Re: Covert Channels

From: Darryl Luff (darrylat_private)
Date: Fri Oct 18 2002 - 04:45:01 PDT

  • Next message: Michal Zalewski: "RE: Covert Channels"

     > Jeremy Junginger wrote:
    
    > Has anyone had success in creating a program that uses IP/TCP/UDP/ICMP
    > header information to transmit encoded messages from one host to
    > another?  Shortly after reading
    
    
    Hi Jeremy,
    
    As you say there are usually easier ways. If you're inside a firewall 
    connecting out, you can just use http, https or email through their 
    existing systems. If you're outside trying to connect in, I think that 
    the main problem is getting your packets in to where the target system 
    can see them. If you can do that, you can encode it however you want.
    
    I imagine that the easiest way would be to pick an unknown IP or TCP 
    option number and insert your own options field into the IP or TCP 
    header. This keeps your data separate from the TCP connection data. I 
    think that an option field can be up to 253 bytes of data?
    
    Do any IDS systems trigger on unrecognised option fields?
    
    
    Darryl Luff
    



    This archive was generated by hypermail 2b30 : Fri Oct 18 2002 - 06:36:13 PDT