Publikationen

Autor	Herzberg, Amir; Shulman, Haya
Datum	2013
Art	Conference Proceedings
Abstrakt	We study covert channels between a MitM attacker, and her MitE 'malware', running within the protected network of a victim organisation, and how to prevent or limit such channels. Our focus is on advanced timing channels, that allow communication between the MitM and MitE, even when hosts inside the protected network are restricted to only communicate to other (local and remote) hosts in the protected network. Furthermore, we assume communication is encrypted with fixed packet size (padding). We show that these do not suffice to prevent covert channels between MitM and MitE; furthermore, we show that even if we restrict communication to a constant rate, e.g., one packet everysecond, communication from MitE to MitM is still possible.We present efficient traffic shapers against covert channels between MitM and MitE. Our solutions preserve efficiency and bounded delay (QoS), while limiting covert traffic leakage, in both directions.
Serie	ARES 2013
In	2013 International Conference on Availability, Reliability and Security, p.236-241
Publisher	IEEE Computer Society
Schlüssel	TUD-CS-2013-0473
Url	https://tubiblio.ulb.tu-darmstadt.de/id/eprint/98227

Limiting MitM to MitE Covert-Channels