Editing Covert channel (section)

==Data hiding in TCP/IP Protocol suite by covert channels==

Focusing on the IP and TCP headers of TCP/IP Protocol suite, an article published by Craig Rowland devises proper encoding and decoding techniques by utilizing the IP identification field, the TCP initial sequence number and acknowledge sequence number fields.<ref name="rowland">[http://firstmonday.org/htbin/cgiwrap/bin/ojs/index.php/fm/article/view/528/449  ''Covert Channels in the TCP/IP Protocol Suite''] {{Webarchive|url=https://web.archive.org/web/20121023122054/http://firstmonday.org/htbin/cgiwrap/bin/ojs/index.php/fm/article/view/528/449 |date=2012-10-23 }}, 1996 Paper by Craig Rowland on covert channels in the TCP/IP protocol with proof of concept code.</ref> These techniques are implemented in a simple utility written for Linux systems running version 2.0 kernels.

Rowland provides a proof of concept as well as practical encoding and decoding techniques for exploitation of covert channels using the TCP/IP protocol suite. These techniques are analyzed considering security mechanisms like firewall network address translation.

However, the non-detectability of these covert communication techniques is questionable. For instance, a case where sequence number field of TCP header is manipulated, the encoding scheme is adopted such that every time the same alphabet is covertly communicated, it is encoded with the same sequence number.

Moreover, the usages of sequence number field as well as the acknowledgment field cannot be made specific to the ASCII coding of English language alphabet as proposed, since both fields take into account the receipt of data bytes pertaining to specific network packet(s).

After Rowland, several authors in academia published more work on covert channels in the TCP/IP protocol suite, including a plethora of countermeasures ranging from statistical approaches to machine learning.<ref>{{Cite journal|last1=Zander|first1=S.|last2=Armitage|first2=G.|last3=Branch|first3=P.|date=2007|title=A survey of covert channels and countermeasures in computer network protocols|journal=IEEE Communications Surveys and Tutorials|publisher=IEEE|volume=9|issue=3|pages=44–57|doi=10.1109/comst.2007.4317620|hdl=1959.3/40808|s2cid=15247126|issn=1553-877X|hdl-access=free}}</ref><ref>{{Cite book|title=Information hiding in communication networks : fundamentals, mechanisms, applications, and countermeasures|date=2016|publisher=Wiley|others=Mazurczyk, Wojciech., Wendzel, Steffen., Zander, Sebastian., Houmansadr, Amir., Szczypiorski, Krzysztof.|isbn=9781118861691|location=Hoboken, N.J.|oclc=940438314}}</ref><ref>{{Cite journal|last1=Wendzel|first1=Steffen|last2=Zander|first2=Sebastian|last3=Fechner|first3=Bernhard|last4=Herdin|first4=Christian|date=April 2015|title=Pattern-Based Survey and Categorization of Network Covert Channel Techniques|journal= ACM Computing Surveys|volume=47|issue=3|pages=50:1–50:26|doi=10.1145/2684195|issn=0360-0300|arxiv=1406.2901|s2cid=14654993}}</ref><ref>{{Cite journal|last1=Cabuk|first1=Serdar|last2=Brodley|first2=Carla E.|author2-link=Carla Brodley|last3=Shields|first3=Clay|date=April 2009|title=IP Covert Channel Detection|journal= ACM Transactions on Information and System Security|volume=12|issue=4|pages=22:1–22:29|doi=10.1145/1513601.1513604|issn=1094-9224|citeseerx=10.1.1.320.8776|s2cid=2462010}}</ref> The research on network covert channels overlaps with the domain of [[network steganography]], which emerged later.