Exploiting error control in network traffic for robust, high rate covert channels

Authors:
William K. Geissler;John C. McEachen
Affiliations:
Department of Electrical and Computer Engineering, Naval Postgraduate School, Monterey, CA, USA.;Department of Electrical and Computer Engineering, Naval Postgraduate School, Monterey, CA, USA
Venue:
International Journal of Electronic Security and Digital Forensics
Year:
2007

Citing 4
Cited 0

TCP/IP illustrated (vol. 1): the protocols

TCP/IP illustrated (vol. 1): the protocols
End-to-end internet packet dynamics

IEEE/ACM Transactions on Networking (TON)
Hiding Data in the OSI Network Model

Proceedings of the First International Workshop on Information Hiding
On the limits of steganography

IEEE Journal on Selected Areas in Communications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Current means of steganography within network traffic are limited in terms of throughput and robustness. We present a novel concept for establishing reliable two-way covert channels that exchange information at a significantly higher rate compared to previous methods. This concept exploits the difficulty in differentiating between erroneous data and unauthorised data. As a proof-of-concept, we examine how the manipulation of Transmission Control Protocol (TCP) error handling may be used for global covert information transfer. Specifically, a new TCP routing application was developed to embed hidden information into cover media and to retrieve the information at the receiving end. A flexible testing architecture was designed and implemented that may also be used to test other steganographic techniques. Error handling techniques for the hidden information were identified for the steganographic protocol, to increase the robustness of the hidden information. Finally, steganalytic techniques and tools have been identified to counter the use of this technique by unfriendly forces.