CONNECTION: COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioN

TL;DR

This paper presents a novel covert channel attack using bit-rate modulation over wide area networks, demonstrating its effectiveness in exfiltrating data stealthily while evading detection systems.

Contribution

It introduces a new covert communication method based on bit-rate modulation, analyzing its performance and security risks in network environments.

Findings

Achieved 5 bps data transfer rate with high robustness.

Channel capacity reached up to 0.9239 bps/Hz under noise.

Demonstrated potential to bypass network security measures.

Abstract

Covert channel networks are a well-known method for circumventing the security measures organizations put in place to protect their networks from adversarial attacks. This paper introduces a novel method based on bit-rate modulation for implementing covert channels between devices connected over a wide area network. This attack can be exploited to exfiltrate sensitive information from a machine (i.e., covert sender) and stealthily transfer it to a covert receiver while evading network security measures and detection systems. We explain how to implement this threat, focusing specifically on covert channel networks and their potential security risks to network information transmission. The proposed method leverages bit-rate modulation, where a high bit rate represents a '1' and a low bit rate represents a '0', enabling covert communication. We analyze the key metrics associated with covert channels, including robustness in the presence of legitimate traffic and other interference, bit-rate capacity, and bit error rate. Experiments demonstrate the good performance of this attack, which achieved 5 bps with excellent robustness and a channel capacity of up to 0.9239 bps/Hz under different noise sources. Therefore, we show that bit-rate modulation effectively violates network security and compromises sensitive data.