Cross-Router Covert Channels

Authors: 

Adar Ovadia, Rom Ogen, Yakov Mallah, Niv Gilboa, and Yossi Oren, Ben-Gurion University of the Negev

Abstract: 

Many organizations protect secure networked devices from non-secure networked devices by assigning each class of devices to a different logical network. These two logical networks, commonly called the host network and the guest network, use the same router hardware, which is designed to isolate the two networks in software.

In this work we show that logical network isolation based on host and guest networks can be overcome by the use of cross-router covert channels. Using specially-crafted network traffic, these channels make it possible to leak data between the host network and the guest network, and vice versa, through the use of the router as a shared medium. We performed a survey of routers representing multiple vendors and price points, and discovered that all of the routers we surveyed are vulnerable to at least one class of covert channel. Our attack can succeed even if the attacker has very limited permissions on the infected device, and even an iframe hosting malicious JavaScript code can be used for this purpose. We provide several metrics for the effectiveness of such channels, based on their pervasiveness, rate and covertness, and discuss possible ways of identifying and preventing these leakages.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {238584,
author = {Adar Ovadia and Rom Ogen and Yakov Mallah and Niv Gilboa and Yossi Oren},
title = {Cross-Router Covert Channels},
booktitle = {13th {USENIX} Workshop on Offensive Technologies ({WOOT} 19)},
year = {2019},
address = {Santa Clara, CA},
url = {https://www.usenix.org/conference/woot19/presentation/ovadia},
publisher = {{USENIX} Association},
month = aug,
}