[REVS] Exploitation of Data Streams Authorized by a Network Access Control System for Arbitrary Data Transfers: Tunneling and Covert Channels over the HTTP Protocol

• Previous message: SecuriTeam: "[EXPL] Another Cdrecord Format String Vulnerability Exploit Released"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 18 Jun 2003 14:54:25 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Latest attack techniques.

You're a pen tester, but is google.com still your R&D team?
Now you can get trustworthy commercial-grade exploits and the latest
techniques from a world-class research group.

Learn more at http://www.coresecurity.com/promos/sit_e1,
or call 617-399-6980

- - - - - - - - -

  Exploitation of Data Streams Authorized by a Network Access Control System
for Arbitrary Data Transfers: Tunneling and Covert Channels over the HTTP
Protocol
------------------------------------------------------------------------

SUMMARY

The following paper will try to illustrate how the HTTP protocol can be
used to transfer covert communications. The paper is a very detailed, and
contains a lot of background information on the HTTP protocol, the
different capabilities that allow malicious users to hide data streams
inside, and the different methods of creating covert channels.

DETAILS

Abstract:
Authorizations of data transit between interconnected networks are defined
and set up into Network Access Control Systems (NACS).

Regardless of different NACS configurations, it is possible, at the
present time, via several evasion methods, to use authorized streams to
transit arbitrary data whose traffic is not allowed or thought of, thus
building what is often presented as a "covert channel".

A lot of covert channels and tunneling approaches are available as papers
or exploitation tools at the present time. Some are hidden into lower
layers of the OSI model whereas other is hidden into the higher one.

As the HTTP protocol is one of the most widely used protocol at the
present time, one can consider that designing tunneling and covert channel
tools over it is something researchers as much as network administrators
should think about.

Various design aspects can be taken into consideration when implementing
an HTTP Client/Server covert channel tool : What kind of server model can
be implemented (Httpd-like, Proxy-like, CGI-Like) - How can the tool be
designed to add confusion from a traffic watcher point of view (Server
proxy chain, Intermediaries distributed servers, Almost-real proxy server
and legitimate third-party models) - What kind of functionality can be
implemented into the covert channel (Single application client and Single
application client proxy modes, Server proxy mode, Client reverse
connection proxy mode and Proprietary user defined protocol mode).

Then, when the HTTP covert channel client/server tool is modelized,
designers can think about how their design could be applied in a real
world environment: What kind of HTTP method can be used (With or Without
Message body, be using the CONNECT method or not?) - What kind of HTTP
legitimate servers can be used to transit the arbitrary data stream
through the NACS (HTTP and reverse proxies, other applications).

Designing covert channel tools also implies to consider their security
underlying aspects: Server and client authentication and authorization,
data stream ciphering and integrity, protection against replay. Another
special consideration should be taken during the development stage itself
to get a clean source code which (as much as possible) is exempt of bad
parts.

Since the corner stone of covert channel methods relies on their intrinsic
stealth-ness, a particular attention can be paid on using specific
covering and steganographic techniques to confuse an eventual observer.

Hiding data into HTTP requests and responses (HTTP headers and body) with
steganographic methods, adding random and/or specifically crafted
confusing traffic, designing confusing servers which are not what they
seem to be.

All of these methods drastically increase the stealth-ness of covert
channels.

The Gray-World "Exploitation of data streams authorized by a network
access control system for arbitrary data transfers: tunneling and covert
channels over the HTTP protocol" paper presents these concepts to
researchers and NACS administrators to explain that each time an
administrator thinks he only allows the HTTP protocol to get in and out of
his internal network, he also allows arbitrary data transfers through his
secured perimeter.

ADDITIONAL INFORMATION

The information has been provided by <mailto:alex@gray-world.net> Alex of
Gray World.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[EXPL] Another Cdrecord Format String Vulnerability Exploit Released"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]