Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 233.4 HTTP ProtocolFollowing description of HTTP protocol is a part of larger document, written by theauthor of this dissertation, which highlights the possibilities of implementing covertchannels in this Application Layer protocol. The full content is of this document isattached to this dissertation in Appendix 4.The application layer protocol called HTTP is often perceived as very basic protocolfor distribution of World Wide Web pages. We could say that even its nameHypertext Transfer Protocol is very suggestive and implies that the purpose of thisprotocol is to transfer hypertext, where hypertext is defined as textual data “linked”across many documents or locations. It makes no wonder then, that some networkadministrators do not consider HTTP as a threat or think that as long as only outgoingestablished connections are permitted and every machine in the network uses somekind of firewall and antivirus software, they network is secure. However the true faceof the protocol is different. The most recent specification of HTTP is RFC 2616 andthe purpose of the protocol is described as follows:The Hypertext Transfer Protocol (HTTP) is an application-levelprotocol for distributed, collaborative, hypermedia informationsystems. HTTP has been in use by the World-Wide Web globalinformation initiative since 1990. The first version of HTTP, referredto as HTTP/0.9, was a simple protocol for raw data transfer across theInternet. HTTP/1.0, as defined by RFC 1945, improved the protocol byallowing messages to be in the format of MIME-like messages,containing metainformation about the data transferred and modifierson the request/response semantics. (Fielding, et al, 1999, pp. 7)HTTP is now well established protocol and the current version is 1.1, however theidea of the protocol stayed the same. Through employing a simple human readable(MIME-like) syntax and allowing transfer of virtually any kind of data, HTTPbecome a preferred protocol in development of “on-line” applications. Furthermorethe fact that a large group of network administrators allowed almost any outgoingconnections of HTTP either directly or through proxies contributed strongly to thistrend. Nowadays almost any software application, which requires communicationover the Internet, employs HTTP or has a build in functionality allowing itsapplication layer protocol to be tunnelled in HTTP. Example of the first kind could beantivirus software that uses HTTP for downloading signatures of the newest threatsfrom the central server, or an update agent for an application like internet messenger.The implementations of the remote method invocation or remote procedure call are,thus, common examples of the second kind of the applications.HTTP was identified as one of three protocols, which can be employed to createcovert channels for sending data in and out of networks commonly considered to besecure. Thus the following section will identify, where RFC 2616 as the documentwhich defines the current version of HTTP in use, gives hackers an open field forhiding data.3.4.1 HTTP Syntax and Covert ChannelsRFC 2616 was created to clear up some hard to understand statements from theprevious documentations of HTTP (namely 1.0 and 0.9) and to introduce few optional