Constructing timing-based covert channels in mobile networks by adjusting CPU frequency
Mengchao Yue, William H. Robinson, Lanier A. Watkins, Cherita Corbett · 2014
We have identified a novel wireless covert timing channel (WCTC) that could be used by malware to exfiltrate data from mobile devices. We introduce the WCTC by demonstrating its ability to transmit data covertly: (1) across existing network services, (2) across ICMP pings, and (3) via a trojanized chat application. The WCTC is implemented by manipulating the Android operating system's CPU on the client end to modulate network traffic emitted from the mobile device by purposely adjusting the CPU's speed to send a binary 1 or 0. The data is recovered and deciphered on the receiving end by applying a simple threshold to the average inter-packet spacing of a fixed number of packets within a bit stream sent by the client. To our knowledge, there only exists intrusive methods to defeat this type of channel. We characterize this potential threat by determining: (1) its channel capacity, (2) the accuracy of its data transmission, (3) the effects of network hops on its accuracy, and (4) the minimum mobile device signal strength required to maintain 90% or better message recovery.