Hidden channels - Revision history

.FUF at 15:42, 17 February 2009

2009-02-17T15:42:44Z

.FUF: removed dead link, added new links

2009-02-17T15:41:50Z

removed dead link, added new links

.FUF at 17:09, 23 October 2008

2008-10-23T17:09:34Z

.FUF: Detection of hidden channels

2008-10-10T19:15:33Z

Detection of hidden channels

.FUF: New page: {{expand}} '''Hidden channels''' (covert channels) are communication channels that transmit information without the authorization or knowledge of the channel's designer, owner, or operato...

2008-10-09T19:29:55Z

New page: {{expand}} '''Hidden channels''' (covert channels) are communication channels that transmit information without the authorization or knowledge of the channel's designer, owner, or operato...

New page

{{expand}}

'''Hidden channels''' (covert channels) are communication channels that transmit information without the authorization or knowledge of the channel's designer, owner, or operator.

== Common Uses ==

* Bypassing network filters;
* Bypassing network [[Sniffer|sniffers]].

== Techniques ==

Information can be hidden within:

* IP ID;
* TCP SEQ/ACK numbers;
* TCP options;
* etc.

== External Links ==

* [http://www.firstmonday.org/issues/issue2_5/rowland/ Covert Channels in the TCP/IP Protocol Suite]

[[Category:Network Forensics]]
[[Category:Steganography]]

@@ Line 26: / Line 26: @@
 * [http://en.wikipedia.org/wiki/Covert_channel Wikipedia: Covert channel]
 * [http://gray-world.net/ Unusual firewall bypassing techniques, network and computer security]
 * [http://www.sans.org/reading_room/whitepapers/covert/ SANS InfoSec Reading Room - Covert Channels]

@@ Line 25: / Line 25: @@
 == External Links ==
-* [http://www.firstmonday.org/issues/issue2_5/rowland/ Covert Channels in the TCP/IP Protocol Suite]
+* [http://en.wikipedia.org/wiki/Covert_channel Wikipedia: Covert channel]
 * [http://www.sans.org/reading_room/whitepapers/covert/ SANS InfoSec Reading Room - Covert Channels]
 [[Category:Network Forensics]]
 [[Category:Steganography]]

@@ Line 11: / Line 11: @@
 * IP ID;
-* TCP SEQ/ACK numbers;
+* TCP ISN;
 * TCP options;
 * etc.
@@ Line 19: / Line 21: @@
 Generally, it is impossible to detect well-designed hidden channels by means of traffic analysis. For example, information hidden within TLS ''Client/Server Hello'' random bytes in encrypted form cannot be distinguished from bytes produced by secure random number generator.
-However, it is possible to detect hidden channels by detecting attendant events, such as successful intrusion attempts.
+However, it is possible to detect hidden channels by detecting attendant events, such as successful intrusion attempts. Some hidden channels produce network anomalies, for example, hidden channels using DNS ID to hide information may produce large number of DNS queries without further communication between hosts.
 == External Links ==
 * [http://www.firstmonday.org/issues/issue2_5/rowland/ Covert Channels in the TCP/IP Protocol Suite]
 [[Category:Network Forensics]]
 [[Category:Steganography]]

@@ Line 1: / Line 1: @@
 '''Hidden channels''' (covert channels) are communication channels that transmit information without the authorization or knowledge of the channel's designer, owner, or operator.
@@ Line 16: / Line 14: @@
 * TCP options;
 * etc.
 == External Links ==