Covert Channel Based on NDIS Intermediate Driver
Danwei Chen · Jisuanji gongcheng · 2009
This paper builds up a covert channel under Windows network protocol stack based on Network Driver Interface Specification(NDIS) Intermediate Driver(IMD) technology.Application program can communicate with outward by this channel whose position is lower than control of firewall,and it can read and write data directly from NIC.It analyzes the reason the firewall may be bypassed,which is caused by lack of protection for the network,and discusses how to prevent this kind of attacks.