Geodesic
Covert timing channel over HTTP cache-control headers
Prikladnaya Diskretnaya Matematika. Supplement, no. 7 (2014), pp. 89-91.

Voir la notice de l'article provenant de la source Math-Net.Ru

The problem of detecting covert channels is known for a long time, but the detection of such channels over HTTP protocol, as one of the most used protocols, is still interesting for researchers. Known examples of covert timing channels over HTTP require changing the structure of HTTP request or modifying the web server, so it is important to discover covert channel for which there is no need to do it. Some of such channels are covert timing channels based on the cache-control headers family of HTTP protocol. The purpose of the work is the development and implementation of the covert timing channels over HTTP cache-control headers Last-Modified and ETag. As a result of the work, it is found that theoretical maximum speed of the channels based on Last-Modified (via Last-Modified value, If-Modified-Since and If-Unmodified-Since headers) is 1 bit/s. That speed is reachable in practice if latency between remote hosts allows to do the request via HTTP and to get the response in 1 second. Accuracy of implementations of the channels is 99.82 % with 1 bit/s speed. Theoretical maximum speed of the channels based on ETag header (via ETag value, If-Match and If-None-Match headers) with default configuration of web server is the same as for Last-Modified covert channels. But usage of PHP language features allows to speed up channel to 1 bit per $(2L+T)$ seconds, where $L$ is a latency between remote hosts and $T$ is a time that is needed for auxiliary operations (as matching headers, storing bits, calculating sleep time etc.). These covert channels' implementations were tested on 2 bit/s speed and showed 99.55 % accuracy.
Keywords: computer security, covert timing channels, HTTP. 
@article{PDMA_2014_7_a38,
     author = {D. N. Kolegov and O. V. Broslavsky and N. E. Oleksov},
     title = {Covert timing channel over {HTTP} cache-control headers},
     journal = {Prikladnaya Diskretnaya Matematika. Supplement},
     pages = {89--91},
     publisher = {mathdoc},
     number = {7},
     year = {2014},
     language = {ru},
     url = {http://geodesic.mathdoc.fr/item/PDMA_2014_7_a38/}
}
TY  - JOUR
AU  - D. N. Kolegov
AU  - O. V. Broslavsky
AU  - N. E. Oleksov
TI  - Covert timing channel over HTTP cache-control headers
JO  - Prikladnaya Diskretnaya Matematika. Supplement
PY  - 2014
SP  - 89
EP  - 91
IS  - 7
PB  - mathdoc
UR  - http://geodesic.mathdoc.fr/item/PDMA_2014_7_a38/
LA  - ru
ID  - PDMA_2014_7_a38
ER  - 
%0 Journal Article
%A D. N. Kolegov
%A O. V. Broslavsky
%A N. E. Oleksov
%T Covert timing channel over HTTP cache-control headers
%J Prikladnaya Diskretnaya Matematika. Supplement
%D 2014
%P 89-91
%N 7
%I mathdoc
%U http://geodesic.mathdoc.fr/item/PDMA_2014_7_a38/
%G ru
%F PDMA_2014_7_a38
D. N. Kolegov; O. V. Broslavsky; N. E. Oleksov. Covert timing channel over HTTP cache-control headers. Prikladnaya Diskretnaya Matematika. Supplement, no. 7 (2014), pp. 89-91. http://geodesic.mathdoc.fr/item/PDMA_2014_7_a38/

[1] CWE-385: Covert Timing Channel, https://cwe.mitre.org/data/definitions/385.html

[2] Brown E., Yuan B., Johnson D., Lutz P., “Covert channels in the HTTP Network Protocol: Channel characterization and detecting Man-in-the-Middle Attacks”, Proc. 5th Intern. Conf. Information Warfare and Security (Ohio, USA, April 8–9, 2010), Air Force Institute of Technology, 2010, 56–65

[3] ETag header Apache specification, http://httpd.apache.org/docs/2.2/mod/core.html#fileetag