Instructor: Covert channels, 2 2
now, in the last lesson on data exfiltration, 3 3
I talked about overt channels, 4 4
things like FTP or peer-to-peer 5 5
or instant messaging that are obvious ways to send data, 6 6
but data exfiltration can also happen over covert channels. 7 7
We talked about this by hiding data 8 8
inside of DNS and other methods like this. 9 9
In this lesson, 10 10
we're going to talk more about what a covert channel is. 11 11
Now, a covert channel is a communications path 12 12
that allows data to be sent outside of the network 13 13
without alerting any intrusion detection 14 14
or data loss countermeasures. 15 15
Now, covert channels can enable the stealthy transmission 16 16
of data from node-to-node using means 17 17
that your security controls simply don't anticipate. 18 18
For instance, if you don't tune your IDS to start looking 19 19
at those DNS records, that would be a covert channel. 20 20
You might have a covert channel that is sending information 21 21
over ICMP echo reply packets 22 22
which are what we send out in response to a ping. 23 23
Again, a lot of IDSs aren't looking 24 24
for that type of information. 25 25
So as we go through the rest of this lesson, 26 26
we are going to talk about some different covert channels. 27 27
First, you might find a covert channel that takes advantage 28 28
of egress filtering not being applied to a firewall. 29 29
This way they can transmit data 30 30
over a non-standard port and send information out. 31 31
We talked about this in depth 32 32
in our non-standard port lesson. 33 33
Second, you might have data that gets encoded 34 34
and that encoded data is then sent 35 35
out as part of the TCP IP packet headers. 36 36
So as we've already mentioned, we may take data, encode it 37 37
as part of an echo reply for ICMP 38 38
or part of a DNS text record and send it out. 39 39
By doing this, it can evade detection. 40 40
The third thing we can do is we can start segmenting data 41 41
into multiple packets, 42 42
by chunking up that data into multiple packets, 43 43
these can be sent at separate times 44 44
and this can help you evade signature analysis 45 45
and data loss prevention 46 46
because a lot of these signature analysis 47 47
and data loss prevention tools only use a short window 48 48
and so that might be 30 seconds or 60 seconds 49 49
when they start reconstructing packets 50 50
to search for signatures. 51 51
If you sent out a packet right now, 52 52
and a packet in three minutes 53 53
and another packet in three minutes after that, 54 54
that may get through the sensors and not trigger any alerts. 55 55
The fourth thing you might look 56 56
at is obfuscating data using hex. 57 57
This way you can transmit strings 58 58
of data using hex code instead of using character strings. 59 59
By using hex, it can get through the sensors 60 60
because the sensors may be looking 61 61
for an ASCII string and not a hex string. 62 62
The fifth type of covert channel is 63 63
when you start transmitting data in an encrypted format 64 64
by sending it 65 65
out through an encrypted format like an SSL or TLS tunnel, 66 66
this can prevent inspection as it leaves the network, 67 67
unless somebody has a break and inspect device 68 68
sitting at the edge of their network. 69 69
So when you're trying to mitigate 70 70
against these different types of covert channels 71 71
what can you do? 72 72
Well, the best thing to do 73 73
is use advanced intrusion detection 74 74
or user behavior analytics tools. 75 75
These are going to be your best options 76 76
to help detect those covert channels. 77 77
But keep in mind, they are not foolproof 78 78
and they will not detect everything. 79 79
As I've said before, 80 80
as the defenders get better, so do the attackers. 81 81
And so we're constantly having this chess match 82 82
where each side is trying different things 83 83
to get something by the other one. 84 84
The attacker is trying to evade the defender 85 85
and the defender is trying to figure 86 86
out what the attacker is doing 87 87
or block their future attacks. 88 88
Now, when we look at covert channels 89 89
these can be created using two different methods. 90 90
We can use storage or timing 91 91
as our methods of a covert channel. 92 92
When we talk about a covert storage channel, 93 93
this is going to utilize one process 94 94
in the computer to write to a storage location 95 95
and then it'll use a different process to read 96 96
from that location. 97 97
By splitting up this reading and writing function 98 98
it can actually be a covert channel 99 99
that cannot be detected by the operating system kernel. 100 100
The second type of covert channel we can have 101 101
is covert timing channels. 102 102
Now, these are going to utilize one process to alter 103 103
a system resource 104 104
so that changes in its response time 105 105
can actually signal information to a recipient process. 106 106
Now for the CYSA+ exam, 107 107
you don't have to know these two types of channels 108 108
in depth and how they operate. 109 109
But just keep in mind that covert storage channels 110 110
use storage to be that covert method, 111 111
where I write to one part 112 112
and then read from that part of the drive, 113 113
and covert timing is going to use different timing 114 114
and sequences to pass information off. 115 115
For instance, I might send out a ping packet 116 116
and I can actually translate that into morse code. 117 117
So every time I send out a ping packet 118 118
on an even number or an odd number second 119 119
that might tell me whether it's a dot or dash. 120 120
Now, there are lots of different methods you can use 121 121
with timing channels, and you can create them 122 122
as complex or as simple as you want as an attacker. 123 123
but it's just something to be aware of as a defender 124 124
as you start seeing unusual things, 125 125
think, is this possibly a timing channel 126 126
or is this possibly a storage channel 127 127
that I should look into? 128 128
Now, in addition to this, 129 129
sometimes you'll have a covert channel 130 130
that's actually a hybrid of the two 131 131
and we'll actually combine the storage ability 132 132
and the timing channel ability. 133 133
This way, an attacker can evade detection as well. 134 134
Now, before we finish up this lesson, 135 135
I do want to talk about one more area 136 136
that we can use as an attacker 137 137
to be able to hide our data 138 138
when we're trying to do a data exfiltration. 139 139
Now, as a penetration tester, I call myself an attacker. 140 140
But you as a defender, 141 141
need to understand the way these attackers, 142 142
whether they are good guys working for you 143 143
or bad actors going against you, 144 144
and that way you can start looking for these type of things 145 145
and this is known steganography 146 146
Now, steganography is this hiding technique 147 147
where we're trying to hide data in plain sight. 148 148
Essentially, steganography is the practice 149 149
of concealing data within another file, 150 150
message, image, or video. 151 151
Now, there are lots of modern tools out there 152 152
that can help you hide digital information 153 153
so that the human eye cannot tell the difference. 154 154
For instance, 155 155
there's this Java tool called LSB steganography 156 156
and you can put a secret message of text 157 157
in the top part of this blank. 158 158
You'll upload an image, 159 159
which is the original image on the left side, 160 160
and then you will end up saving that text into the image. 161 161
Now, if you look at that image with the naked eye, 162 162
you cannot tell the difference. 163 163
But what's ended up happening here 164 164
is that in the background 165 165
those words of ASCII texts have been converted 166 166
into ones and zeros, 167 167
and they have slightly modified one pixel here 168 168
and one pixel there in that final image. 169 169
and those single pixels are only being changed 170 170
by a fraction of a bit. 171 171
So it might be yellow 172 172
and now it's a little bit of a lighter yellow. 173 173
This one might have been a green color 174 174
and now it's a little bit of a darker green. 175 175
And all those ones and zeros are put throughout that image 176 176
and it does affect the image quality just a little bit, 177 177
but it doesn't really add to the file size 178 178
or change the file much at all 179 179
and so it's very easy to hide information in these files. 180 180
Now, the reason we call it hiding in plain sight 181 181
is because there is no encryption here. 182 182
Anybody who has this tool 183 183
can actually take that steganography image, 184 184
loaded into the tool and then pull out the data 185 185
back to the text as well. 186 186
Now, the reason I wanted to bring up stenography to you 187 187
is not because it's used heavily 188 188
inside the attacker workspace. 189 189
In fact, it's one of the least common ones 190 190
that I've seen out in the wild. 191 191
But it is important to think about 192 192
because data loss countermeasures 193 193
do inspect outgoing packets 194 194
for a lot of different signatures 195 195
and they're looking at those signatures 196 196
to see if they match a database of known file signatures. 197 197
But if I take that file and I put it inside another file, 198 198
such as I did here with this text, 199 199
putting it inside the image, 200 200
that will actually be circumvented 201 201
from that countermeasure signature matching 202 202
because we are not going to match that text; 203 203
that text now became this image 204 204
or when I'm going to match the original image 205 205
because now we have the text embedded in it 206 206
and that changes the file a little bit. 207 207
So this is something to keep 208 208
in mind as you're looking at it. 209 209
In addition to using text in images, 210 210
you can use audio files, video files 211 211
pretty much whatever you want 212 212
and you can hide other data inside 213 213
of those type of files 214 214
and then pull it out using steganography