research-article

Constructing timing-based covert channels in mobile networks by adjusting CPU frequency

Authors:

Mengchao Yue,

William H. Robinson,

Lanier Watkins,

Cherita CorbettAuthors Info & Claims

HASP '14: Proceedings of the Third Workshop on Hardware and Architectural Support for Security and Privacy

Article No.: 2, Pages 1 - 8

https://doi.org/10.1145/2611765.2611768

Published: 15 June 2014 Publication History

Get Access

Abstract

We have identified a novel wireless covert timing channel (WCTC) that could be used by malware to exfiltrate data from mobile devices. We introduce the WCTC by demonstrating its ability to transmit data covertly: (1) across existing network services, (2) across ICMP pings, and (3) via a trojanized chat application. The WCTC is implemented by manipulating the Android operating system's CPU on the client end to modulate network traffic emitted from the mobile device by purposely adjusting the CPU's speed to send a binary 1 or 0. The data is recovered and deciphered on the receiving end by applying a simple threshold to the average inter-packet spacing of a fixed number of packets within a bit stream sent by the client. To our knowledge, there only exists intrusive methods to defeat this type of channel. We characterize this potential threat by determining: (1) its channel capacity, (2) the accuracy of its data transmission, (3) the effects of network hops on its accuracy, and (4) the minimum mobile device signal strength required to maintain 90% or better message recovery.

References

[1]

H. Ritzdorf, "Analyzing Covert Channels on Mobile Devices", Master's Thesis, Swiss Federal Institute of Technology Zurich, April 2012.

Google Scholar

[2]

International Business Times Website Accessed January 2014: http://www.ibtimes.com/android-market-share-nears-52-percent-apple-iphone-still-most-popular-device-us-723349

Google Scholar

[3]

G. Smith, "Google's Android Most Popular Target For Mobile Malware: Report", http://www.huffingtonpost.com/2011/08/23/android-mobile-malware-target-_n_934088.html, August 2011.

Google Scholar

[4]

L. Watkins, C. Corbett, B. Salazar, K. Fairbanks, and W. H. Robinson, "Using network traffic to remotely identify the type of applications executing on mobile devices," in Mobile Security Technologies (MoST) 2013, San Francisco, CA, USA, 2013.

Google Scholar

[5]

Texas Instruments Embedded Processors Wiki Website, Accessed March 2014: http://processors.wiki.ti.com/index.php/TI-Android-GingerBread-2.3.4-DevKit-2.1_PortingGuides

Google Scholar

[6]

X. Luo, E. W. Chan, and R. K. Chang, "TCP covert timing channels: Design and detection," in IEEE International Conference on Dependable Systems and Networks With FTCS and DCC (DSN 2008), 2008, pp. 420--429.

Google Scholar

[7]

S. H. Sellke, C.-C. Wang, S. Bagchi, and N. Shroff, "TCP/IP timing channels: Theory to implementation," in IEEE INFOCOM, 2009, pp. 2204--2212.

Google Scholar

[8]

W. Gasior and L. Yang, "Exploring covert channel in Android platform," in 2012 International Conference on Cyber Security (CyberSecurity), 2012, pp. 173--177.

Digital Library

Google Scholar

[9]

J.-M. Cioranesco, H. Ferradi, and D. Naccache, "Communicating covertly through CPU monitoring," IEEE Security & Privacy, vol. 11, pp. 71--73, 2013.

Digital Library

Google Scholar

[10]

S. Zander, G. J. Armitage, and P. Branch, "A survey of covert channels and countermeasures in computer network protocols," IEEE Communications Surveys and Tutorials, vol. 9, pp. 44--57, 2007

Digital Library

Google Scholar

[11]

V. Berk, A. Giani, and G. Cybenko, "Detection of Covert Channel Encoding in Network Packet Delays", Technical Report TR536, Revision 1, Dartmouth College, 2005.

Google Scholar

[12]

S. Radhakrishnan, U. Selcuk, and R. Beyah, "Realizing an 802.11-based Covert Timing Channel using Off-The-Shelf Wireless Cards," In IEEE Global Communications (GLOBECOM) Conference, Atlanta, GA, December 2013.

Google Scholar

[13]

S. Z. Goher, B. Javed, and N. A. Saqib, "Covert channel detection: A survey based analysis," in 9th International Conference on High Capacity Optical Networks and Enabling Technologies (HONET), 2012, pp. 057--065.

Google Scholar

[14]

R. M. Stillman, "Detecting IP covert timing channels by correlating packet timing with memory content," in IEEE Southeastcon, 2008, pp. 204--209.

Google Scholar

Cited By

View all

Pandya KBorisaniya BBuddhadev B(2022)ShoutIMEI: Ultrasound Covert Channel-Based Attack in AndroidSecurity, Privacy and Data Analytics10.1007/978-981-16-9089-1_24(293-301)Online publication date: 8-Apr-2022
https://doi.org/10.1007/978-981-16-9089-1_24
Liang CBaker TLi YNawaz RTan Y(2021)Building Covert Timing Channel of the IoT-Enabled MTS Based on Multi-Stage VerificationIEEE Transactions on Intelligent Transportation Systems10.1109/TITS.2021.3118853(1-18)Online publication date: 2021
https://doi.org/10.1109/TITS.2021.3118853
Miedl PHe XMeyer MBartolini DThiele L(2018)Frequency Scaling As a Security Threat on Multicore SystemsIEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems10.1109/TCAD.2018.285703837:11(2497-2508)Online publication date: Nov-2018
https://doi.org/10.1109/TCAD.2018.2857038
Show More Cited By

Index Terms

Constructing timing-based covert channels in mobile networks by adjusting CPU frequency
1. Software and its engineering
  1. Software notations and tools
    1. General programming languages
      1. Language features

Recommendations

Out-of-Band Covert Channels—A Survey

A novel class of covert channel, out-of-band covert channels, is presented by extending Simmons’ prisoners’ problem. This new class of covert channel is established by surveying the existing covert channel, device-pairing, and side-channel research. ...
Detecting covert timing channels: an entropy-based approach
CCS '07: Proceedings of the 14th ACM conference on Computer and communications security

The detection of covert timing channels is of increasing interest in light of recent practice on the exploitation of covert timing channels over the Internet. However, due to the high variation in legitimate network traffic, detecting covert timing ...
Constructing and characterizing covert channels on GPGPUs
MICRO-50 '17: Proceedings of the 50th Annual IEEE/ACM International Symposium on Microarchitecture

General Purpose Graphics Processing Units (GPGPUs) are present in most modern computing platforms. They are also increasingly integrated as a computational resource on clusters, data centers, and cloud infrastructure, making them possible targets for ...

Comments

Information & Contributors

Information

Published In

HASP '14: Proceedings of the Third Workshop on Hardware and Architectural Support for Security and Privacy

June 2014

89 pages

ISBN:9781450327770

DOI:10.1145/2611765

Conference Chairs:
Ruby Lee
Princeton University
,
Weidong Shi
University of Houston

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 15 June 2014

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

HASP '14

Sponsor:

SIGARCH

HASP '14: The Third Workshop on Hardware and Architectural Support for Security and Privacy

June 15, 2014

Minnesota, Minneapolis, USA

Acceptance Rates

Overall Acceptance Rate 9 of 13 submissions, 69%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

11
Total Citations
View Citations
242
Total Downloads

Downloads (Last 12 months)11
Downloads (Last 6 weeks)0

Reflects downloads up to 26 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

View all

Pandya KBorisaniya BBuddhadev B(2022)ShoutIMEI: Ultrasound Covert Channel-Based Attack in AndroidSecurity, Privacy and Data Analytics10.1007/978-981-16-9089-1_24(293-301)Online publication date: 8-Apr-2022
https://doi.org/10.1007/978-981-16-9089-1_24
Liang CBaker TLi YNawaz RTan Y(2021)Building Covert Timing Channel of the IoT-Enabled MTS Based on Multi-Stage VerificationIEEE Transactions on Intelligent Transportation Systems10.1109/TITS.2021.3118853(1-18)Online publication date: 2021
https://doi.org/10.1109/TITS.2021.3118853
Miedl PHe XMeyer MBartolini DThiele L(2018)Frequency Scaling As a Security Threat on Multicore SystemsIEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems10.1109/TCAD.2018.285703837:11(2497-2508)Online publication date: Nov-2018
https://doi.org/10.1109/TCAD.2018.2857038
Block KNarain SNoubir GNoubir GConti MKasera S(2017)An autonomic and permissionless Android covert channelProceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks10.1145/3098243.3098250(184-194)Online publication date: 18-Jul-2017
https://dl.acm.org/doi/10.1145/3098243.3098250
Biswas AGhosal DNagaraja S(2017)A Survey of Timing Channels and CountermeasuresACM Computing Surveys10.1145/302387250:1(1-39)Online publication date: 10-Mar-2017
https://dl.acm.org/doi/10.1145/3023872
Mead FZielinski JWatkins LRobinson W(2017)A mobile two-way wireless covert timing channel suitable for peer-to-peer malware2017 IEEE 28th Annual International Symposium on Personal, Indoor, and Mobile Radio Communications (PIMRC)10.1109/PIMRC.2017.8292638(1-6)Online publication date: Oct-2017
https://doi.org/10.1109/PIMRC.2017.8292638
Blasco JChen T(2017)Automated generation of colluding apps for experimental researchJournal of Computer Virology and Hacking Techniques10.1007/s11416-017-0296-414:2(127-138)Online publication date: 6-Apr-2017
https://doi.org/10.1007/s11416-017-0296-4
Qiang WXin SJin HSun G(2017)DroidAuditor: A framework for auditing covert communication on AndroidConcurrency and Computation: Practice and Experience10.1002/cpe.420529:19Online publication date: 28-Jul-2017
https://doi.org/10.1002/cpe.4205
Qiang WXin SJin HLv XZhang Q(2016)Auditing Covert Communication between Applications on Android2016 15th International Symposium on Parallel and Distributed Computing (ISPDC)10.1109/ISPDC.2016.44(257-260)Online publication date: 2016
https://doi.org/10.1109/ISPDC.2016.44
Luo LFu YWu DZhu SLiu P(2016)Repackage-Proofing Android Apps2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)10.1109/DSN.2016.56(550-561)Online publication date: Jun-2016
https://doi.org/10.1109/DSN.2016.56
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Abstract

References

Cited By

Index Terms

Recommendations

Out-of-Band Covert Channels—A Survey

Detecting covert timing channels: an entropy-based approach

Constructing and characterizing covert channels on GPGPUs

Comments

Information

Published In

Sponsors

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Acceptance Rates

Contributors

Other Metrics

Bibliometrics

Article Metrics

Other Metrics

Citations

Cited By

Login options

Full Access

View options

PDF

eReader

Share

Share this Publication link

Share on social media

Affiliations