Guide to Encrypted Dynamic Covert Channels
Source: http://turboborland.blogspot.com/2008/12/guide-to-encrypted-dynamic-covert.html
Creating and Using New Covert Channels –Skip to end list for just a walkthrough on what to do–
+++State of Things+++
Covert channels in TCP/IP communications are dying from the public and security field's eye. When I talk about covert channels, several security professionals/researchers ask me what it is or say something along the lines of, "Like Stegonagraphy?". Publicly available, mass used, and not fully understood by implementer(s) intrusion detection systems (and their rulesets) and stateful firewalls could be why little is known anymore about this subject. With great tools that setup an encrypted tunnel (cryptcat, VPN software, etc.) publicly available and rather simple to use, the publics eye will be on these for a while. Which means that I can have my fun with my new covert channel without much risk!
+++Covert Channels of the Past+++
First off, let's talk about the past. Covert channels have been rather restrictive in their implementation (as far as the documentation on the channels and their uses goes). This because the communication was happening somewhere inside of a packet or multiple packets. This brought much more attention to checking for legitimate network communications. Active warden systems and/or network stabilizers was the software being researched and released to prevent these covert channels from happening. Basically, the new software looked at the packets and tried to find irregularities (heuristic and blacklist) in the network traffic (think stateful firewalls). Then it would take action depending on the software and/or configuration settings.
+++Requirements+++
This post should explain how to create your own special encrypted covert channel with a tshark filter, hping, and your brain (knowledge of TCP/IP communication would be greatly beneficial).
+++Down to the Good Stuff+++
So, my first step was to find a way to create a covert channel that's encrypted. This idea came to me after reading an article on port knocking. Port knocking is where you have a port that you want to connect to, but it's closed. This port opens when a certain amount of ports (UDP/TCP Open/Closed) are "knocked on" (connected, single packet sent to, whatever you want to count for a "knock" in your implementation). So, say I want access to port 22, SSH, but it's closed. I would run my program to connect to this port. What this program would do is send a SYN packet to TCP 7342, UDP 2738, UDP 3829, and TCP 80 thus opening port 22 for my ip for a certain length of time.
Now, what would happen if we did a simple algorithm to turn the port numbers into words? Say we hit TCP 2837 and TCP 2837="A". We have 655352 (TCP and UDP) possibilites open to us for a simple charset of our choosing. Or, say you want to use both source and destination port numbers, than we would have 1310702. Example simple encryption algorithm: Take the length of the word, multiply it by the amount of words in our sentance, then multiply each character by it's ASCII equivalent. If the number goes above 65535, turn negative and start at -1. Each negative number are UDP ports, each positive are TCP. ->This creates a unique encryption, unless you steal my too simplistic idea or use someone else's encryption, that anyone can setup and modify easily.
Alright, so we have TCP 503, TCP 17532, TCP 1934, TCP 10374, UDP 59 and it spells out "hello". Now, we want to send it to another person on the network (original idea for why this method was thought of by me). We don't want to give away our originating ip addresses, so we will be using hping3. Hping3 takes advantage of the insecurities dealing with the TCP/IP stack. With it we have the ability to create and send packets on the network (with a spoofed source address if wanted). Network Architecture: 192.168.1.1 - Shitty Router 192.168.1.4 - Client using internet 192.168.1.7 - Me 192.168.1.9 - Person I want to talk to 192.168.1.17 - Client using internet 192.168.1.20 - VoIP server 192.168.1.24 - Client using internet 192.168.1.48 - Web server 192.168.1.50 - Client using internet 192.168.1.69 - Client using internet 192.168.1.78 - Client using internet 192.168.1.94 - Client using internet
First attempt: hping command: hping3 -I wlan1 -V -S 192.168.1.69 -a 192.168.1.4 -p 503 -c 1 –sign "secretkey" ->interface wlan1, be verbose, Syn packet, destination: 192.168.1.69, source: 192.168.1.4, TCP 503 = "h", stop after 1 packet, sign packet with text "secretkey" tshark command: tshark -i wlan1 -n -R "tcp contains secretkey" ->interface wlan1, don't run DNS on port number, addresses, etc., only show tcp packets that contain the text "secretkey"
Pretty simple, huh? It should be easy to modify as long as you RTFM. This is a failed attempt, and I'll tell you why. First, our packet is pretty broken and might not look like legitimate traffic in the eyes of the network's security. Also we placed text into the packet and that might trigger an alarm or create a fingerprint to easily track the rest of the packets. Not that it matters because the talk is encrypted with whatever algorithm you created, but we want as much stealth as possible without tripping any alarms.
Second attempt: hping command: hping3 -I wlan1 -V -S 192.168.1.69 -a 192.168.1.4 -p 503 -c 1 -t 60 –tcp-timestamp ->This time we used a ttl (time to live) and set it to 60, instead of the default 64 that hping puts out. I also included a tcp timestamp to make the packet look more like a normal packet. tshark command: tshark -i wlan1 -n -R "ip.ttl == 60"
Great, so now we created a system where only the information we want to recieve will show up on our sniffer and it's easy to modify. Learn TCP/IP and filters to make yours more unique. There are, unfortunately, two more problems we need to address. The first being that our cards are going into promiscuous mode and the second being how fast the packets are being sent out. You should be able to figure out a way around the network card problem, there are limitless possibilities. Although, unless you're on a secure network where you think/know they have something checking for network cards in this mode, don't worry about this too much. One way around it would be to send packets to and from each other instead of spoofing the source and destination addresses. Then, we can set tshark to not run in promiscuous mode. If you start sending trash requests to different webpages at the same time, it would be like finding a needle in a haystack when looking through logs. Let alone them somehow knowing of your private channel. As for the amount of packets being sent out in a short time, we can fix that easily. Sending a lot of packets rather quickly is a problem that has great potential to trigger all sorts of alerts. Time out your packet sending, maybe send a packet at random intervals between 3-20 seconds? Remember, patience is a virtue.
+++Coders/Scripters+++ It would probably be in your best interest to create some kind of program for automation of this method. A simple "./covert this would be the text you want to send", so you could pipe something else in there if you wanted (for those of you who can reconstruct a file after it's been fragmented like that). Then it encrypts the message for you and modifies your hping3 commands accordingly. Don't forget about packet sending times! On the reciever's end, strip out the port numbers from your tshark dump and pipe it into your decryption program.
+++The Simple Covert Channel Walkthrough+++ –Just making a simple list for those who don't want to read the article. If you've read the article, you probably won't want to read this as it's just a repeat.– 1.) Port numbers represent characters. Each port number will be a character. We can use any open/closed, TCP/UDP, source/destination, ports. This gives us 131070*2 possibilities for our pre-defined charset. 2.) Create an encryption algorithm for the port to character conversion. Make one up yourself so it's completely unique. Don't be simplistic, we are using this for sending information we probably don't want anyone to find out about. 3.) Run hping to create and send packets. Use hping's ability to spoof source and destination addresses. 4.) Make the packets different than most network traffic, but not so much as to send up alerts. A simple change like ttl time would be recommended. 5.) Run tshark and apply a filter to find your modified packets. 6.) Take the port numbers and decrypt them for your message/file/etc. 7.) Automate the process for large files 8.) Now read the article for a more thorough analysis of this method, downfalls/possible problems, and how to free yourself from those possible problems.
Tyler Borland
**Also, if anyone has web space for me and will let me upload my security videos to it, I'll re-release them to the community.
Quite the competent information, from a quick glance. Wish I could devote more time to reading it today, but the holidays have me stuck with family. Would love to see it as an article instead, but may sticky this to keep it in view.
Oh, and love the blog… I'm sure someone would be more than happy to supply space for the vids. As an offhand question, what's the average size of the vids and are they in flv or normal vid format?
Well, a couple are giant .avi files (when I first started them) and the others are small .swf's.
total 1433176 -rwxrwxrwx 1 username youknowwhat 117003264 2007-05-15 01:52 bbcode.avi -rwxrwxrwx 1 username youknowwhat 12611823 2007-08-01 00:09 bbcode_new.swf -rwxrwxrwx 1 username youknowwhat 19002579 2007-06-21 01:14 blindsqlint.swf -rwxrwxrwx 1 username youknowwhat 6758969 2007-06-19 01:37 blindsql.swf -rwxrwxrwx 1 username youknowwhat 291830784 2007-05-11 03:42 cookies.avi -rwxrwxrwx 1 username youknowwhat 8511645 2007-08-24 04:19 crackzip.swf -rwxrwxrwx 1 username youknowwhat 87317504 2007-04-03 02:16 dreamweaversucks.avi -rwxrwxrwx 1 username youknowwhat 5142665 2007-06-14 02:18 eval.swf -rwxrwxrwx 1 username youknowwhat 237788672 2007-05-18 00:57 funwithcsrf.avi drwxrwxrwx 2 username youknowwhat 4096 2008-08-04 13:47 hidingads -rwxrwxrwx 1 username youknowwhat 235954176 2007-05-10 01:56 includes.avi -rwxrwxrwx 1 username youknowwhat 2123794 2007-06-24 23:36 mailspoof.swf -rwxrwxrwx 1 username youknowwhat 92503552 2007-05-14 01:11 persistant.avi drwxrwxrwx 2 username youknowwhat 4096 2008-08-04 13:47 ripping_flash -rwxrwxrwx 1 username youknowwhat 2161596 2007-06-26 01:20 sessions.swf -rwxrwxrwx 1 username youknowwhat 128448512 2007-04-18 12:34 useragent.avi -rwxrwxrwx 1 username youknowwhat 6254519 2007-07-27 04:04 winxp.swf -rwxrwxrwx 1 username youknowwhat 212524032 2007-04-04 01:07 xss2.avi
nights_shadow wrote: Is there anyone out there who could provide me with some web space for these videos? Wow… those are rather large, even for the SWFs. I will see what I can work out to arrange web space for them, though. I would be honored to host such content. I will message you when I have arrangements made.