Covert channels in TCP timestamps

Rachel Greenstadt


We present a protocol for sending data over a common class of low-bandwidth covert channels. Covert channels exist in most communications systems and allow individuals to communicate truly undetectably. However, covert channels are seldom used due to their complexity. Our protocol is both practical and secure against attack by powerful adversaries. We implement our protocol on a standard platform (Linux) exploiting a channel in a common communications system (TCP timestamps).

Brought to you by the MIT LCS Applied Security Reading Group