Herzberg, Amir ; Shulman, Haya (2013)
Limiting MitM to MitE Covert-Channels.
Regensburg, Germany
doi: 10.1109/ARES.2013.138
Conference or Workshop Item, Bibliographie
Abstract
We study covert channels between a MitM attacker, and her MitE 'malware', running within the protected network of a victim organisation, and how to prevent or limit such channels. Our focus is on advanced timing channels, that allow communication between the MitM and MitE, even when hosts inside the protected network are restricted to only communicate to other (local and remote) hosts in the protected network. Furthermore, we assume communication is encrypted with fixed packet size (padding). We show that these do not suffice to prevent covert channels between MitM and MitE; furthermore, we show that even if we restrict communication to a constant rate, e.g., one packet everysecond, communication from MitE to MitM is still possible.We present efficient traffic shapers against covert channels between MitM and MitE. Our solutions preserve efficiency and bounded delay (QoS), while limiting covert traffic leakage, in both directions.
| Item Type: | Conference or Workshop Item |
|---|---|
| Erschienen: | 2013 |
| Creators: | Herzberg, Amir ; Shulman, Haya |
| Type of entry: | Bibliographie |
| Title: | Limiting MitM to MitE Covert-Channels |
| Language: | English |
| Date: | September 2013 |
| Publisher: | IEEE Computer Society |
| Book Title: | 2013 International Conference on Availability, Reliability and Security |
| Series: | ARES 2013 |
| Event Location: | Regensburg, Germany |
| DOI: | 10.1109/ARES.2013.138 |
| Abstract: | We study covert channels between a MitM attacker, and her MitE 'malware', running within the protected network of a victim organisation, and how to prevent or limit such channels. Our focus is on advanced timing channels, that allow communication between the MitM and MitE, even when hosts inside the protected network are restricted to only communicate to other (local and remote) hosts in the protected network. Furthermore, we assume communication is encrypted with fixed packet size (padding). We show that these do not suffice to prevent covert channels between MitM and MitE; furthermore, we show that even if we restrict communication to a constant rate, e.g., one packet everysecond, communication from MitE to MitM is still possible.We present efficient traffic shapers against covert channels between MitM and MitE. Our solutions preserve efficiency and bounded delay (QoS), while limiting covert traffic leakage, in both directions. |
| Uncontrolled Keywords: | Logic gates, Delays, Virtual private networks, Internet, Quality of service, Bandwidth |
| Identification Number: | TUD-CS-2013-0473 |
| Divisions: | Profile Areas Profile Areas > Cybersecurity (CYSEC) |
| Date Deposited: | 24 Aug 2017 17:06 |
| Last Modified: | 17 Apr 2019 11:57 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Send an inquiry |
Options (only for editors)
 |
Show editorial Details |
Drucken
Impressum