Hispanopedia Wiki
Articulo de referencia

Covert channel

In computer security , a covert channel is a type of attack that creates a capability to transfer information objects between processes that are not supposed to be allowed to co...

Hispanopedia WikiContenido en espanolLectura gratuita

In computer security, a covert channel is a type of attack that creates a capability to transfer information objects between processes that are not supposed to be allowed to communicate by the computer security policy. The term, originated in 1973 by Butler Lampson, is defined as channels "not intended for information transfer at all, such as the service program's effect on system load," to distinguish it from legitimate channels that are subjected to access controls by COMPUSEC.[1]

Characteristics

A covert channel is so called because it is hidden from the access control mechanisms of secure operating systems since it does not use the legitimate data transfer mechanisms of the computer system (typically, read and write), and therefore cannot be detected or controlled by the security mechanisms that underlie secure operating systems. Covert channels are exceedingly hard to install in real systems, and can often be detected by monitoring system performance. In addition, they suffer from a low signal-to-noise ratio and low data rates (typically, on the order of a few bits per second). They can also be removed manually with a high degree of assurance from secure systems by well established covert channel analysis strategies.

Covert channels are distinct from, and often confused with, legitimate channel exploitations that attack low-assurance pseudo-secure systems using schemes such as steganography or even less sophisticated schemes to disguise prohibited objects inside of legitimate information objects. The legitimate channel misuse by steganography is specifically not a form of covert channel.

Covert channels can tunnel through secure operating systems and require special measures to control. Covert channel analysis is the only proven way to control covert channels. By contrast, secure operating systems can easily prevent misuse of legitimate channels, so distinguishing both is important. Analysis of legitimate channels for hidden objects is often misrepresented as the only successful countermeasure for legitimate channel misuse. Because this amounts to analysis of large amounts of software, it was shown as early as 1972 to be impractical.[2] Without being informed of this, some are misled to believe an analysis will "manage the risk" of these legitimate channels.

TCSEC criteria

The Trusted Computer Security Evaluation Criteria (TCSEC) was a set of criteria, now deprecated, that had been established by the National Computer Security Center, an agency managed by the United States' National Security Agency.

Lampson's definition of a covert channel was paraphrased in the TCSEC[3] specifically to refer to ways of transferring information from a higher classification compartment to a lower classification. In a shared processing environment, it is difficult to completely insulate one process from the effects another process can have on the operating environment. A covert channel is created by a sender process that modulates some condition (such as free space, availability of some service, wait time to execute) that can be detected by a receiving process.

The TCSEC defines two kinds of covert channels:

  • Storage channels - Communicate by modifying a "storage location", such as a hard drive.
  • Timing channels - Perform operations that affect the "real response time observed" by the receiver.

The TCSEC, also known as the Orange Book,[4] requires analysis of covert storage channels to be classified as a B2 system and analysis of covert timing channels is a requirement for class B3.

Timing channels

The use of delays between packets transmitted over computer networks was first explored by Gray Girling[5] for covert communication. This work motivated many other works to establish or detect a covert communication and analyze the fundamental limitations of such scenarios.

Identifying covert channels

Ordinary things, such as existence of a file or time used for a computation, have been the medium through which a covert channel communicates. Covert channels are not easy to find because these media are so numerous and frequently used.

Two relatively old techniques remain the standards for locating potential covert channels. One works by analyzing the resources of a system and other works at the source-code level.

Eliminating covert channels

The possibility of covert channels cannot be eliminated,[2] although it can be significantly reduced by careful design and analysis.

The detection of a covert channel can be made more difficult by using characteristics of the communications medium for the legitimate channel that are never controlled or examined by legitimate users. For example, a file can be opened and closed by a program in a specific, timed pattern that can be detected by another program, and the pattern can be interpreted as a string of bits, forming a covert channel. Since it is unlikely that legitimate users will check for patterns of file opening and closing operations, this type of covert channel can remain undetected for long periods.

A similar case is port knocking. In usual communications the timing of requests is irrelevant and unwatched. Port knocking makes it significant.

Data hiding in OSI model

Handel and Sandford presented research where they study covert channels within the general design of network communication protocols.[6] They employ the OSI model as a basis for their development in which they characterize system elements having potential to be used for data hiding. The adopted approach has advantages over these because standards opposed to specific network environments or architectures are considered.

Their study does not aim to present foolproof steganographic schemes. Rather, they establish basic principles for data hiding in each of seven OSI layers. Besides suggesting the use of the reserved fields of protocols headers (that are easily detectable) at higher network layers, they also propose the possibility of timing channels involving CSMA/CD manipulation at the physical layer.

Their work identifies covert channel merit such as:

  • Detectability: Covert channel must be measurable by the intended recipient only.
  • Indistinguishability: Covert channel must lack identification.
  • Bandwidth: number of data hiding bits per channel use.

Their covert channel analysis does not consider issues such as interoperability of these data hiding techniques with other network nodes, covert channel capacity estimation, effect of data hiding on the network in terms of complexity and compatibility. Moreover, the generality of the techniques cannot be fully justified in practice since the OSI model does not exist per se in functional systems.

Data hiding in LAN environment by covert channels

Girling analizó por primera vez los canales encubiertos en un entorno de red. Su trabajo se centró en las redes de área local (LAN), en las que identificó tres canales encubiertos evidentes (dos de almacenamiento y uno de sincronización). Esto demostró ejemplos reales de las posibilidades de ancho de banda para canales encubiertos simples en LAN. Para un entorno LAN específico, el autor introdujo la noción de un espía que monitorea las actividades de un transmisor específico en la LAN. Las partes que se comunican de forma encubierta son el transmisor y el espía. Según Girling, la información encubierta puede comunicarse a través de cualquiera de las siguientes formas evidentes:

  1. Al observar las direcciones a las que se dirige el transmisor, si el número total de direcciones a las que puede dirigirse un remitente es 16, existe la posibilidad de una comunicación secreta con 4 bits para el mensaje secreto. El autor denominó a esta posibilidad canal de almacenamiento encubierto, ya que depende de lo que se envía (es decir, a qué dirección se dirige el remitente).
  2. De igual modo, el otro canal de almacenamiento encubierto obvio dependería del tamaño de la trama enviada por el remitente. Para los 256 tamaños posibles, la cantidad de información encubierta descifrada a partir de un tamaño de trama sería de 8 bits. Este escenario también se denominó canal de almacenamiento encubierto.
  3. El tercer escenario presentado utiliza la presencia o ausencia de mensajes. Por ejemplo, "0" para un intervalo de tiempo de mensaje impar, "1" para uno par.

El escenario transmite información encubierta mediante una estrategia de "envío en el momento", por lo que se denomina canal encubierto temporizado. El tiempo de transmisión de un bloque de datos se calcula en función del tiempo de procesamiento del software, la velocidad de la red, el tamaño de los bloques de red y la sobrecarga del protocolo. Suponiendo que se transmiten bloques de diversos tamaños en la LAN, la sobrecarga del software se calcula en promedio y se utiliza una nueva evaluación del tiempo para estimar el ancho de banda (capacidad) de los canales encubiertos.

Ocultación de datos en el conjunto de protocolos TCP/IP mediante canales encubiertos

Centrándose en las cabeceras IP y TCP del conjunto de protocolos TCP/IP, un artículo publicado por Craig Rowland propone técnicas adecuadas de codificación y decodificación mediante el uso del campo de identificación IP, el número de secuencia inicial TCP y el número de secuencia de acuse de recibo. [ 7 ] Estas técnicas se implementan en una sencilla utilidad escrita para sistemas Linux con núcleos de la versión 2.0.

Rowland proporciona una prueba de concepto , así como técnicas prácticas de codificación y decodificación para la explotación de canales encubiertos mediante el conjunto de protocolos TCP/IP. Estas técnicas se analizan considerando mecanismos de seguridad como la traducción de direcciones de red (NAT) de los cortafuegos .

However, the non-detectability of these covert communication techniques is questionable. For instance, a case where sequence number field of TCP header is manipulated, the encoding scheme is adopted such that every time the same alphabet is covertly communicated, it is encoded with the same sequence number.

Moreover, the usages of sequence number field as well as the acknowledgment field cannot be made specific to the ASCII coding of English language alphabet as proposed, since both fields take into account the receipt of data bytes pertaining to specific network packet(s).

After Rowland, several authors in academia published more work on covert channels in the TCP/IP protocol suite, including a plethora of countermeasures ranging from statistical approaches to machine learning.[8][9][10][11] The research on network covert channels overlaps with the domain of network steganography, which emerged later.

See also

References

  1. ↑Butler Lampson (1 October 1973). "A note on the confinement problem". Communications of the ACM. 16 (10): 613–615. doi:10.1145/362375.362389. ISSN 0001-0782. Wikidata Q56446421.
  2. 12Computer Security Technology Planning Study (James P. Anderson, 1972)
  3. ↑NCSC-TG-030, Covert Channel Analysis of Trusted Systems (Light Pink Book), 1993 from the United States Department of Defense (DoD) Rainbow Series publications.
  4. ↑5200.28-STD, Trusted Computer System Evaluation Criteria (Orange Book), 1985Archived 2006-10-02 at the Wayback Machine from the DoD Rainbow Series publications.
  5. ↑GIRLING, GRAY (February 1987). "Covert Channels in LAN's". IEEE Transactions on Software Engineering. SE-13 (2): 292–296. doi:10.1109/tse.1987.233153. S2CID 3042941. ProQuest 195596753.
  6. ↑Hiding data in the OSI network modelArchived 2014-10-18 at the Wayback Machine, Theodore G. Handel and Maxwell T. Sandford II (2005)
  7. ↑Covert Channels in the TCP/IP Protocol SuiteArchived 2012-10-23 at the Wayback Machine, 1996 Paper by Craig Rowland on covert channels in the TCP/IP protocol with proof of concept code.
  8. ↑Zander, S.; Armitage, G.; Branch, P. (2007). "A survey of covert channels and countermeasures in computer network protocols". IEEE Communications Surveys and Tutorials. 9 (3). IEEE: 44–57. doi:10.1109/comst.2007.4317620. hdl:1959.3/40808. ISSN 1553-877X. S2CID 15247126.
  9. ↑Information hiding in communication networks : fundamentals, mechanisms, applications, and countermeasures. Mazurczyk, Wojciech., Wendzel, Steffen., Zander, Sebastian., Houmansadr, Amir., Szczypiorski, Krzysztof. Hoboken, N.J.: Wiley. 2016. ISBN 9781118861691. OCLC 940438314.{{cite book}}: CS1 maint: others (link)
  10. ↑Wendzel, Steffen; Zander, Sebastian; Fechner, Bernhard; Herdin, Christian (April 2015). "Pattern-Based Survey and Categorization of Network Covert Channel Techniques". ACM Computing Surveys. 47 (3): 50:1–50:26. arXiv:1406.2901. doi:10.1145/2684195. ISSN 0360-0300. S2CID 14654993.
  11. ↑Cabuk, Serdar; Brodley, Carla E.; Shields, Clay (April 2009). "IP Covert Channel Detection". ACM Transactions on Information and System Security. 12 (4): 22:1–22:29. CiteSeerX 10.1.1.320.8776. doi:10.1145/1513601.1513604. ISSN 1094-9224. S2CID 2462010.

Further reading

  • Timing Channels an early exploitation of a timing channel in Multics.
  • Covert channel tool hides data in IPv6, SecurityFocus, August 11, 2006.
  • Raggo, Michael; Hosmer, Chet (2012). Data Hiding: Exposing Concealed Data in Multimedia, Operating Systems, Mobile Devices and Network Protocols. Syngress Publishing. ISBN 978-1597497435.
  • Lakshmanan, Ravie (2020-05-04). "New Malware Jumps Air-Gapped Devices by Turning Power-Supplies into Speakers".
  • An open online class on covert channels (GitHub)
  • Gray-World - Open Source Research Team : Tools and Papers
  • Steath Network Operations Centre - Covert Communication Support System