A mobile two-way wireless covert timing channel suitable for peer-to-peer malware
Forest C. Mead, Jeffrey M. Zielinski, Lanier A. Watkins, William H. Robinson · 2017
A wireless covert timing channel (WCTC) is an established method of concealing information within a wireless medium for the purpose of covert communications. The pervasive use of mobile devices motivates our exploration into the potential of a two-way WCTC suitable for peer-to-peer (P2P) malware, in order to raise early awareness to the threat. In this work, we demonstrate the efficacy of a two-way WCTC over local networks, the public Internet, and cellular networks. Such network scalability in a mobile-to-mobile WCTC would make the notoriously hard-to-defeat P2P command-and-control (C&C) structure a viable option for currently prevalent families of mobile banking and ransomware Trojans. Specifically, we developed an Android application with the capability to communicate with other instances of the application over local networks, the Internet, and mobile networks via a WCTC. We demonstrate the feasibility of this application through experiments that test its accuracy, speed, and overall effectiveness. The main concern is that our endpoint applications could easily be replaced with malware and P2P C&Cs. The likely result is that very-difficult-to-detect malicious network traffic would emerge, especially since popular intrusion detection systems, like Snort and FireEye, have no inherent mechanisms to detect WCTCs.