Channels 40