Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 526.2.5 Experiment 5 – Covert Channel DetectionOnly the Proxy part of the designed prototype has been implemented in the course ofthe project, thus the functionality of the system is limited to protocol and signaturebaseddetection. In this experiment Inline Filtering Agent was located inside the testnetwork and the hosts (previously specified Web browsers on the hosts) wereconfigured to use it. Various requests were then generated, automatically as well as byhuman operators, most of them using browsers permitted to pass through the filteringProxy. This was to produce background noise and try to simulate a load of theFiltering Agent. Later Data Hiding Proxy was used to imitate few data hidingscenarios. During the experiment we were able to detect 100% of the data hidingscenarios based on:- HTTP header-name case modification- linear white space injection at the beginning or the end of header-value- modification of the headers’ order- addition of uncommon or undefined headerIn all the cases the IFA has properly identified the originators of the threats, byproviding remote-end socked information. This shown the advantage of usingdetection and filtering agents in-line with the requests. Since a Proxy must process allthe traffic before forwarding it, there is no chance of overlooking any well definedsignature.During the experiment we have also detected few applications of unknown signatures,different than Data Hiding Proxy. Thus, with a help of HTTP Analyser Foundationthe alerts were further investigated (Figure 6-4). Finally following automated agentsof the test network, has been identified:- Background Intelligent Transfer Service version 6.6 – Windows update agent- MSN Messenger 7.0 – MSN configuration agent- Gadu-Gadu Autoupdate – update agent of popular Polish communicator- GG – advert download of the Internet communicator mentioned above- Symantec Anti-virus Live Update agentWe were aware of the above software agents running in the test network, however,none of them were explicitly configured to use the Inline Filtering Agent. Later, it hasbeen identified, that Internet Explorer Proxy settings are being inherited by thoseapplications.Figure 6-4 Threat Detection