Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 42Figure 5-7 Filtering Proxy5.4.4 Data Hiding ProxyThe Data Hiding Agent was designed so it may perform functions of writing andreading from the covert channel. Since we are experimenting with six different datahiding methods, basic implementation of all of them is present. Thus, in order tocreate traffic and write to covert channel a standard Web browser is used, with Proxysettings pointing to the local loop back address (127.0.0.1) of the host. On the localloop back address there is a modified implementation of HTTP Proxy, i.e. DataHiding Proxy (Figure 5-8), preset with the destination IP address and in the ‘Sender’mode.Figure 5-8 Data Hiding ProxyTherefore, any request made from the browser will be modified with covert channelinformation and forwarded to the recipient. Then, the recipient, a Data Hiding Proxyset in ‘Receiver’ mode, will read the data from the covert channel (only when therequest came from the preset originator), and forward the request to the target. Thus,