PS10. Random Value Pattern (also P5)

Initial publication	S. Wendzel, S. Zander, B. Fechner, C. Herdin in [1]
Illustration	The covert channel embeds hidden data in a header element containing a (pseudo-)random value.
Context	Network Covert Storage Channels → Modification of Non-Payload → Structure Preserving → Modification of an Attribute
Evidence	J. Keller, S. Wendzel. Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains, Applied Sciences, Vol. 11(2), MDPI, 2021. C. H. Rowland. 1997. Covert Channels in the TCP/IP Protocol Suite. First Monday 2, 5 (May 1997). J. Rutkowska. 2004. The implementation of passive covert channels in the Linux kernel. (2004). Speech held at the 21st Chaos Communication Congress, Berlin, Germany, http://events.ccc.de/congress/2004/fahrplan/files/319-passive-covert-channels-slides.pdf N. Lucena, J. Pease, P. Yadollahpour, and S. J. Chapin. 2004. Syntax and Semantics-Preserving Application Layer Protocol Steganography. In Proceedings of 6th Information Hiding Workshop. In [1], additional information on the evidence is provided.
Implementation	e.g. C. Heinz: TLSCC (University of Hagen)

References:
[1] S. Wendzel, S. Zander, B. Fechner, C. Herdin: Pattern-based Survey and Categorization of Network Covert Channel Techniques, ACM Computing Surveys, Vol. 47, Issue 3, pp. 50:1-26, ACM, 2015.
An early version of the article is available here: download.