Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 25visual inspection of the HTTP envelope would reveal this covert channel, however asit is unusual for anybody to examine HTTP message header and HTTP clients andservers would ignore casing, this kind of covert channel could be successfullydeployed.Linear white spacing.Another reason for concern is the fact that according to RFC 2616 the field-content(the data part of field-value) can be preceded and followed by an optional linear whitespacing (LWS). LWS can be made up from a non-compulsory CRLF and one or morespace (SP) or horizontal tab (HT) character.LWS = [CRLF] 1*(SP|HT)Header values may be folded onto multiple lines using CRLF as long as the new linestarts with a space or horizontal tab. Thus, all linear white space in a header may bereplaced with a single SP before processing or forwarding the message downstream.This allows for a text decoration in the HTTP messages and has no real meaning inprocessing of the requests and responses. However it creates room for bidirectionalcovert channels. In a case where there is no HTTP Proxy between communicatingsites, or linear white spaces are left unaltered by a Proxy, it is possible to encodeinformation using SP and HT characters. An example illustrates how linear whitespace characters may be employed to transfer covert payload in the following header:“Connection: keep-alive”Header name Connection followed by a colon “:”, a space SP and the value keepalive:“Connection” “:” SP “keep-alive”Let assume that 1’s are encoded as HTs and 0’s as SPs. Now if the single SP would bereplaced with a combination of HTs and SPs, the meaning of the HTTP header wouldnot change, but a binary stream could be hidden in the header. Thus a byte ofinformation which in binary form is 01011100 could be encoded in one of thefollowing ways:“Connection” “:” SP HT SP HT HT HT SP SP “keep-alive”“Connection” “:” SP “keep-alive” SP HT SP HT HT HT SP SP“Connection” “:” SP “keep-alive” CRLFSP HT SP HT HT HT SP SPThere is virtually no limit to a number of bits per message that can be sent using thismethod, apart of the size limits set for different kinds of requests and responses. If bitsencoded in this way are placed in front of a header value a visual examination of theHTTP message would be enough to reveal the disguise, however if they follow thefield-value contents or a CRLF only examination of the message bytes would exposethe covert channel.Order of headers.Above technique is not the last reason why HTTP messages are such s good carrierfor covert channels. The generic-message syntax does not specify the order in which