[PPT] - Covert channel detection using flow-data Guido Pineda Reyes MSc. PowerPoint Presentation

SLIDE 1

Covert channel detection using flow-data

Guido Pineda Reyes

MSc. Systems and Networking Engineering

University of Amsterdam

July 3, 2014

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 1 / 46

SLIDE 2

Outline

1

Introduction

2

Research questions

3

Approach

4

Data analysis ICMP DNS HTTP

5

Algorithms

6

Implementation ICMP DNS HTTP

7

Conclusions

8

Q&A

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 2 / 46

SLIDE 3

Covert Channels

Definition

Lampson, 1973

“... A communication channel that is used for information transmission, but that is not intended for communications...”

National Computer Security Centre Maryland Meade, 1985

“Communication channel that can be exploited ... to transfer information in a manner that violates the system’s security policy”

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 3 / 46

SLIDE 4

Malicious usage

Data exfiltration Intrusion maintenance Botnet control Malware updates Gathering of sensitive information ...

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 4 / 46

SLIDE 5

Chosen techniques

ICMP tunnel ICMP reverse shell DNS tunnel HTTP reverse shell

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 5 / 46

SLIDE 6

Flow-data

Overview

Netflow is a monitoring tool Describes the method for a collector to export statistics about IP packets passing an observation point. Netflow v10 aka IPFIX (RFC 5101) Payload is not included

Flow

Packets with a set of common properties: source address and port number ingress interface destination address and port number network layer protocol type of service (TOS)

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 6 / 46

SLIDE 7

Research questions

Is it possible to detect network-based covert channel malicious activity by using flow-data?

How do the selected covert channel techniques work? What is the difference between normal traffic and covert channel traffic behaviour using the chosen techniques? What algorithms can be used to detect network-based covert channel traffic? How can this results be validated?

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 7 / 46

SLIDE 8

Approach

Data gathering

Regular traffic

Protocol Total bytes (MB) Total packets Total bidirectional flows ICMP 698.5 3445152 169 DNS 1638.6 3981600 53490 HTTP 1956.27 1818293 40107

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 8 / 46

SLIDE 9

Approach

Data gathering

Malicious traffic

Technique Total bytes (MB) Total packets Total bidirectional flows ICMP tunneling 3957.08 4491868 30 ICMP reverse shell 196.2 3481308 75 DNS tunneling 2746.7 3376230 172 HTTP reverse shell 311.39 470985 166

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 9 / 46

SLIDE 10

Approach

Experimental environment

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 10 / 46

SLIDE 11

IPFIX templates

Export template: ICMP

Field Description IPV4 SRC ADDR IPv4 source address IPV4 DST ADDR IPv4 destination address PROTOCOL IP protocol byte IN BYTES Incoming flow bytes (src ->dst) IN PKTS Incoming flow packets (src ->dst) OUT BYTES Outgoing flow bytes (dst ->src) OUT PKTS Outgoing flow packets (dst ->src) MIN TTL Min flow TTL MAX TTL Max flow TTL ICMP TYPE ICMP Type * 256 + ICMP code

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 11 / 46

SLIDE 12

IPFIX templates

Export template: DNS

Field Description IPV4 SRC ADDR IPv4 source address IPV4 DST ADDR IPv4 destination address PROTOCOL IP protocol byte IN BYTES Incoming flow bytes (src ->dst) IN PKTS Incoming flow packets (src ->dst) OUT BYTES Outgoing flow bytes (dst ->src) OUT PKTS Outgoing flow packets (dst ->src) MIN TTL Min flow TTL MAX TTL Max flow TTL DNS QUERY DNS query DNS QUERY ID DNS query transaction Id DNS QUERY TYPE DNS query type (e.g. 1=A, 2=NS..) DNS RET CODE DNS return code (e.g. 0=no error)

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 12 / 46

SLIDE 13

IPFIX templates

Export template: HTTP

Field Description IPV4 SRC ADDR IPv4 source address IPV4 DST ADDR IPv4 destination address PROTOCOL IP protocol byte IN BYTES Incoming flow bytes (src->dst) IN PKTS Incoming flow packets (src->dst) OUT BYTES Outgoing flow bytes (dst->src) OUT PKTS Outgoing flow packets (dst->src) MIN TTL Min flow TTL MAX TTL Max flow TTL TCP FLAGS Cumulative of all flow TCP flags HTTP URL HTTP URL HTTP METHOD HTTP METHOD HTTP RET CODE HTTP return code (e.g. 200, 304...)

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 13 / 46

SLIDE 14

Outline

1

Introduction

2

Research questions

3

Approach

4

Data analysis ICMP DNS HTTP

5

Algorithms

6

Implementation ICMP DNS HTTP

7

Conclusions

8

Q&A

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 14 / 46

SLIDE 15

ICMP tunnel

Packet ratio distribution

Regular ICMP ICMP tunnel

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 15 / 46

SLIDE 16

ICMP tunnel

Bytes per packet distribution

Regular ICMP ICMP tunnel

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 16 / 46

SLIDE 17

ICMP reverse shell

TTL distribution

Regular ICMP ICMP reverse shell

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 17 / 46

SLIDE 18

Outline

1

Introduction

2

Research questions

3

Approach

4

Data analysis ICMP DNS HTTP

5

Algorithms

6

Implementation ICMP DNS HTTP

7

Conclusions

8

Q&A

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 18 / 46

SLIDE 19

DNS tunnel

Packet ratio distribution

Regular DNS DNS tunnel

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 19 / 46

SLIDE 20

Regular DNS

Packet distribution per unique destination IP

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 20 / 46

SLIDE 21

DNS tunnel

Packet distribution per unique destination IP

Destination IP A Destination IP B

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 21 / 46

SLIDE 22

DNS tunnel

Packet distribution per unique destination IP

Destination IP C (Tunnel server)

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 22 / 46

SLIDE 23

Regular DNS

DNS QUERY TYPE analysis

DNS QUERY TYPE # of flows % Type 1 40395 75.5 A 2 1807 3.39 NS 6 4 0.007 SOA 12 438 0.08 PTR 16 1 0.002 TXT 28 2461 4.6 AAAA 33 18 0.03 SRV 43 723 1.35 DS 48 8083 15.03 DNSKEY

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 23 / 46

SLIDE 24

DNS tunnel

DNS QUERY TYPE analysis

DNS QUERY TYPE # of flows % 12 60 34.88 10 57 33.14 1 26 15.12 13 7.56 16 5 2.92 5 3 1.74 15 3 1.74 33 3 1.74 255 1 0.58 28 1 0.58

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 24 / 46

SLIDE 25

Outline

1

Introduction

2

Research questions

3

Approach

4

Data analysis ICMP DNS HTTP

5

Algorithms

6

Implementation ICMP DNS HTTP

7

Conclusions

8

Q&A

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 25 / 46

SLIDE 26

HTTP

TCP FLAGS analysis

Cumulative OR-ed of TCP FLAGS for all packets in one flow. For regular HTTP traffic, this value is well distributed. But, for malicious HTTP traffic, every flow has the TCP FLAGS value = 27

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 26 / 46

SLIDE 27

Regular HTTP

TCP FLAGS analysis

TCP FLAG # of flows Meaning % 24 22088 ACK+PUSH 55,0727 26 10284 ACK+PUSH+SYN 25,6414 27 5039 ACK+PUSH+SYN+FIN 12,5639 19 2223 ACK+FIN+SYN 5,5427 17 163 ACK+FIN 0,4064 31 162 ACK+PUSH+RST+SYN+FIN 0,4039 30 93 ACK+PUSH+RST+SYN 0,2319 23 38 ACK+RST+SYN+FIN 0,0947 25 15 ACK+PSH+FIN 0,0374 21 1 ACK+RST+FIN 0,0025 18 1 ACK+SYN 0,0025

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 27 / 46

SLIDE 28

HTTP

HTTP METHOD analysis per unique destination IP

Destination IP address # of Flows with method: GET POST HEAD EMPTY A 104

1722

105 B 114

1482

107 C 267 25 849 94 D

979

E 18

729

3 F 700

10

G 628

33

H

618

I

555

4 J 371 136

39

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 28 / 46

SLIDE 29

HTTP

HTTP METHOD analysis per unique destination IP

For HTTP reverse shell traffic, the amount of POST and GET methods per unique destination IP address is about 50% each.

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 29 / 46

SLIDE 30

Algorithms

Description

Using a data-set provided by the sponsoring company. HTTP traffic generated by 150 different web crawlers (64095 flows) DNS traffic (35219 flows) ICMP traffic (12352 flows)

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 30 / 46

SLIDE 31

Proposed alorithms

ICMP

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 31 / 46

SLIDE 32

Proposed alorithms

DNS

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 32 / 46

SLIDE 33

Proposed alorithms

HTTP

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 33 / 46

SLIDE 34

Outline

1

Introduction

2

Research questions

3

Approach

4

Data analysis ICMP DNS HTTP

5

Algorithms

6

Implementation ICMP DNS HTTP

7

Conclusions

8

Q&A

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 34 / 46

SLIDE 35

ICMP Tunnel

Before injection After injection

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 35 / 46

SLIDE 36

ICMP

ICMP reverse shell

Before injection After injection

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 36 / 46

SLIDE 37

Outline

1

Introduction

2

Research questions

3

Approach

4

Data analysis ICMP DNS HTTP

5

Algorithms

6

Implementation ICMP DNS HTTP

7

Conclusions

8

Q&A

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 37 / 46

SLIDE 38

DNS

DNS tunnel

Analysis on the packet distribution per unique destination IP address shows suspicious standard deviation values for specific flows. DNS QUERY TYPE field is effective to retrieve unusual values.

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 38 / 46

SLIDE 39

Outline

1

Introduction

2

Research questions

3

Approach

4

Data analysis ICMP DNS HTTP

5

Algorithms

6

Implementation ICMP DNS HTTP

7

Conclusions

8

Q&A

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 39 / 46

SLIDE 40

HTTP

HTTP reverse shell

After filtering every flow with TCP FLAGS field = 27

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 40 / 46

SLIDE 41

HTTP

HTTP reverse shell

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 41 / 46

SLIDE 42

HTTP

HTTP reverse shell

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 42 / 46

SLIDE 43

Conclusions

It is possible to detect the tested network-based covert channels by using flow data. By establishing a base line behaviour, it is possible to compare between regular and suspicious behavior. Even though, flow-data does not give an insight on the payload of a packet, is still a powerful tool for security analysis.

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 43 / 46

SLIDE 44

Future work

Implement the proposed algorithms as a script or programming language and with live flow-data Test more tools for similar behaviour patterns Test other protocols Test a bigger data-set for possible false positives Compare results with other types of malicious traffic Investigate flow-data with network-based covert timing channels

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 44 / 46

SLIDE 45

Q&A

Questions?

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 45 / 46

SLIDE 46

Appendix

Covert Channel Classification

Covert Storage Channel

Carries information inside protocol fields

Covert Timing Channel

They use time emission between packets. A time interval can be defined: if a packet is sent during the interval, this codes a one, if no packet is sent this codes a zero.

Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, 2014 46 / 46