CONNECTION: COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioN
Simone Soderi Rocco De Nicola




CONNECTION: covert channel network attack






S. Soderi



IMT School for Advanced Studies Lucca, Lucca, Italy Cybersecurity National Laboratory, CINI - Roma, Italy




CONNECTION:	COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioN
    Simone Soderi1,20000-0002-1024-9470, Rocco De Nicola1,20000-0003-4691-7570
    
==============================================================================





Covert channel networks are a well-known method for circumventing the security measures organizations put in place to protect their networks from adversarial attacks.
This paper introduces a novel method based on bit-rate modulation for implementing covert channels between devices connected over a wide area network.

This attack can be exploited to exfiltrate sensitive information from a machine (i.e., covert sender) and stealthily transfer it to a covert receiver while evading network security measures and detection systems.
We explain how to implement this threat, focusing specifically on covert channel networks and their potential security risks to network information transmission. The proposed method leverages bit-rate modulation, where a high bit rate represents a `1' and a low bit rate represents a `0', enabling covert communication.
We analyze the key metrics associated with covert channels, including robustness in the presence of legitimate traffic and other interference, bit-rate capacity, and 
bit error rate. 

Experiments demonstrate the good performance of this attack, which achieved 5 bps with excellent robustness and a channel capacity of up to 0.9239 bpsHz under different noise sources. Therefore, we show that bit-rate modulation effectively violates network security and compromises sensitive data.





8.4cm1pt

Please cite this version of the paper:


Soderi, S., De Nicola, R. CONNECTION: COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioN. In: Shao, J., Katsikas, S.K., Meng, W. (eds) Emerging Information Security and Applications. EISA 2023. Communications in Computer and Information Science, vol 2004. Springer, Singapore. https://doi.org/10.1007/978-981-99-9614-8_11


You may use the following bibtex entry:

8.4cm1pt








§ INTRODUCTION


In our age of pervasive digitization, the transmission of information across networks is ubiquitous and multifaceted, encompassing voice, text, imagery, and video <cit.>. While this communication is an indispensable enabler of modern society, it carries significant security vulnerabilities. Malicious agents can exploit these channels, orchestrating covert attacks to exfiltrate sensitive data or establish concealed backdoors for subsequent unauthorized access.
Attackers increasingly use information hiding and steganography techniques to avoid detection and remain undetected for an extended period <cit.>.
Specifically, covert network channels, a specialized communication conduit designed to camouflage information transfer from unauthorized entities, poses a significant security threat.
Network covert channels can be artfully crafted by manipulating the inherent network protocols or employing steganography to hide information within apparently benign data. Their primary aim is to facilitate the transfer of information in a manner that is elusive to detection and non-intrusive to standard network operations. This stealthy and non-disruptive nature positions network covert channels as a potent tool for attackers, enabling them to bypass detection and surreptitiously access privileged information.
Investigating covert network channels is crucial in fortifying the security and ensuring the privacy of networked systems. Enhancing our ability to detect and mitigate network covert channels is crucial in preventing information exfiltration and unauthorized access to sensitive systems. 


Covert channels pose a concrete threat to networked environments and data transfer processes <cit.>. Their primary intent is to infiltrate a network covertly or without prompting significant suspicion. This task is increasingly challenging in the rapidly evolving network security landscape, necessitating the incorporation of hardware and software designed for covert channel detection into the fabric of network defence strategies.
Once the infection of network devices succeeds, data exfiltration  occurs. Data can be covertly transferred from a network via numerous methodologies, predominantly by exploiting well-known internet protocols, which will be further explained in the following sections <cit.>. Alternatively, a covert channel can assist threat actors in creating a backdoor, enabling remote access to the victim's system.
Almost all actions associated with the execution of a covert channel attack can be tracked, possibly preventing future attacks. 
This paper focuses on implementing covert channels using a new technique that relies on bit-rate modulation to efficiently exchange data between two networked devices. Although it is a simple principle, no contributions in the literature exploit the same mechanism.
The idea is to make this communication invisible to possible detection systems that monitor bit-rate variations. Above all, the article emphasizes the criticality introduced by this type of attack and, thus, the urgent need for research efforts in this field.



In today's digital era, information exchange via networks is widespread and diverse, covering voice, text, images, and video <cit.>. Despite its vital role in modern society, networked communication is vulnerable to security breaches. Malicious actors can exploit communication channels, conducting covert attacks to extract sensitive data or establish hidden backdoors <cit.>. Indeed, covert network channels, 
concealing unauthorized information transfer, present a substantial security risk. These channels can be crafted by manipulating network protocols or using steganography to hide data within innocuous information. Their primary aim is discreet information transfer, evading detection and network disruption. This stealthy nature makes covert channels a potent tool for attackers, allowing them to access data secretly.
Examining covert network channels is vital for network security. Enhancing detection and mitigation strategies is crucial to prevent data leaks and unauthorized access. Covert channels pose tangible threats to networks and data processes <cit.>. Their goal is hidden infiltration, increasingly challenging in evolving security landscapes. Incorporating covert channel detection tools in network defence is essential.

Data can be surreptitiously transferred via various methods, often exploiting well-known internet protocols <cit.>. 

Monitoring covert channel actions can prevent future attacks. This paper introduces a novel technique relying on bit-rate modulation for covert communication between networked devices. The approach aims to evade detection systems by exploiting bit-rate variations. To the best of our knowledge, this mechanism is new and calls for further research to curb its impact.

Contribution The main contribution of this paper is the design of a new covert channel to attack enterprise networks under different noise sources. The basic intuition is that the attacker is not interested in intercepting the data transiting the network; rather, she/he wants to control the bit-rate at which it is transmitted. By modulating the bit-rate appropriately, the attacker can associate some pieces of information with a high bit-rate and others with a low bit-rate. Although simple, this technique is new in the covert channel scenario. Other contributions of this paper include the artefact implementation of the covert sender and receiver and the description of experiments on the performance of the proposed attack in a cyber range that emulates an enterprise data network.


The rest of the paper is organized as follows. Section <ref> describes the main background concepts used in this work, while Section <ref> contains a short overview of revising the literature about covert channels. Section <ref> introduces the attacker model, while Section <ref> describes the actual implementation of the covert sender and receiver. Section <ref> presents our experiments and its results. Finally, Section <ref> concludes the paper.





§ BACKGROUND

This section provides the basic concepts for understanding covert channels and how we exploited them during our experiments.


Furthermore, it provides the basic concepts of network architectures that span wide geographical areas, which will be used in an emulated environment (a cyber-range) to assess our attack model.



 §.§ Covert Channel Characteristics
 
The creation, maintenance, and effective operation of covert channels depend on balancing fundamental characteristics: anonymity, robustness, bit error rate, and channel capacity.
These prerequisites collectively serve as crucial factors in assessing the effectiveness of a covert channel, as they determine its ability to transmit information while eluding network monitoring security systems <cit.>. The paramount consideration in crafting a successful covert channel is skillfully achieving and harmonizing all these essential features.

Anonymity This feature, often synonymous with unobservability, is essential in establishing the covert nature of the channel. To ensure evasion from potential detection mechanisms, the communication via a covert channel must adeptly mimic ordinary network traffic. This requirement extends beyond simple masquerading; the channel's data patterns and behavioural characteristics must not show statistically significant deviations compared to normal traffic patterns. Additionally, the channel must remain immune to various intrusion detection techniques, including anomaly-based and signature-based detection systems.

Robustness This attribute of a covert channel represents its resilience to alterations, noise, and data losses. Covert channels should exhibit high data integrity and guarantee accurate and reliable data transmission despite potential disruptions. For instance, channels must be resilient against network jitter, packet loss, or intentional disruptions. Furthermore, the channel should be robust against varying network conditions, such as changes in network load or transmission rates.

ber The bit error rate measures the frequency of transmission errors or bit errors during communication. It is crucial to evaluate the error rate of the covert channel as it can affect the reliability and accuracy of the transmitted data. Higher error rates can lead to information loss or corruption, compromising covert communication.

Coexistence with Legitimate Traffic Analyzing the behaviour of a covert channel when it coexists with legitimate network traffic is essential. This investigation helps uncover potential interference or congestion issues that may arise when covert communication overlaps with regular network traffic. Understanding these coexistence characteristics is instrumental in designing covert channels that are not only efficient but also highly stealthy.



Channel Capacity When designing a hidden communication channel that leverages mechanisms not originally intended for information transfer, it is necessary to understand the capacity of such a channel. This capacity indicates the maximum rate of information that can be transmitted reliably over the channel, and it serves as a vital parameter in assessing the channel's efficiency for covert communication.
In this paper, we employ the bsc model <cit.>, as illustrated in Figure <ref>, a special case of the more general dmc model. The BSC model is characterized by its discrete nature and binary input and output symbols, with X, Y ∈{0,1}. This model considers the impact of noise or other channel interferences, which can introduce errors into the transmitted bitstream. Notably, the BSC model assumes that these errors affect the two transmitted symbols with equal probability, denoted as p.



For further clarification, consider a scenario where a transmitter sends a binary symbol `0' or `1' over the channel. Due to channel noise or interference, there is a probability p that the transmitted symbol will be erroneously received as its opposite at the receiving end, i.e., P(1|0) or P(0|1). Contrarily, (1-p) is a probability that the transmitted symbol will be received correctly, i.e., P(0|0) or P(1|1). Thus, the BSC model enables the analysis of a communication channel's behaviour under the influence of such symmetric errors.
For a BSC, the maximum information that a transmitter can reliably convey to a receiver through the channel is expressed by the channel capacity, which can be mathematically determined using the following <cit.>





    C =  max_P𝕀(X;Y) = 1 - H(p)  
          =   1 - p log_2(1/p) - (1-p) log_2(1/1-p),

where 𝕀(X;Y) is the mutual information between the input X and output Y, H(p) is the binary entropy function, and p is the error probability.
The channel capacity, C, quantifies the highest achievable rate of error-free information transfer over the channel, considering the error probability, p. By comprehending the capacity of a covert communication channel and optimizing its performance accordingly, it is possible to maximize the efficiency and reliability of hidden data transfer while minimizing the risk of detection.


Channel Capacity
When designing a covert communication channel using unintended mechanisms, understanding its capacity is crucial. This capacity signifies the maximum reliable information rate transmitted, a vital metric for assessing efficiency.
We use the bsc model <cit.>, shown in Figure <ref>, a discrete variant of the dmc model. It has binary input/output symbols, X, Y ∈0,1, and accounts for noise-causing errors (p).



For instance, a `0' or `1' could be sent, with p probability of receiving the opposite due to noise (P(1|0) or P(0|1)). Conversely, (1-p) is the probability of correct reception (P(0|0) or P(1|1)). This models symmetric errors.In this case, the channel capacity, C, 

can be mathematically determined using the following equation <cit.>. It quantifies optimal error-free data transfer while optimizing efficiency and minimizing detection risk and is expressed in bpsHz.





    C =  max_P𝕀(X;Y) = 1 - H(p)  
          =   1 - p log_2(1/p) - (1-p) log_2(1/1-p),

where 𝕀(X;Y) is the mutual information between the input X and output Y, H(p) is the binary entropy function, and p is the error probability.



 §.§ Brief Overview of Enterprise Networks
 


In computer networks and communication infrastructures, service and enterprise networks emerge as two distinct interconnected types of networks <cit.>. 



Central to these networks is the mpls protocol, a key in the backbones of modern IP networks. mpls governs large isp networks and more confined enterprise network backbones using internal routing protocols such as ospf, internal Border Gateway Protocol (iBGP) within the backbone, and  bgp between different as <cit.>. 


mpls utilizes labelling mechanisms to transmit packet routing within the network, resulting in rapid and deterministic switching. 



Considering an IP packet routing via a Layer 3 Virtual Private Networks (L3VPNs) such as VPN-A from a CE device at remote Site 1 to remote Site 2 illustrated in Figure <ref>. The IP packet receives an mpls label at the ingress PE device (i.e., ingress of the core MPLS backbone AS 65010), dictating its subsequent routing path. The packet then transits to  P routers, which forward the packet based on its label. The mpls label is removed at the egress PE device, and the packet is directed to the destination CE device at Site 2. This routing process is governed by vrf instances at the PE devices, segregating network traffic based on vpn membership. 
The role of mpls in contemporary network architecture is undoubtedly vital. It uses labels appended to data packets, enabling efficient bit-stream routing across multiple remote sites within an enterprise or isp network avoiding the dependence on complex destination-based routing algorithms. With vrf instances, mpls ensures secure and efficient connectivity between different enterprise network sites, emphasizing its crucial contribution to managing data streams within complex network architectures <cit.>.


In computer networks and communication infrastructures, service and enterprise networks emerge as two distinct interconnected types <cit.>, with the mpls protocol playing a central role. mpls governs large isp networks and enterprise network backbones, utilizing various routing protocols like ospf, internal Border Gateway Protocol (iBGP), and bgp between different as <cit.>. mpls employs labelling mechanisms for efficient packet routing, ensuring rapid and deterministic switching.
For example, consider routing an IP packet through a Layer 3 Virtual Private Network (L3VPN) from a CE device at remote Site 1 to remote Site 2, as depicted in Figure <ref>. The packet is labelled at the ingress PE device, dictating its path. P routers forward the packet using its label, and the label is removed at the egress PE device before reaching the destination CE device at Site 2. This process is controlled by vrf instances at the PE devices, segregating network traffic based on vpn membership.
mpls plays a crucial role in modern network architecture by efficiently routing data packets using labels. This approach facilitates streamlined routing across remote sites within networks, avoiding the complexities of destination-based routing algorithms. With vrf instances, mpls ensures secure and efficient connectivity between different network sites, highlighting its pivotal contribution to managing data flows within intricate network structures <cit.>.










§ RELATED WORKS

In 1973, Lampson defined the covert channel as a communication channel not intended for information transfer <cit.>. Such type of communication falls within a more general discipline of data manipulation known as information hiding or data hiding.  Nowadays, covert channels are carefully engineered to evade detection and circumvent network security policies by establishing new communication paths, causing the disruption of security mechanisms and making their creation and maintenance challenging <cit.>.
Since covert channels exploit unconventional aspects, it is easy to imagine that there are different types of them. It is, therefore, important to mention a couple of them.


Covert Timing Channels These covert channels transmit information based on the packet arrival times rather than the actual packet content <cit.>. They can be subdivided into two types: timing and sorting channels. In the first, the sender uses predefined time intervals to convey information; for instance, the reception of a packet could represent a binary `1', and the absence of a packet could represent a `0'. More sophisticated timing channels might use inter-packet arrival times to convey data. In such a scenario, a long delay may signify a `0' while a short delay indicates a `1'. Whereas in sorting channels, the sequence of packet arrivals forms the transmitted message.
Given that such channels secretly exploit temporal data to forward information, they face significant challenges, such as synchronization between the sender and receiver, especially when the network introduces jitters or noise. However, despite their relatively low throughput, the high anonymity makes them efficient enough for covert communication. 

Multiple techniques aim to enhance statistical detection's resilience, such as mimicking genuine traffic patterns or employing randomized inter-packet delays <cit.>.
    
    
Covert Network/Storage Channels These channels manipulate different layers of the Internet Protocol stack to facilitate covert communication. The sender, who can control parts of the network stack, modifies protocol headers, fragments, checksum values, or packet transmission timing to conceal the information <cit.>. The hidden messages could be embedded in unused bits or fields of protocol headers, such as the IP identification field, the IP fragment offset, the TCP sequence number field, and TCP timestamps <cit.>. While embedding messages in packet headers provides an easy way to create a covert channel, these channels are equally simple to detect and prevent. An adversary can monitor specific fields of packet headers for detection or sanitize these fields for prevention. Furthermore, it is worth noting that payload embedding is generally avoided in the spirit of maintaining covert communication, as this could reveal the existence of the covert channel. 
For instance, a spread-spectrum watermarking technique can track data covertly flows through a network <cit.>.

    


Covert channels, characterized as policy-violating and unconventional stealthy communication mediums in a system's design, are habitually employed to secretly transfer sensitive information, potentially for data exfiltration or malware communications. Moreover, these channels can serve as vehicles for circumventing cybersecurity policy in companies' perimeter. Covert channels have been observed in many environments, ranging from networks, cyber-physical systems <cit.>, and local processes/systems to out-of-band scenarios like ultrasonic sound <cit.>, light <cit.>, power supply <cit.>, radio frequency <cit.>, magnetic fields <cit.>, or temperature <cit.>.
Overall, each type of covert channel has advantages and drawbacks, and the choice between them often depends on the specific requirements of covert communication and the constraints imposed by the network environment.
Furthermore, a prevalent characteristic among covert channels is the low data transfer rate, exploiting the potential of protracted hiding. Covert channels achieving speeds of 100 bps are classified as fast in this context <cit.>.

In addition to timing and storage channels, other types of covert channels are worth mentioning, even if they are less important in the context of this paper:  



   
    
  (i) covert thermal channels use a process to modulate the CPU usage and change the machine's temperature, which is then sensed by a thermal sensor controlled by another process <cit.>; 
    
  (ii) covert acoustic channels leverage the audible or ultrasonic sound spectrum for data exfiltration <cit.>.
    








§ ATTACKER MODEL

In this section, we illustrate the proposed model of our attacker. The attacker's main objective is to illegally establish a communication conduit, herein termed a covert channel between two specific entities: the sender and the receiver. They must be intended as equipment interconnected via a WAN, as described in Section <ref>.
In the assumptions of our adversarial model, both the sender and the receiver fall under the attacker's control. 

To illustrate, consider the situation wherein the sender and the receiver are devices that malware deployed by the attacker has compromised. This malware can execute arbitrary code on the infected devices, creating a

connection.
It is important to emphasize that when constructing our attack model for establishing covert channels, we control and integrate features of both senders and receivers, exactly like in many other approaches to the same issue.

Many studies focusing on covert channels have incorporated an attack model that, like ours, is characterized by a transmitter-receiver structure in which the attacker requires the same control capabilities. Some examples from recent literature can be found in these references  <cit.>, but none of the considered approaches relies on bit-rate modulation.




The concept of an apt delineates an attack campaign whereby an adversarial entity maintains an unauthorized presence within a targeted network, thereby gaining high-sensitivity access to data <cit.>. The attacker model we propose, named CONNECTION - “COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioN", involves both sender and receiver elements, as illustrated in Figure <ref>. 
This attack falls into the category of a covert timing channel. The compromise of the two entities can be achieved through various methods, including but not limited to supply chain attacks, the use of social engineering techniques, or the exploitation of hardware with pre-installed software or firmware. The attacker does not require special permissions to carry out this attack once the machines have been infected. It's worth noting that even highly secure facilities, including air-gapped ones, are not immune to such exploits, as demonstrated in recent years, with Stuxnet <cit.> being one of the most famous examples


After successfully infecting the two designated devices, the malicious software initiates a process to identify the communication partners of the sender. In this scenario, the attacker may not need to know the exact address of the sender; the target network's address range or the IP address subnet could be sufficient.


Under the attacker's control, the sender initiates covert communication attempts with each IP address within the target network's address space. Upon successfully detecting this covert communication, the (infected) receiver

responds to the sender by modulating its bit-rate.

To be more precise, when the sender selects a specific IP address, it begins transmitting a bitstream (represented as X in Figure <ref>), using bit-rate variation as the communication method: a high bit-rate indicates the transmission of a '1' bit, while a low bit-rate indicates the transmission of a '0' bit.

Conversely, the receiver using a traffic dump can demodulate the encoded information, resulting in receiving the message Y. By observing the traffic shape,  often referred to as the envelope, exchanged between these two devices,  an amplitude modulation such as a pam or an ook modulations <cit.> could be identified. However, in our case, this is achieved by controlling the network throughput.
Implementing this type of covert channel depends on the specifications of the victim device. The following section will discuss how to carry out this attack. 






§ BIT-RATE MODULATION AS COVERT CHANNEL


Let us, therefore, consider the context described in Section <ref>, i.e., a threat actor operating on two devices communicating over a WAN (see Figure <ref>). 
Given its extensive use, at this time, we will use the MITRE ATT&CK framework <cit.> as a reference to frame the activities of the attacker. In particular, he/she must plan tactics and use techniques to implement the covert channel.
There will be a pre-attack phase in which the attacker will conduct a reconnaissance phase to acquire useful information to weaponize and adapt the malware that will create the covert channel between the sender in Site 1 and the receiver in Site 2.
The techniques needed to effectively realize this covert communication, and in particular, how the covert channel between  the sender and the receiver is established, are explained in the following.



 §.§ Covert Sender
 
Algorithm <ref> outlines a procedure for transmitting a bitstream over a covert network. The process employs the principles of bit-rate modulation, effectively performing an amplitude modulation (e.g., pam) of the throughput. This technique ingeniously hides the communication, making it robust against conventional detection strategies.

The procedure begins with identifying the essential elements required to execute the algorithm, which includes the amplitude modulation parameters b1 and b0, i.e., the high bit-rate levels to transmit 1 and the low bit-rate levels to transmit 0. 
The only information the sender must have is the IP address (or the addressing of the destination LAN) and port of the receiver. 
An attacker can potentially obtain this information in the reconnaissance phase through social engineering operations such as phishing or other means. It is, however, assumed that the sender and receiver are already connected via the WAN.


Upon initiation, the algorithm processes each bit in the bitstream. Depending on whether the current bit is `1' or `0', the payload is generated using the modulation parameters b1 or b0, respectively. This operation is performed by the GeneratePayload function, which generates random data at the corresponding bit rate, i.e., b0 or b1.
Once the payload is generated, the algorithm encapsulates it into a network UDP packet using the ConstructPacket function. This packet, intended for the receiver, contains the payload and is routed to the specified receiver's IP and port number. 
We have used the UDP protocol without losing generality to maximize control over the timing of the data sent.


To comply with mtu constraints, specifically in Ethernet networks, and to avoid unintended fragmentation at the network layer, the constructed packet is fragmented into smaller pieces of a predetermined size, which here is set at 1472 bytes. The  fragmentation is implemented using the FragmentPacket function. After the fragmentation, each fragment is sent in a sequence using the TransmitFragment function. This phase represents the transportation of each bit in the bitstream as an independent network packet.
In essence, this algorithm executes the covert transmission of the bitstream over the WAN. Applying the bit-rate modulation mechanism modulates the amplitude of the network throughput, such as an pam signal modulation.

This mechanism, combined with the fact that the algorithm does not modify the content of the packets, makes the transmission highly resistant to detection, thereby improving the stealth and reliability of the covert channel.






 §.§ Covert Receiver

In the covert communication scenario, the receiver starts by passively monitoring or sniffing UDP network traffic on a specific port, e.g., using the network traffic capture utility, tcpdump <cit.>. 

It saves it in a PCAP file for further processing, i.e., demodulation.




The receiver analyses the network traffic it has just captured following the procedure in Algorithm <ref>. It filters only those packets that might contain secret information, demodulates the bits, and synchronizes to a known preamble. The preamble needed to synchronise the communication is also sent using bit-rate modulation. Thus, after acquiring incoming packets, the receiver's algorithm applies a filter (FilterPacket) to discard all packets irrelevant for transmission, retaining only those received

that use UDP for transport (indicated by protocol number 17).

As mentioned earlier, during transmission, the sender can employ packet fragmentation. 
When transmitting a `1', which uses a high bit-rate, it will generate numerous fragments, while when transmitting a `0', it will use a much lower bit-rate and, therefore, fewer fragments or even no fragments if the payload is shorter than the mtu. 
After the filtering process, it becomes necessary to group the packets based on their identification (ID) and count the number of packets in each group arriving at a specific port 
The resulting count serves as an indicator for the bit-rate, thus acting as an implicit representation of the value of the bit originally transmitted. The DemodulatePacket function analyzes this counter, and the higher the packet count, the more likely it is that the corresponding bit value in the original bit stream was a `1' and vice versa. To translate these counts into a demodulated bit stream, a threshold comparator is used, and then a threshold value is defined, for example, 80% of the maximum observed count. Counts that meet or exceed this threshold are interpreted as `1', while those that fall below are interpreted as `0'.

The demodulated bit stream is scanned for this sequence, and the index immediately following the end of the sequence is taken as the starting point for the actual data in the bit stream.

This algorithm provides a robust and ingenious approach to covert communication by exploiting the underlying characteristics of network transmissions and their inherent variability in the number of packets to encode and transmit data secretly.
Though this method operates with low throughput, the most significant advantage is the possibility that it offers a method for exfiltrating valuable information from within an organization. For example, one could send externally the file /etc/passwd, which in a few bytes (typically <100 B) contains the accounts and associated passwords of Unix computers.






§ EVALUATION OF THE COVERT CHANNEL
 

In this section, we will evaluate the usefulness of the implemented covert channel, which uses bit-rate modulation, in a virtual scenario (see Figure <ref>). 
This evaluation aims to understand the potential risks associated with the covert channel and assess its effectiveness as a means of unauthorized communication.
For our experiments, we relied on a controlled environment known as a cyber range, where we set up a secure network infrastructure comprising an MPLS backbone connecting two remote sites.
The cyber range provides a controlled environment to evaluate the covert channel's utility while considering achievable bit-rate, ber,  robustness, and coexistence with legitimate traffic.



We deployed the attack model sketched in Figure <ref> in the cyber range  using the Graphical Network Simulator-3 (GNS3) <cit.>. This network software emulator combines virtual and real devices to simulate complex networks. In this virtual environment, we established an MPLS backbone based on OSPF and BGP protocols. The backbone consisted of three routers P, two PE, and two CE, all running on the VyOS open-source network operating system <cit.>.
The cyber range connected two remote sites, each with an infected machine as the covert sender (PC1-1) and the covert receiver (PC1-2). The aim is to use the malicious covert channel to exfiltrate sensitive information from PC1-1.
To achieve this, the covert sender implements Algorithm 1 using a Python script that uses Scapy <cit.>, a Python program for network packet manipulation. Scapy facilitated the generation, modulation, and transmission of covert payloads.
The covert receiver implements Algorithm <ref> using tcpdump, Python, and Scapy. Tcpdump allowed real-time network traffic capture, while Python and Scapy enabled the demodulation and analysis of received packets. Algorithm <ref> decoded the covert bitstream, recovering the transmitted information.




 §.§ Results of Adversary Emulation in the cyber range




We conducted a comprehensive set of experiments 

to evaluate the performance of the covert channel. The experiments considered the metrics outlined in Section <ref>, providing valuable insights into the channel's behaviour and capabilities. The parameters and details of these tests are summarized in Table <ref>.
In particular, we investigated the influence of the ar in the bit-rate modulation technique. The ar represents the ratio between the number of bytes used to transmit bit `1' (b1) and the number used to transmit bit `0' (b0). For instance, if we allocated 6000 bytes for bit `1' and 1000 bytes for bit `0', the resulting ar would be 6.
To capture a comprehensive perspective, we collected statistical data on transmitting multiple bitstreams with varying lengths ranging from 48 to 144 bits (including the 16 preamble bits). We computed the mean and standard deviation of the bit-rate and ber by analyzing these measurements. These statistical measures allowed us to gain deeper insights into the channel's performance and robustness.




Figure <ref> shows the covert channel in action when transmitting a short bitstream (i.e., 16 bits of preamble and 6 bits of data) and how demodulation (Algorithm <ref>) is done by assessing whether the packet rate is above or below the threshold.

To evaluate the covert channel's capacity, we conducted measurements to determine its maximum bit-rate. Initially, we set a fixed payload size for transmitting bit `1' (b1) and explored various scenarios using smaller payloads to represent bit `0' (b0). This approach allowed us to achieve amplitude modulation with variable amplitude ratios (AR). Figure <ref> illustrates two cases where b1 is set to 6000 bytes in one group of tests and 4000 in another.
The results revealed that the maximum achievable bit-rate is approximately 5 bps. Interestingly, Figure <ref> shows that the throughput remains constant when the ar is such that the payload size of bit zero is smaller than the mtu.












In Figure <ref>, we examined the impact of packet loss on the covert channel using an pam scheme with b1 set to 6000 bytes. Notably, for high packet loss rates, specifically around 5%, the ber reached approximately 20%.
Similarly, Figure <ref> illustrates the effect of dropping packets periodically, where the threshold denotes the number of packets dropped. For example, with a drop rate of 1 packet per 50, the BER was approximately 15%.
With the same settings, Figure <ref> shows the relation between the channel capacity (C) expressed by (<ref>) and packets dropping and packet loss, respectively. With the covert channel proposed here, we achieved a spectral efficiency of 0.9239 bpsHz.

In addition, we conducted further tests

to evaluate the other characteristics of covert channels by considering UDP traffic of up to 10 Mbps between PC1-1 and PC1-2 and experienced no interference of the covert channel. We also introduced variations in latency, jitter, and corrupted packets 

(values used for these tests are in Table  <ref>). Remarkably, none of these operations disrupted the covert channel's transmission. GNS3 allowed us to vary packet loss, frequency drop, latency, jitter, and corruption by operating on the communication link between the two machines.

These results demonstrate the robustness of the covert channel in a typical enterprise network scenario.  Moreover, the channel exhibits a sufficient bit-rate for effective information exfiltration. Its inherent anonymity poses significant challenges for detection since the transmitted bursts exhibit very low throughput, thus avoiding the microburst phenomenon typically mitigated by modern network devices. Additionally, using random payload data and commonly employed UDP services further contribute to the channel's elusive nature, making it difficult to detect.






§ DISCUSSION

Covert channels have been an area of significant research interest, with various techniques being proposed over the years. The proposed attack offers a novel approach in this domain. As described in the previous sections, the throughput achieved is comparable with other solutions proposed in the literature. In addition, the simplicity of the attack, based on bit-rate modulation, could prospectively make it applicable even in contexts where devices with low computational capabilities operate.

Comparison with other schemes While there is  a limited number of studies in the literature that employ a similar scheme to our attack, it remains appropriate to compare our performance with those existing contributions.
In <cit.>, the authors introduced a covert channel mechanism in a virtualized environment that posed serious security risks in the cloud. Their method achieved a throughput of 100 bps on average. 
In <cit.>, authors create a unique covert timing channel to exfiltrate data utilizing Internet of Things (IoT) devices. The TCP/IP throughput of the Stealth mode is 4.61 bps, while the ZigBee throughput is 3.90 bps. 
Recently, Hou et al. <cit.> published an innovative approach, exploiting the LoRa physical layer to establish a covert channel with a throughput of 30 bps. This approach is the closest work to our contribution. The authors implemented the covert channel by modulating the amplitude of the LoRA radio signal.


MitigationThe detection of the attack we propose is challenging without prior knowledge. Nevertheless, if the network-controlling team possesses specific information, it is plausible that by analyzing network traffic variations (such as observing the network traffic envelope), they could potentially detect an amplitude modulation and trigger an alert.

Ethical aspects Our research aims to signal a new class of vulnerabilities within network traffic, thereby hardening defences against exploiting such channels to leak sensitive data by adverse entities. To effectively identify and cancel bit-rate modulation covert channels, network devices must incorporate advanced monitoring capabilities to monitor and respond to anomalous throughput fluctuations.






§ CONCLUSIONS

We have presented a novel covert timing channel that exploits bit-rate modulation as a new attack vector on enterprise networks. 

An advantage of this technique is that it uses a light and simple algorithm to implement the sender and receiver, making it suitable also for hacking those resource-limited devices belonging to two lan communicating via an enterprise network.

We conducted extensive experiments in a controlled cyber range environment to validate our approach, allowing us to manipulate network parameters and thoroughly evaluate our model. The results demonstrated the effectiveness of our covert channel, achieving a data transmission rate of 5 bps and a channel capacity up to 0.9239 bpsHz.  
Although the bit-rate may seem low, let us remember that it is a typical value for a covert channel and sufficient to exfiltrate sensitive data before being discovered.
Furthermore, our solution shows resilience against common network challenges such as jitter, latency, and coexistence with legitimate traffic and maintains complete anonymity.

Through a comprehensive understanding of covert channel attacks, we can defend our networks, preserving the integrity and privacy of data and, ultimately, fostering trust in our digital world.




§ ACKNOWLEDGMENTS 
 
The authors thank Niccolò Maggioni for his insightful comments.
This work was partly supported by Consorzio Interuniversitario Nazionale per l'Informatica (CINI)  through a Research Project under Grant CA 01/2021 a.i. 2 and by project SERICS (PE00000014) under the NRRP MUR program funded by the EU - NGEU.







splncs04



