In this lesson,
we're going to talk about different types
of covert channels that you might encounter
doing a penetration test.
Covert channels are methods used
to transfer information in ways
that aren't easily detected.
Now we'll explore four types: steganography,
DNS, ICMP, and HTTPS.
We'll also give a demonstration of each
of these covert channels later in this section.
So in this lesson, we're just going
to get familiar with the concept.
Each of these methods can be leveraged
to bypass standard security measures,
so understanding them is crucial.
First up is steganography.
Steganography is the art of hiding information
within other non-secret data.
The classic example is embedding
a hidden message inside of a image file.
Let's say you have a regular JPEG image.
With this method, you can alter
the least significant bits of the image pixels value
to encode the information you want to hide.
These changes are so tiny that the human eye
can't detect any difference in the image.
For instance, you might hide a text document
within a photo without changing the appearance of the photo.
This technique isn't limited to images.
It can also be applied to audio files, video files,
and even network packets.
Another practical example of this
could be hiding command and control instructions
inside of image files that are shared on social media,
making the communication channel difficult to spot.
Next, let's discuss DNS covert channels.
DNS is used to translate human readable domain names
into IP addresses.
However, it can be exploited for covert communication.
An attacker can encode data within DNS queries in responses.
For example, let's say you want
to exfiltrate sensitive data from a compromised system.
You can break the data into small chunks
and encode it into sub-domain names of DNS queries.
When these DNS queries are made,
they will appear as regular traffic,
but the sub-domain parts contain your data.
A DNS server controlled by an attacker
can capture these queries,
extract the hidden information,
and respond with innocuous looking DNS responses.
Because DNS traffic is typically allowed
through firewalls and monitored less intensely,
it serves as a good channel for covert communication.
Now let's move on to ICMP, which stands
for Internet Control Message Protocol.
ICMP is primarily used
for testing network device communication,
such as with the well-known ping command,
which checks the reachability of a host.
Attackers can use ICMP for covert communication
by hiding data inside ICMP packets.
For instance, the payload of ICMP Eco Request
in Eco Reply messages can be manipulated
to carry hidden data.
This method can be very difficult to detect
because ICMP traffic is often seen as harmless
and necessary for network operations,
and therefore less likely
to be scrutinized by the security system.
Finally, let's examine HTTPS covert channels.
HTTPS is used for secure communications
over a computer network, especially over internet.
Its job is to ensure the integrity,
confidentiality of data between the user's computer
and the site they are visiting by encrypting the traffic.
Covert channels using HTTPS exploit this encryption
to hide data within web traffic.
For instance, an attacker could embed malicious commands
or exfiltrate data within the payload of the HTTPS traffic.
Since HTTPS traffic is encrypted,
it's challenging for security tools like firewalls
to inspect the contents without breaking the encryption,
which is typically not feasible
due to privacy and performance concerns.
So remember, understanding these covert channels
is useful in pen testing because they can be used
to bypass standard security measures,
and we can use them to exfiltrate data out of the network.
By knowing how they work,
you can give better recommendations
to the client in how best to detect and defend
against them during normal operations.