Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 66Linear Spacing Modification% OF RESPONSES100%80%60%40%20%0%200 206 301 302 304 400 403 404 500RESPONSE CODEForw ard ProxyData Hiding ProxyResponses to Requests with Linear Spacing ModifiedNumbers of ‘404’ error responses are similar for both forward Proxy and Data Hiding Agent.A small percentage of modified requests, however, resulted in ‘400’, ‘403’ and ‘500’ type responses.Thus, although this data hiding method is allowed by RFC 2616 some server software implementationsdo not process them in required manner. However, covert channel implementation employing thisvulnerability of RFC 2616 is still possible, since the number of error responses in negligible.Optional Header Added% OF RESPONSES100%80%60%40%20%0%200 301 302 303 304 403 404RESPONSE CODEForw ard Proxy Data Hiding ProxyResponses to Requests with Optional Header (‘Via’) AddedNumbers of error responses (‘403’, ‘404’) are negligible and similar for both forward Proxy and DataHiding Agent. This suggests that HTTP servers’ implementations comply with RFC 2616 specification,by ignoring any unrecognised headers.Headers' Reordering% OF RESPONSES100%80%60%40%20%0%200 206 301 302 303 304 400 403 404RESPONSE CODEForw ard ProxyData Hiding ProxyResponses to Requests with Modified Headers’ OrderNumbers of ‘403’ and ‘404’ error responses are similar for both forward Proxy and Data Hiding Agent.Thus, with only negligible number of code ‘400’ responses (less than 1%), we assume headerreordering may be used to produce covert channels implementations.