1
1

00:00:00,000  -->  00:00:01,830
<v Instructor>Covert channels,</v>
2

2

00:00:01,830  -->  00:00:04,022
now, in the last lesson on data exfiltration,
3

3

00:00:04,022  -->  00:00:06,210
I talked about overt channels,
4

4

00:00:06,210  -->  00:00:08,790
things like FTP or peer-to-peer
5

5

00:00:08,790  -->  00:00:12,240
or instant messaging that are obvious ways to send data,
6

6

00:00:12,240  -->  00:00:16,140
but data exfiltration can also happen over covert channels.
7

7

00:00:16,140  -->  00:00:17,730
We talked about this by hiding data
8

8

00:00:17,730  -->  00:00:20,490
inside of DNS and other methods like this.
9

9

00:00:20,490  -->  00:00:21,323
In this lesson,
10

10

00:00:21,323  -->  00:00:24,060
we're going to talk more about what a covert channel is.
11

11

00:00:24,060  -->  00:00:26,520
Now, a covert channel is a communications path
12

12

00:00:26,520  -->  00:00:28,980
that allows data to be sent outside of the network
13

13

00:00:28,980  -->  00:00:31,140
without alerting any intrusion detection
14

14

00:00:31,140  -->  00:00:33,240
or data loss countermeasures.
15

15

00:00:33,240  -->  00:00:35,910
Now, covert channels can enable the stealthy transmission
16

16

00:00:35,910  -->  00:00:38,160
of data from node-to-node using means
17

17

00:00:38,160  -->  00:00:41,010
that your security controls simply don't anticipate.
18

18

00:00:41,010  -->  00:00:44,130
For instance, if you don't tune your IDS to start looking
19

19

00:00:44,130  -->  00:00:47,550
at those DNS records, that would be a covert channel.
20

20

00:00:47,550  -->  00:00:49,560
You might have a covert channel that is sending information
21

21

00:00:49,560  -->  00:00:51,900
over ICMP echo reply packets
22

22

00:00:51,900  -->  00:00:54,330
which are what we send out in response to a ping.
23

23

00:00:54,330  -->  00:00:56,460
Again, a lot of IDSs aren't looking
24

24

00:00:56,460  -->  00:00:58,080
for that type of information.
25

25

00:00:58,080  -->  00:00:59,537
So as we go through the rest of this lesson,
26

26

00:00:59,537  -->  00:01:02,700
we are going to talk about some different covert channels.
27

27

00:01:02,700  -->  00:01:05,910
First, you might find a covert channel that takes advantage
28

28

00:01:05,910  -->  00:01:09,210
of egress filtering not being applied to a firewall.
29

29

00:01:09,210  -->  00:01:10,920
This way they can transmit data
30

30

00:01:10,920  -->  00:01:13,830
over a non-standard port and send information out.
31

31

00:01:13,830  -->  00:01:15,210
We talked about this in depth
32

32

00:01:15,210  -->  00:01:16,810
in our non-standard port lesson.
33

33

00:01:17,790  -->  00:01:20,580
Second, you might have data that gets encoded
34

34

00:01:20,580  -->  00:01:22,230
and that encoded data is then sent
35

35

00:01:22,230  -->  00:01:25,350
out as part of the TCP IP packet headers.
36

36

00:01:25,350  -->  00:01:28,080
So as we've already mentioned, we may take data, encode it
37

37

00:01:28,080  -->  00:01:30,600
as part of an echo reply for ICMP
38

38

00:01:30,600  -->  00:01:33,360
or part of a DNS text record and send it out.
39

39

00:01:33,360  -->  00:01:36,000
By doing this, it can evade detection.
40

40

00:01:36,000  -->  00:01:38,490
The third thing we can do is we can start segmenting data
41

41

00:01:38,490  -->  00:01:39,960
into multiple packets,
42

42

00:01:39,960  -->  00:01:42,210
by chunking up that data into multiple packets,
43

43

00:01:42,210  -->  00:01:44,220
these can be sent at separate times
44

44

00:01:44,220  -->  00:01:46,230
and this can help you evade signature analysis
45

45

00:01:46,230  -->  00:01:47,640
and data loss prevention
46

46

00:01:47,640  -->  00:01:49,350
because a lot of these signature analysis
47

47

00:01:49,350  -->  00:01:52,680
and data loss prevention tools only use a short window
48

48

00:01:52,680  -->  00:01:55,140
and so that might be 30 seconds or 60 seconds
49

49

00:01:55,140  -->  00:01:56,790
when they start reconstructing packets
50

50

00:01:56,790  -->  00:01:58,140
to search for signatures.
51

51

00:01:58,140  -->  00:01:59,760
If you sent out a packet right now,
52

52

00:01:59,760  -->  00:02:00,930
and a packet in three minutes
53

53

00:02:00,930  -->  00:02:02,850
and another packet in three minutes after that,
54

54

00:02:02,850  -->  00:02:06,360
that may get through the sensors and not trigger any alerts.
55

55

00:02:06,360  -->  00:02:07,410
The fourth thing you might look
56

56

00:02:07,410  -->  00:02:10,290
at is obfuscating data using hex.
57

57

00:02:10,290  -->  00:02:11,850
This way you can transmit strings
58

58

00:02:11,850  -->  00:02:14,820
of data using hex code instead of using character strings.
59

59

00:02:14,820  -->  00:02:16,890
By using hex, it can get through the sensors
60

60

00:02:16,890  -->  00:02:18,240
because the sensors may be looking
61

61

00:02:18,240  -->  00:02:21,180
for an ASCII string and not a hex string.
62

62

00:02:21,180  -->  00:02:22,950
The fifth type of covert channel is
63

63

00:02:22,950  -->  00:02:26,070
when you start transmitting data in an encrypted format
64

64

00:02:26,070  -->  00:02:26,903
by sending it
65

65

00:02:26,903  -->  00:02:29,910
out through an encrypted format like an SSL or TLS tunnel,
66

66

00:02:29,910  -->  00:02:32,580
this can prevent inspection as it leaves the network,
67

67

00:02:32,580  -->  00:02:34,890
unless somebody has a break and inspect device
68

68

00:02:34,890  -->  00:02:37,140
sitting at the edge of their network.
69

69

00:02:37,140  -->  00:02:38,850
So when you're trying to mitigate
70

70

00:02:38,850  -->  00:02:40,770
against these different types of covert channels
71

71

00:02:40,770  -->  00:02:42,090
what can you do?
72

72

00:02:42,090  -->  00:02:43,500
Well, the best thing to do
73

73

00:02:43,500  -->  00:02:45,450
is use advanced intrusion detection
74

74

00:02:45,450  -->  00:02:48,000
or user behavior analytics tools.
75

75

00:02:48,000  -->  00:02:49,410
These are going to be your best options
76

76

00:02:49,410  -->  00:02:51,270
to help detect those covert channels.
77

77

00:02:51,270  -->  00:02:53,760
But keep in mind, they are not foolproof
78

78

00:02:53,760  -->  00:02:55,950
and they will not detect everything.
79

79

00:02:55,950  -->  00:02:57,180
As I've said before,
80

80

00:02:57,180  -->  00:02:59,790
as the defenders get better, so do the attackers.
81

81

00:02:59,790  -->  00:03:01,890
And so we're constantly having this chess match
82

82

00:03:01,890  -->  00:03:03,840
where each side is trying different things
83

83

00:03:03,840  -->  00:03:05,580
to get something by the other one.
84

84

00:03:05,580  -->  00:03:07,350
The attacker is trying to evade the defender
85

85

00:03:07,350  -->  00:03:08,730
and the defender is trying to figure
86

86

00:03:08,730  -->  00:03:09,840
out what the attacker is doing
87

87

00:03:09,840  -->  00:03:12,180
or block their future attacks.
88

88

00:03:12,180  -->  00:03:14,160
Now, when we look at covert channels
89

89

00:03:14,160  -->  00:03:16,620
these can be created using two different methods.
90

90

00:03:16,620  -->  00:03:18,420
We can use storage or timing
91

91

00:03:18,420  -->  00:03:20,790
as our methods of a covert channel.
92

92

00:03:20,790  -->  00:03:22,800
When we talk about a covert storage channel,
93

93

00:03:22,800  -->  00:03:24,630
this is going to utilize one process
94

94

00:03:24,630  -->  00:03:27,090
in the computer to write to a storage location
95

95

00:03:27,090  -->  00:03:29,070
and then it'll use a different process to read
96

96

00:03:29,070  -->  00:03:30,390
from that location.
97

97

00:03:30,390  -->  00:03:33,000
By splitting up this reading and writing function
98

98

00:03:33,000  -->  00:03:35,040
it can actually be a covert channel
99

99

00:03:35,040  -->  00:03:38,160
that cannot be detected by the operating system kernel.
100

100

00:03:38,160  -->  00:03:40,110
The second type of covert channel we can have
101

101

00:03:40,110  -->  00:03:42,000
is covert timing channels.
102

102

00:03:42,000  -->  00:03:44,340
Now, these are going to utilize one process to alter
103

103

00:03:44,340  -->  00:03:45,450
a system resource
104

104

00:03:45,450  -->  00:03:46,980
so that changes in its response time
105

105

00:03:46,980  -->  00:03:50,220
can actually signal information to a recipient process.
106

106

00:03:50,220  -->  00:03:52,200
Now for the CYSA+ exam,
107

107

00:03:52,200  -->  00:03:54,210
you don't have to know these two types of channels
108

108

00:03:54,210  -->  00:03:55,920
in depth and how they operate.
109

109

00:03:55,920  -->  00:03:58,530
But just keep in mind that covert storage channels
110

110

00:03:58,530  -->  00:04:00,510
use storage to be that covert method,
111

111

00:04:00,510  -->  00:04:01,590
where I write to one part
112

112

00:04:01,590  -->  00:04:03,600
and then read from that part of the drive,
113

113

00:04:03,600  -->  00:04:05,790
and covert timing is going to use different timing
114

114

00:04:05,790  -->  00:04:08,010
and sequences to pass information off.
115

115

00:04:08,010  -->  00:04:10,470
For instance, I might send out a ping packet
116

116

00:04:10,470  -->  00:04:12,720
and I can actually translate that into morse code.
117

117

00:04:12,720  -->  00:04:14,820
So every time I send out a ping packet
118

118

00:04:14,820  -->  00:04:17,460
on an even number or an odd number second
119

119

00:04:17,460  -->  00:04:19,980
that might tell me whether it's a dot or dash.
120

120

00:04:19,980  -->  00:04:21,750
Now, there are lots of different methods you can use
121

121

00:04:21,750  -->  00:04:23,910
with timing channels, and you can create them
122

122

00:04:23,910  -->  00:04:26,940
as complex or as simple as you want as an attacker.
123

123

00:04:26,940  -->  00:04:28,710
but it's just something to be aware of as a defender
124

124

00:04:28,710  -->  00:04:30,630
as you start seeing unusual things,
125

125

00:04:30,630  -->  00:04:32,760
think, is this possibly a timing channel
126

126

00:04:32,760  -->  00:04:34,470
or is this possibly a storage channel
127

127

00:04:34,470  -->  00:04:35,760
that I should look into?
128

128

00:04:35,760  -->  00:04:36,960
Now, in addition to this,
129

129

00:04:36,960  -->  00:04:38,640
sometimes you'll have a covert channel
130

130

00:04:38,640  -->  00:04:40,560
that's actually a hybrid of the two
131

131

00:04:40,560  -->  00:04:42,480
and we'll actually combine the storage ability
132

132

00:04:42,480  -->  00:04:44,550
and the timing channel ability.
133

133

00:04:44,550  -->  00:04:47,580
This way, an attacker can evade detection as well.
134

134

00:04:47,580  -->  00:04:49,200
Now, before we finish up this lesson,
135

135

00:04:49,200  -->  00:04:51,390
I do want to talk about one more area
136

136

00:04:51,390  -->  00:04:53,250
that we can use as an attacker
137

137

00:04:53,250  -->  00:04:54,750
to be able to hide our data
138

138

00:04:54,750  -->  00:04:56,910
when we're trying to do a data exfiltration.
139

139

00:04:56,910  -->  00:05:00,210
Now, as a penetration tester, I call myself an attacker.
140

140

00:05:00,210  -->  00:05:01,560
But you as a defender,
141

141

00:05:01,560  -->  00:05:03,750
need to understand the way these attackers,
142

142

00:05:03,750  -->  00:05:05,820
whether they are good guys working for you
143

143

00:05:05,820  -->  00:05:08,580
or bad actors going against you,
144

144

00:05:08,580  -->  00:05:11,220
and that way you can start looking for these type of things
145

145

00:05:11,220  -->  00:05:13,590
and this is known steganography
146

146

00:05:13,590  -->  00:05:15,900
Now, steganography is this hiding technique
147

147

00:05:15,900  -->  00:05:18,570
where we're trying to hide data in plain sight.
148

148

00:05:18,570  -->  00:05:20,820
Essentially, steganography is the practice
149

149

00:05:20,820  -->  00:05:23,250
of concealing data within another file,
150

150

00:05:23,250  -->  00:05:25,620
message, image, or video.
151

151

00:05:25,620  -->  00:05:27,720
Now, there are lots of modern tools out there
152

152

00:05:27,720  -->  00:05:29,790
that can help you hide digital information
153

153

00:05:29,790  -->  00:05:32,820
so that the human eye cannot tell the difference.
154

154

00:05:32,820  -->  00:05:33,653
For instance,
155

155

00:05:33,653  -->  00:05:37,260
there's this Java tool called LSB steganography
156

156

00:05:37,260  -->  00:05:39,420
and you can put a secret message of text
157

157

00:05:39,420  -->  00:05:41,010
in the top part of this blank.
158

158

00:05:41,010  -->  00:05:42,240
You'll upload an image,
159

159

00:05:42,240  -->  00:05:44,130
which is the original image on the left side,
160

160

00:05:44,130  -->  00:05:47,850
and then you will end up saving that text into the image.
161

161

00:05:47,850  -->  00:05:49,800
Now, if you look at that image with the naked eye,
162

162

00:05:49,800  -->  00:05:51,300
you cannot tell the difference.
163

163

00:05:51,300  -->  00:05:53,040
But what's ended up happening here
164

164

00:05:53,040  -->  00:05:54,330
is that in the background
165

165

00:05:54,330  -->  00:05:56,610
those words of ASCII texts have been converted
166

166

00:05:56,610  -->  00:05:57,990
into ones and zeros,
167

167

00:05:57,990  -->  00:06:00,660
and they have slightly modified one pixel here
168

168

00:06:00,660  -->  00:06:03,120
and one pixel there in that final image.
169

169

00:06:03,120  -->  00:06:05,370
and those single pixels are only being changed
170

170

00:06:05,370  -->  00:06:07,140
by a fraction of a bit.
171

171

00:06:07,140  -->  00:06:08,280
So it might be yellow
172

172

00:06:08,280  -->  00:06:10,290
and now it's a little bit of a lighter yellow.
173

173

00:06:10,290  -->  00:06:11,580
This one might have been a green color
174

174

00:06:11,580  -->  00:06:13,440
and now it's a little bit of a darker green.
175

175

00:06:13,440  -->  00:06:16,410
And all those ones and zeros are put throughout that image
176

176

00:06:16,410  -->  00:06:19,170
and it does affect the image quality just a little bit,
177

177

00:06:19,170  -->  00:06:21,150
but it doesn't really add to the file size
178

178

00:06:21,150  -->  00:06:23,040
or change the file much at all
179

179

00:06:23,040  -->  00:06:26,010
and so it's very easy to hide information in these files.
180

180

00:06:26,010  -->  00:06:28,020
Now, the reason we call it hiding in plain sight
181

181

00:06:28,020  -->  00:06:29,910
is because there is no encryption here.
182

182

00:06:29,910  -->  00:06:31,710
Anybody who has this tool
183

183

00:06:31,710  -->  00:06:33,810
can actually take that steganography image,
184

184

00:06:33,810  -->  00:06:36,630
loaded into the tool and then pull out the data
185

185

00:06:36,630  -->  00:06:37,983
back to the text as well.
186

186

00:06:38,820  -->  00:06:40,950
Now, the reason I wanted to bring up stenography to you
187

187

00:06:40,950  -->  00:06:42,600
is not because it's used heavily
188

188

00:06:42,600  -->  00:06:44,610
inside the attacker workspace.
189

189

00:06:44,610  -->  00:06:46,560
In fact, it's one of the least common ones
190

190

00:06:46,560  -->  00:06:48,180
that I've seen out in the wild.
191

191

00:06:48,180  -->  00:06:49,830
But it is important to think about
192

192

00:06:49,830  -->  00:06:51,780
because data loss countermeasures
193

193

00:06:51,780  -->  00:06:53,250
do inspect outgoing packets
194

194

00:06:53,250  -->  00:06:54,840
for a lot of different signatures
195

195

00:06:54,840  -->  00:06:55,950
and they're looking at those signatures
196

196

00:06:55,950  -->  00:06:58,770
to see if they match a database of known file signatures.
197

197

00:06:58,770  -->  00:07:02,370
But if I take that file and I put it inside another file,
198

198

00:07:02,370  -->  00:07:03,720
such as I did here with this text,
199

199

00:07:03,720  -->  00:07:05,220
putting it inside the image,
200

200

00:07:05,220  -->  00:07:07,080
that will actually be circumvented
201

201

00:07:07,080  -->  00:07:09,030
from that countermeasure signature matching
202

202

00:07:09,030  -->  00:07:11,190
because we are not going to match that text;
203

203

00:07:11,190  -->  00:07:13,080
that text now became this image
204

204

00:07:13,080  -->  00:07:14,580
or when I'm going to match the original image
205

205

00:07:14,580  -->  00:07:16,257
because now we have the text embedded in it
206

206

00:07:16,257  -->  00:07:18,330
and that changes the file a little bit.
207

207

00:07:18,330  -->  00:07:19,290
So this is something to keep
208

208

00:07:19,290  -->  00:07:21,000
in mind as you're looking at it.
209

209

00:07:21,000  -->  00:07:22,860
In addition to using text in images,
210

210

00:07:22,860  -->  00:07:24,790
you can use audio files, video files
211

211

00:07:24,790  -->  00:07:26,700
pretty much whatever you want
212

212

00:07:26,700  -->  00:07:28,740
and you can hide other data inside
213

213

00:07:28,740  -->  00:07:29,610
of those type of files
214

214

00:07:29,610  -->  00:07:31,610
and then pull it out using steganography