Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 71http://abc.com/~smithhttp://abc.com/%7Esmithhttp://abc.com/%7esmithFollowing a question mark (“?”) a query can be add to the URI. This is a commonway to transmit data from html forms to the servers. In many cases additionalinformation not required by the server is ignored and individuals can be tempted touse it as a cover channel (Dyatlov, et al. 2003). Although development of anautomated system to uncover this type of activity can prove to be a complex task, thechannel may be identified by simple visual examination of an address bar in abrowser.This is not the end of the optional arrangements of the RFC under examination.Another possibility to encode few bits per message is by alternative use of the threepossible formats of the date allowed. Fortunately this time the creators of thespecification stated that although on the receiving end all three formats should betreated as valid, implementations MUST generate only the RFC 1123 format. Thanksto this statement all HTTP/1.1 messages consisting of different date format than theone specified in the relevant document can be considered as invalid, while anypackets with HTTP version different than 1.1 should be treated as highly suspiciousanyway.Request messageIn HTTP communications request messages are send from clients to servers in orderto request a services. The client must specify the method (service required), identifyresource and the protocol version it is willing to employ in the start-line of HTTPrequest message. As described earlier, the start-line is followed by message-headerfields, compulsory empty line and optional message-body.Request-Line = Method SP Request-URI SP HTTP-Version CRLFFrom the above syntax the fact that “linear white spacing” hiding technique cannot beemployed in the Request-Line can be derived. Method and HTTP-version fields arecase-sensitive, but the Request-URI follows requirements described in URI section ofprevious paragraph, so may be used as a covert channel. There are eight methodsspecified by RFC 2616, but the document allows for extending this list with additionalcustom methods as long as both sides can understand them. Following is a list ofmethods identified by the document:- OPTION- GET- HEAD- POST- PUT- DELETE- TRACE- CONNECTIn theory it is possible to cipher a payload by alternating request methods or bydefining a new set of methods. For example any time a client sends GET request therecipient could treat it as 0 and any time a HEAD method is received it should bedecoded as 1. When a new set of request methods is defined it is possible to transmit