PT12. Re-Transmission Pattern (also P11)

Initial publication S. Wendzel, S. Zander, B. Fechner, C. Herdin in [1]
Illustration A covert channel re-transmits previously sent or received PDUs.
Context Network Covert Timing Channels -> Protocol-aware
  • C. Kraetzer, J. Dittmann, A. Lang, and T. Kuehne. 2006. WLAN Steganography: A First Practical Review. In Proc. 8th Workshop on Multimedia and Security (MMSEC’06). 17–22.
  • S. Zillien, S. Wendzel: Detection of Covert Channels in TCP Retransmissions, in Proc. NordSec 2018, Springer, 2018.

See [1] for two additional examples of such hiding techniques based on the re-transmission pattern.
Implementation ?
Known Pattern-based Countermeasures

[1] S. Wendzel, S. Zander, B. Fechner, C. Herdin: Pattern-based Survey and Categorization of Network Covert Channel Techniques, ACM Computing Surveys, Vol. 47, Issue 3, pp. 50:1-26, ACM, 2015.
An early version of the article is available here: download.

Keine Kommentare:

Kommentar veröffentlichen