Skip to content

Covert channels

1. Context & stakes

Generic covert channels in header fields and timing.

Protocol headers and packet timing carry spare capacity - IP ID, TCP sequence, TTL, inter-packet gaps - that can smuggle data past controls which only inspect payloads. Because the traffic looks ordinary, covert channels slip past DLP and firewalls and are a hallmark of stealthy exfiltration and C2. Normalising header fields and analysing timing statistically are what detect them.

2. Theory

A covert channel smuggles data where none is meant to exist: unused/reusable header fields (IP ID, TCP urgent pointer, sequence numbers, ToS) carry bits, or a timing channel encodes data in inter-packet delays. Low-bandwidth but content-inspection-proof; detection is statistical (field entropy, timing regularity).

3. Attack (PoC)

netlab-covert attack --i-own-this-network --iface veth-host
  1. Unused TCP/IP fields
  2. Timing channels

4. Detection

netlab-covert detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Statistical detection
  • Header normalization

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading