PHY covert channels: can you see the idles?
Ki Suh Lee, Han Wang, Hakim Weatherspoon · 2014
Network covert timing channels embed secret messages in legitimate packets by modulating interpacket delays. Unfortunately, such channels are normally implemented in higher network layers (layer 3 or above) and easily detected or prevented. However, access to the physi-cal layer of a network stack allows for timing channels that are virtually invisible: Sub-microsecond modula-tions that are undetectable by software endhosts. There-fore, covert timing channels implemented in the physi-cal layer can be a serious threat to the security of a sys-tem or a network. In fact, we empirically demonstrate an effective covert timing channel over nine routing hops and thousands of miles over the Internet (the National Lambda Rail). Our covert timing channel works with cross traffic, less than 10 % bit error rate, which can be masked by forward error correction, and a covert rate of 81 kilobits per second. Key to our approach is access and control over every bit in the physical layer of a 10 Gigabit network stack (a bit is 100 picoseconds wide at 10 gigabit per seconds), which allows us to modulate and interpret interpacket spacings at sub-microsecond scale. We discuss when and how a timing channel in the phys-ical layer works, how hard it is to detect such a channel, and what is required to do so. 1