Stealthy Data Exfiltration via TCP Sequence Numbers based Covert Channel

Abstract

Ex-filtration of confidential data from a compromised network node become increasingly difficult given modern day defenses, such as deep packet inspection filters, next generation firewalls, anomaly based behavioral intrusion detection systems, and data loss/leak prevention systems. There are various proposed methods in the literature to establish covert channels for stealthy data extraction, however most of them cause anomalies in the network traffic and could be flagged by the state-of-the art defensive network technologies. In this paper, we describe a novel approach, along with a proof-of-concept implementation, for creating a covert channel that fits well within the bounds of RFC-793, utilizing Transmission Control Protocol (TCP) Sequence Numbers. This method encodes the data to be ex-filtrated within TCP sequence numbers, and adds random bytes as payload to each packet to keep the communication compatible with TCP. By designing the proposed data ex-filtration channel to function within RFC standards, we aimed to increase our ability to blend into the regular network traffic and hide from network monitoring tools. We tested our method against an open source intrusion detection system, Snort, and was able to evade detection.