Question

Name and describe three covert tunneling strategies.

Answer 1

The TCSEC defines two kinds of covert channels:

• Storage channels - Communicate by modifying a "storage location", such as a hard drive.
• Timing channels - Perform operations that affect the "real response time observed" by the receiver.

The TCSEC, also known as the Orange Book, requires analysis of covert storage channels to be classified as a B2 system and analysis of covert timing channels is a requirement for class B3.

Timing Channels

The use of delays between packets transmitted over computer networks was first explored by Girling for covert communication. This work motivated many other works to establish or detect a covert communication and analyze the fundamental limitations of such scenarios.

Identifying covert channels

Ordinary things, such as existence of a file or time used for a computation, have been the medium through which a covert channel communicates. Covert channels are not easy to find because these media are so numerous and frequently used.

Two relatively old techniques remain the standards for locating potential covert channels. One works by analyzing the resources of a system and other works at the source-code level.

Eliminating covert channels

The possibility of covert channels cannot be completely eliminated, although it can be significantly reduced by careful design and analysis.

The detection of a covert channel can be made more difficult by using characteristics of the communications medium for the legitimate channel that are never controlled or examined by legitimate users. For example, a file can be opened and closed by a program in a specific, timed pattern that can be detected by another program, and the pattern can be interpreted as a string of bits, forming a covert channel. Since it is unlikely that legitimate users will check for patterns of file opening and closing operations, this type of covert channel can remain undetected for long periods.

A similar case is port knocking. In usual communications the timing of requests is irrelevant and unwatched. Port knocking makes it significant.