Herzberg, Amir ; Shulman, Haya (2013)
Limiting MitM to MitE Covert-Channels.
Regensburg, Germany
doi: 10.1109/ARES.2013.138
Konferenzveröffentlichung, Bibliographie
Kurzbeschreibung (Abstract)
We study covert channels between a MitM attacker, and her MitE 'malware', running within the protected network of a victim organisation, and how to prevent or limit such channels. Our focus is on advanced timing channels, that allow communication between the MitM and MitE, even when hosts inside the protected network are restricted to only communicate to other (local and remote) hosts in the protected network. Furthermore, we assume communication is encrypted with fixed packet size (padding). We show that these do not suffice to prevent covert channels between MitM and MitE; furthermore, we show that even if we restrict communication to a constant rate, e.g., one packet everysecond, communication from MitE to MitM is still possible.We present efficient traffic shapers against covert channels between MitM and MitE. Our solutions preserve efficiency and bounded delay (QoS), while limiting covert traffic leakage, in both directions.
| Typ des Eintrags: | Konferenzveröffentlichung |
|---|---|
| Erschienen: | 2013 |
| Autor(en): | Herzberg, Amir ; Shulman, Haya |
| Art des Eintrags: | Bibliographie |
| Titel: | Limiting MitM to MitE Covert-Channels |
| Sprache: | Englisch |
| Publikationsjahr: | September 2013 |
| Verlag: | IEEE Computer Society |
| Buchtitel: | 2013 International Conference on Availability, Reliability and Security |
| Reihe: | ARES 2013 |
| Veranstaltungsort: | Regensburg, Germany |
| DOI: | 10.1109/ARES.2013.138 |
| Kurzbeschreibung (Abstract): | We study covert channels between a MitM attacker, and her MitE 'malware', running within the protected network of a victim organisation, and how to prevent or limit such channels. Our focus is on advanced timing channels, that allow communication between the MitM and MitE, even when hosts inside the protected network are restricted to only communicate to other (local and remote) hosts in the protected network. Furthermore, we assume communication is encrypted with fixed packet size (padding). We show that these do not suffice to prevent covert channels between MitM and MitE; furthermore, we show that even if we restrict communication to a constant rate, e.g., one packet everysecond, communication from MitE to MitM is still possible.We present efficient traffic shapers against covert channels between MitM and MitE. Our solutions preserve efficiency and bounded delay (QoS), while limiting covert traffic leakage, in both directions. |
| Freie Schlagworte: | Logic gates, Delays, Virtual private networks, Internet, Quality of service, Bandwidth |
| ID-Nummer: | TUD-CS-2013-0473 |
| Fachbereich(e)/-gebiet(e): | Profilbereiche Profilbereiche > Cybersicherheit (CYSEC) |
| Hinterlegungsdatum: | 24 Aug 2017 17:06 |
| Letzte Änderung: | 17 Apr 2019 11:57 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum