Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 10Traditionally all the documents relating to data hiding and cryptography, since RonRivest’s article presenting RSA cryptosystem in 1978, sender is not being calledperson A but is named Alice, and the receiver is called Bob instead of person B(Rivest, 1978). This scheme is used in this report, to make the discussions easier tofollow, for the convenience of the reader. Thus, eavesdropper system in this scheme isalso called Eve (Figure 1-1).In covert channel scenarios Alice is often considered to be an inmate of a highsecurity prison. It is assumed that she knows an escape plan from a prison where Bobis spending his sentence. Alice is trying to send the escape plan to Bob, however Eve,the governor checks their communication very precisely, thus they employ covertchannel know to them to sent the secret messages. Figure 1-2 illustrates basic methodof information hiding employing plain text message as a carrier (first letters of thewords in the message combined together form: LetTheMissionBegin).Let everyone tango.This has Edward’smind in some simple inquiry of nothing,before everyone gets into Nirvana.Figure 1-2 Cover Channel (Buchanan, 2006)1.4 Project Aims and ObjectivesThis project began with intend of analysing possible counter measures to ApplicationLayer covert channels technologies. Therefore following aims were specified:(a) Research possible carriers of covert information at Application Layer ofInternet protocol suite.(b) Prototype suitable CCDS.(c) Evaluate the prototype and suggest a framework for identifying detectionsystems’ sensitivity, to various types of covert traffic, as well as capability ofintroducing noise into the suspected channels.In order to accomplish these aims, following objectives were also defined:(a) Investigate current research of covert channels and technologies available fortheir detection and limitation.(b) Choose a programming language suitable for prototyping of CCDS.(c) Define testing environment for the prototype’s evaluation.(d) Propose further research areas.