Hi Joff, You'll probably need some algortihtms to test for randmoness; these might be helpful: http://csrc.nist.gov/rng/
But then you must be aware of 2 problems: a) Statistical tests like these tests work on the whole sequence. With mixed sequences (e.g. an encapsulated random payload within a non-random structure) you'll still need some algorithm to try to identify the boundaries of the candidate bit string to test. b) Randomness tests usually need a few bits to be accurate (e.g. ~100 bits for the frequency and runs tests), some need thousands of bits. Therefore with fragmented sequences it might be nearly impossible to detect. c) No test is accurate enough on its own, although Maurer's Universal statistical test claims to be (it needs about 388,000 bits to be reliable under its own terms anyway), so you might need to apply a batch of tests to have enough confidence that a certain bitstring is indeed random. d) Compressed sequences, although not exactly random, might look very similar to an encrypted sequence (from a randomness test point of view). With standard statistical tests it is very difficult to tell; it is hard but it can be done. e) There is no way (that I know of) to distinguish between totally random sequences and sequences encrypted with a good encryption algorithm (such as AES), and that's the point of good encryption anyway ;-). So if you get totally random sequences as decoys you should be aware of the risks of denial of service, because running this kind of detection on real-time traffic flows will certainly consume some CPU cycles. Other than that, it is certainly an interesting project, but I wonder if there aren't more effective ways to detect information leaks than just identifying pseudorandom strings on the network and then assuming that those might be related to confidential information. Cheers, Omar Herrera > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Joff Thyer > > It is reasonably trivial to encode data within packet headers, and > even encrypt said data as most are probably aware. There are past > examples where control information has been sent within ICMP and other > packets using header fields. > > My question surrounds detection; given that IDS tends to be payload > focused, if a covert channel exists that has encrypted data in a > packet header, how do we go about detecting it? > > My initial thought leans toward the fact that encrypted data blocks > are statistically flat over time. Given say 'snort', how can we use > this idea? I am not a snort expert by any means, so please no > flames! > > I would be happy to summarize opinions. > > -Joff Thyer ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
