Re: Covert Channels

[Darryl Luff <darryl () snakegully nu>]

> Jeremy Junginger wrote:

> Has anyone had success in creating a program that uses IP/TCP/UDP/ICMP
> header information to transmit encoded messages from one host to
> another?  Shortly after reading


Hi Jeremy,

As you say there are usually easier ways. If you're inside a firewall 
connecting out, you can just use http, https or email through their 
existing systems. If you're outside trying to connect in, I think that 
the main problem is getting your packets in to where the target system 
can see them. If you can do that, you can encode it however you want.

I imagine that the easiest way would be to pick an unknown IP or TCP 
option number and insert your own options field into the IP or TCP 
header. This keeps your data separate from the TCP connection data. I 
think that an option field can be up to 253 bytes of data?

Do any IDS systems trigger on unrecognised option fields?


Darryl Luff