Chapter 3 Time-to-live Covert Channels - CAIA

CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS
If the overt traffic is TCP Alice and Bob could use TCP sequence numbers to mitigate
the effects of packet loss and reordering. Alice has to store tuples of bits sent and TCP
sequence numbers in a buffer. When she detects a TCP retransmission she must re-encode
the bits sent previously. Bob needs to buffer received packets and put them in the right
order, according to the TCP sequence numbers before decoding.
3.6 Conclusions
We analysed the characteristics of normal TTL variation from several traffic traces. We
showed that normal TTL changes only occurred in less than 1% of packet pairs, but in
2–6% of the flows. The large majority of flows with changes had only two different TTL
values differing by one. This noise reduces the channel capacity, but on the other hand
it improves the stealth of the channel. Without normal TTL variation the covert channel
would be trivial to detect.
We presented several novel improved modulation schemes. Our new schemes are
stealthier and can be used with passive channels. Furthermore, they provide up to 5%
higher capacities than previous schemes. However, even with the improved schemes the
channel is still detectable, as we will show in Chapter 7.
We then proposed an information-theoretic model for the channel that can be used to
determine the channel capacity based on errors caused by normal TTL variation, packet
loss and packet reordering. The model is not limited to the TTL channel; it could be
applied to direct storage channels in other IP header fields. We also developed techniques
for reliable data transmission over the covert channel.
Since the TTL noise distributions are complex and cannot be modelled easily we anal-
ysed the error rates of the different modulation schemes by emulating the covert channel
using overt traffic from traces. For a minimum TTL amplitude the average error rates
across all traces vary between 1 −3 and 1 −2 . Larger amplitudes reduce the error rates but
also reveal the covert channel, given the characteristics of normal TTL variation.
Based on the channel model and the measured error rates we estimated the capacities
and transmission rates. Without packet loss and reordering the capacity is over 0.9 bits
per overt packet or packet pair. But it reduces quickly with increasing packet loss and
reordering. The transmission rates range from tens of bits per second up to a few kilobits
per second.
We carried out several experiments to evaluate the throughput of the reliable transport
technique. We emulated covert channels using overt traffic from traces and simulated
packet loss and reordering. With a hybrid FEC+ARQ scheme we achieved throughputs
of 60% or more of the capacity, with rates of up to several hundreds of bits per second.
72