Covert Channels in Transport Layer Security

ABSTRACT

Network covert channels embedded within network conversations are becoming widely adopted to enforce privacy of users or bypass censorship attempts as well as by malware to remain unnoticed while exfiltrating data or coordinating an attack. As a consequence, being able to design a network covert channel or anticipate its exploitation is of paramount importance to fully assess the security of the Internet. Since prime requirements for a successful covert channel are its stealthiness and bandwidth, the popularity, availability and performances of the overt traffic flows used as the carrier play a major role. Therefore, in this paper we investigate the use of ubiquitous Transport Layer Security (TLS) to contain hidden information for implementing network covert channels. Specifically, we review seven methods targeting TLS traffic and investigate the performances of three covert channels through an experimental measurement campaign. Obtained results indicate the feasibility of using TLS traffic as the carrier and also allow to derive some general indications for the development of countermeasures.

References

1. V. Berk, A. Giani, and G. Cybenko. 2005. Detection of covert channel encoding in network packet delays. Technical report TR536, TU Dartmouth 19 (2005).
2. K. Cabaj, L. Caviglione, W. Mazurczyk, S. Wendzel, A. Woodward, and S. Zander. 2018. The new threats of information hiding: The road ahead. IT Professional 20, 3 (2018), 31--39.
3. Alessandro Carrega, Luca Caviglione, Matteo Repetto, and Marco Zuppelli. 2020. Programmable Data Gathering for Detecting Stegomalware. In 2020 6th IEEE Conference on Network Softwarization (NetSoft). IEEE, 422--429.
4. L. Caviglione. 2009. Can satellites face trends? The case of Web 2.0. In 2009 International Workshop on Satellite and Space Communications. IEEE, 446--450.
5. L. Caviglione, M. Gaggero, E. Cambiaso, and M. Aiello. 2017. Measuring the energy consumption of cyber security. IEEE Comm. Magazine 55, 7 (2017), 58--63.
6. E. Crockett, C. Paquin, and D. Stebila. 2019. Prototyping post-quantum and hybrid key exchange and authentication in TLS and SSH. IACR Cryptol. ePrint Arch. 2019 (2019), 858.
7. T. Dierks and E. Rescorla. 2008. RFC 5246-the transport layer security (TLS) protocol version 1.2. The Internet Engineering Task Force (IETF) (2008).
8. D. Eastlake et al. 2011. Transport layer security (TLS) extensions: Extension definitions. Technical Report. RFC 6066, January.
9. W. Frączek, W. Mazurczyk, and K. Szczypiorski. 2012. Hiding information in a stream control transmission protocol. Computer Comm. 35, 2 (2012), 159--169.
10. R. Holz, J. Amann, O. Mehani, M. Wachs, and M. Kaafar. 2015. TLS in the wild: An Internet-wide analysis of TLS-based protocols for electronic communication. arXiv preprint arXiv:1511.00341 (2015).
11. A. Iacovazzi and Y. Elovici. 2016. Network flow watermarking: A survey. IEEE Communications Surveys & Tutorials 19, 1 (2016), 512--530.
12. J. Kaur, S. Wendzel, O. Eissa, J. Tonejc, and M. Meier. 2016. Covert channel-internal control protocols: attacks and defense. Security and Communication Networks 9, 15 (2016), 2986--2997.
13. B. W. Lampson. 1973. A Note on the Confinement Problem. Commun. ACM 16, 10 (Oct. 1973), 613--615.
14. W. Mazurczyk. 2013. VoIP Steganography and Its Detection---A Survey. ACM Comput. Surv. 46, 2, Article 20 (Dec. 2013), 21 pages.
15. W. Mazurczyk and L. Caviglione. 2014. Steganography in modern smartphones and mitigation techniques. IEEE Comm. Surveys & Tutorials 17, 1 (2014), 334--357.
16. W. Mazurczyk and L. Caviglione. 2015. Information Hiding as a Challenge for Malware Detection. IEEE Security & Privacy 2 (2015), 89--93.
17. J. Merrill and D. Johnson. 2015. Covert channels in SSL session negotiation headers. In Proc. of the Conference on Security and Management. 70--72.
18. R. Rios, J. Onieva, and J. Lopez. 2013. Covert Communications through Network Configuration Messages. Computers & Security 39 (11 2013), 34--46.
19. J. Saenger, W. Mazurczyk, J. Keller, and L. Caviglione. 2020. VoIP network covert channels to enhance privacy and information sharing. Future Generation Computer Systems 111 (2020), 96--106.
20. S. Schmidt, W. Mazurczyk, R. Kulesza, J. Keller, and L. Caviglione. 2018. Exploiting IP telephony with silence suppression for hidden data transfers. Computers & Security 79 (2018), 17--32.
21. A. Velinov, A. Mileva, S. Wendzel, and W. Mazurczyk. 2019. Covert Channels in the MQTT-Based Internet of Things. IEEE Access 7 (2019), 161899--161915.
22. C. Wang, Y. Yuan, and L. Huang. 2016. Base communication model of IP covert timing channels. Frontiers Comput. Sci. 10, 6 (2016), 1130--1141.

Index Terms

• Security and privacy

  • Network security

  • Security services

    • Pseudonymity, anonymity and untraceability

  • Systems security

    • Distributed systems security

    • Information flow control