Covert channel for local area network

• Published in: 2010 IEEE International Conference on Wireless Communications, Networking and Information Security pp. 316 - 319
• Main Authors: Liping Ji, Yu Fan, Chuan Ma
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-06-2010
• Subjects: ARP broadcasting packet; Broadcasting; Computer vision; Delay; Hidden communication; LAN covert channels; Local area networks; Protocols; Software safety; TCPIP; Telecommunication traffic; Timing; Undetectability; Wide area networks
• ISBN: 1424458501; 9781424458509
• DOI: 10.1109/WCINS.2010.5541791

There exist many TCP/IP covert channels in WAN for network hidden communication in last decades. However, there are few covert channels designed for the LAN while existing WAN covert channels could not be adapted for the LAN applications. In this paper we proposed a novel covert channel based on ARP broadcasting packets for LAN. In our method we employed the normal ARP request packets as the carrier which could escape feature-based detections. In addition, our method would not lead to abnormal network traffic. Experimental results show that our covert channel has great resistance to not only the feature-based detections but also the network traffic detections.