Network Report-Steganography in IP

7/29/2019 Network Report-Steganography in IP

1/21

Covert Channels in

Transport and Network

Layers

By:

SHUBHAM VISHNOI-10BCE1098

ASHISH CHAUHAN-10BCE1021

7/29/2019 Network Report-Steganography in IP

2/21

Introduction:

This contains a general investigation of various protocols on the

transport andnetwork layers. The list of protocols that are evaluated for

possible use in covert com-munications include the TCP (Transmission

Control Protocol), IGMP (Internet GroupManagement Protocol), ICMP

(Internet Control Message Protocol) and Internet Proto-col (IP). Thisdoes not serve to provide an exhaustive look at possible covert

channels but attempts to prove existence of simple storage channels, in

mentioned protocols, that might be used later (future research)

possibly.

TCP (Transmission Control Protocol)

At the transport layer, TCP is intended to provide a reliable process-to-

process communication service in a multi-network environment. TCP is,

therefore, a connection-oriented and reliable transport protocol. The

7/29/2019 Network Report-Steganography in IP

3/21

header of the TCP protocol is shown in Figure 3.1. It has a 6-bit field

labelled as code bits (URG, ACK, PSH, RST, SYN, FIN). These bits

determine the purpose and contents of the TCP segment. These six bits

tell a network

node how to interpret other fields in the header. There are 64 possible

combinations for these six bits, out of which 29 combinations are

considered to be valid as per the rules set forth by the protocol [18].

For the covert channel identification, the intent is to explore any

redundancy condition within these possible code bit combinations.

Control Bits: 6 bits (from left to right):

URG: Urgent Pointer field significant

ACK: Acknowledgment field significant

PSH: Push Function

7/29/2019 Network Report-Steganography in IP

4/21

RST: Reset the connection

SYN: Synchronize sequence numbers

FIN: No more data from sender

Most of the TCP segments have an ACK bit set (i.e., the value of the ACK

bit is 1) because of the full duplex nature of the connection between

two hosts. This allows data piggybacking since acknowledgements can

be sent with data. One of the redundancy conditions is shown in Table

3.1 below:

Table 3.1 represents one of the valid combinations of the 6-bit code

fields. It can be interpreted as follows: One of the ends of the virtual

connection intends to finish the connection (FIN =1) from its end and at

the same time it sends an acknowledgment (ACK is set). The push flag is

also set as the same end requests the receiving transport layer to push

the data to its respective application layer immediately. Since the URG

bit is not set, the Urgent pointer field (16 bit) of the TCP header, shown

in Figure 3.1,becomes redundant and therefore can be used to have a

storage covert channel. Likewise, redundancy conditions exist for all

those possible cases wherein the URG bit is not set thereby making the

urgent pointer field redundant. The SYN bit set can also have possible

combinations either with the ACK bit set or the URG/PSH (not both at

7/29/2019 Network Report-Steganography in IP

5/21

the same time) set to 1. Therefore, the remaining bits are meaningless

for the protocol enabling covert data transmission possibilities through

TCP header.

IGMP (Internet Group Management Protocol)

IP multicasting (one-to-many communication) follows the paradigm of

allowing trans-mission to a subset of host computers, but it generalizes

the concept to allow the subset to spread across arbitrary physical

networks throughout the Internet. A given subset is, therefore, known

as multicast group. Multicast routers and hosts that implement multi-

cast must use IGMP to communicate group membership information.

The two message phases are report messages (host to router - joining a

group, membership continuation, leaving the group) and query

messages(router to host - monitoring the group).

IGMP is encapsulated in an IP datagram for transmission. Here the IP

destination address is the multicast address.

IPv4 header fields:

Version = 4;

IHL = 6 words;

Total length = 32 octets;

7/29/2019 Network Report-Steganography in IP

6/21

TTL = 1 (requires one hop only);

Protocol = 2;

Router alert option (An IP option that causes each intermediate routerto examine a datagram even if the datagram is not destined to the

router)Fragmentation may (DF bit is zero) or may not (DF bit is set) be

allowed

The IGMPv2 can have the following two types of messages:

1. Membership report message and leave group message - host to

router

2. Membership query message- router to host. Based on the

nomenclature defined above and the types of IGMP messages,

following

IP datagrams are possible:

a.Host to Router; Membership report, refer Table 3.2 and leave group

messages; Frag-mentation allowed.

b.Host to Router; Membership report and leave group messages;

Fragmentation not allowed.

c. Router to Host; Membership query messages; Fragmentation

allowed.

d.Router to Host; Membership query messages; Fragmentation notallowed.

By having a 16-bit arrangement of the complete IP datagram, a 16X16

matrix is obtained. The intent is to use the unused bits (8 bits; actually

set to zero by sender and ignored by receiver (for report messages -

7/29/2019 Network Report-Steganography in IP

7/21

host to router) and 16 bits; actually set to zero by the sender (for query

messages - router to host) in order to have some secret data

transferred between host to router and router to hosts. This can be

combined with other fixed values of other fields as defined in thenomenclature above.

Table 3.2: IGMP encapsulated in IPv4 header with router alert option;

host to router;membership report message

Therefore, by considering 16X16 matrix rows 2,5,11,12,13 forreport

messages(frag-mentation allowed) table 3.3 refers, rows 2,4,5,11,12,13

7/29/2019 Network Report-Steganography in IP

8/21

for report messages (fragmenta-tion not allowed), rows 2,5,11,12,15,16

for query messages(fragmentation allowed) and for query message

(fragmentation not allowed)rows 2,4,5,11,12,15,16 of the 16X16 ma-

trix, we can attain possible covert communication scenarios throughproper embedding extraction processes at the two communicating

ends, respectively.

ICMP (Internet Control Message Protocol)

The ICMP is the mechanism used by hosts or routers to send

notification of IP datagram problems back to the sender. ICMP packets

are encapsulated inside of IP datagrams. The ICMP sends query anderror reporting messages. With query messages, ICMP can also

diagnose some network problems. In this class of ICMP messages, a

node sends a message that is answered in a specific format by the

destination node. The details of ICMP can be found in [19]. The

7/29/2019 Network Report-Steganography in IP

9/21

following highlights examples of covert storage channels. ICMP echo

request and ICMP echo reply messages.The Optional data field allows

having a variable length data to be returned to the sender. IP options

like router alert, record route and time stamp can be usedencapsulating ICMP echo request message. This provides a possibility to

have covert channel between the communicating parties. Moreover,

network devices usually do not filter the contents of ICMP echo traffic

if ICMP echo traffic is allowed.The ICMP address mask request is

meant from host to the specific router on the LAN or broadcast

message to all the routers on the LAN. The request is filled with zeros in

the 32-bit address mask field. This can be used to have covertcommunication from host to router(s) on the same LAN.

Router solicitation: A host sends a solicitation after booting to request

that routers on the local net imme-diately respond with an ICMP

message router advertisement. It has a 32 bit reserved word. These

reserved bits can be made to use for covert communication for a

specific scenario.

Data Hiding through Packet Header Manipulation

The possibilities of covert channels in transport and Internet layer

protocols are identified and. This section specifically deals with data

hiding possibilities in the IPv4 header. Four scenarios are discussed that

make use of flags and identification fields of the header. The layered

7/29/2019 Network Report-Steganography in IP

10/21

architecture requires the IP datagram to encapsulate data received

from the transport layer. Similarly, IP datagram headers en-capsulate

ICMP messages as well as IGMPs report and query messages. Covert

channels in the IPv4 header can, therefore also, be associated withthose identified in the TCP, ICMP or IGMP headers. This facilitates an

increased amount of covert information tied with any of these

messages. Therefore, flexibility of associating additional information

with ICMP, IGMP and TCP traffic through IP header, is achieved, once

covert channels are explored in IP header. As depicted earlier,

redundancies and multiple interpretations of the design strategy give

rise to possible cov