Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 55 Implementation ................................................................................................................365.1 Introduction ........................................................................................................................365.2 Testing Network .................................................................................................................365.3 Foundation Software...........................................................................................................375.3.1 HTTP Analysers ........................................................................................................375.3.2 HTTP Proxies............................................................................................................395.3.3 Web browsers ............................................................................................................405.4 Experimental Applications ..................................................................................................405.4.1 HTTP Dumper ...........................................................................................................405.4.2 OffLine HTTP Analyser.............................................................................................415.4.3 Filtering Proxy...........................................................................................................415.4.4 Data Hiding Proxy .....................................................................................................425.4.5 Browser Caller...........................................................................................................435.4.6 Browser Timer...........................................................................................................455.5 Covert Channel Detection System Prototype........................................................................455.6 Conclusions ........................................................................................................................466 Experiment Data Analysis............................................................................................476.1 Introduction ........................................................................................................................476.2 Experiments........................................................................................................................476.2.1 Experiment 1 – Implementation Specific Data Gathering............................................476.2.2 Experiment 2 – Request Information Filtering ............................................................496.2.3 Experiment 3 – Headers Modification ........................................................................506.2.4 Experiment 4 – Browser Signature Recognition..........................................................516.2.5 Experiment 5 – Covert Channel Detection ..................................................................526.2.6 Experiment 6 – Analysing Prototype’s Load on the Test Network...............................536.2.7 Experiment 7 – Code Mobility Check.........................................................................546.3 Conclusions ........................................................................................................................557 Discussion, Conclusions and Further Work..........................................................567.1 Introduction ........................................................................................................................567.2 Discussion & Prototype Evaluation .....................................................................................567.3 Test Inadequacies................................................................................................................587.4 Conclusions ........................................................................................................................587.5 Further Work ......................................................................................................................608 References..........................................................................................................................619 Appendices.........................................................................................................................63Appendix 1 - Experiment 2 Results ...............................................................................................63Appendix 2 – Experiment 3 Results...............................................................................................65Appendix 3 - HTTP Protocol.........................................................................................................67Appendix 3 – Project Presentation.................................................................................................74Appendix 4 - Inline Filtering Agent - Code Listing........................................................................79Appendix 5 - HTTP Analyser Foundation - Code Listing...............................................................93Appendix 6 – Browser Timer - Code Listing ...............................................................................104Appendix 7 – Browser Caller - Code Listing ...............................................................................108Appendix 8 – Data Hiding Proxy - Code Listing..........................................................................114Appendix 10 - HTTP Dumper - Code Listing ..............................................................................121Appendix 11 – Experimant 1 - Code Listing................................................................................130Appendix 12 – Experiment 2 & 3 - Code Listing .........................................................................137