Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 50control should not be employed, due to a nature of information send by client’ssoftware in requests using cache control. This is due to the fact, that some of thisinformation (sent in plain text) may give potential listener detailed data on softwareused by the inside host.We think current implementations of HTTP/1.1 protocol send a number of redundantdata in their messages. In this experiment only a number of request headers have beenput to test, however, out of five headers, three have been identified as not beingrelevant anymore. Thus, we think an in depth study of data send be HTTP clients andserver responses is needed, to produce a new specification to this protocol basedaround statistical data of current implementations.6.2.3 Experiment 3 – Headers ModificationIn previous sections of this report, we have identified six different techniques to hidedata inside HTTP transaction messages. However, these methods were identified astheoretical and since Experiment 1 proved that there are many differentimplementations of HTTP specification, the objective of this experiment was to testthe behaviour various servers, to suggested data hiding scenarios. The physical andlogical setup for this experiment was very similar to that of Experiment 2. Thus, Host2 was generating two requests for each website in ‘sites’ file. The requests followedtwo different paths, one with forward Proxy, where no modifications were performed,and one with Data Hiding Proxy on the way, so that the request could be modifiedaccordingly to the requirements. Thus, we have tested five different data hidingscenarios:(a) Case ModificationFrom HTTP specification, we know that all header names are case-insensitive. Thus,in this scenario, Data Hiding Proxy has been used to change header names’ casing,from the usual title-case, to uppercase.(b) Undefined HeaderClient and server software, which conform to HTTP/1.1 standard must ignoreunrecognised headers, i.e. threat the transaction, as they would if the header was notthere. Therefore, to test this data hiding technique Data Hiding Proxy was configuredto add an extra header (‘Covert-Channel: A covert data’) to every request passing through it.(c) Linear Spacing ModificationThis scenario employed the fact that HTTP software should interpret consequentlinear spacing characters as a single white space. Thus combination of white spacesand linear tabulators was appended to every header in requests passing through DataHiding Proxy.(d) Optional HeaderOptional header ‘Via’ with a value ‘A covert data’ was added to each request whentesting this scenario.(e) Headers’ ReorderingIn this test Data Hiding Proxy was used to change the order of two first headers ineach request, since software conform to HTTP/1.1 should ignore the order of theheaders of different name.The only data hiding technique not tested in this experiment was the modification ofserver object. This is due, to the fact that appropriate scenario would need to employstandard unmodified HTTP requests, to access server object. Thus, since thetechnique doesn’t involve modification of the request it cannot negatively affectHTTP server software and would produce results identical to the baseline.