Protocol Hopping Covert Channels (2007)

Protocol Hopping Covert Channels (PHCC) are a way to realize covert channels capable to switch between different protocols while a covert channel is established. PHCCs even can use a randomized protocol order and a mixed packet order to transfer packets what makes them hard to detect.

Papers/Theses associated with PHCC

cf. publications section to access the papers.

Steffen Wendzel: The Problem of Traffic Normalization Within a Covert Channel's Network Environment Learning Phase, SICHERHEIT 2012, Springer, 2012 (to appear).

Steffen Wendzel, Jörg Keller: Low-attention forwarding for mobile network covert channels, in Proc. 12th Conference on Communications and Multimedia Security (CMS 2011), IFIP International Federation for Information Processing, Ghent, Belgium, B. de Decker et. al. (Eds.): CMS 2011, LNCS 7025, pp. 122-133, 2011.

German: Steffen Wendzel: Protocol Hopping Covert Channels, Hakin9 03/2008.

German: Steffen Wendzel: Diplomarbeit zum Thema 'Protokollwechsel zur Realisierung von Covert Channels und Header-Strukturveränderungen zur Vermeidung von Covert Channels', Kempten University of Applied Sciences, May-2009.

Papers by other Authors

TBW

Proof of Concept Code

A sample implementation called phcct (protocol hopping covert channel tool) also known as takushi (what is japanese for taxi) was implemented. It can be found here.