gmane.comp.security.covert-channels

Re: New Covert Channel Discussion Group

Steffen Wendzel — 2010-09-29T06:37:20

Ah, correct, thanks. I also changed the URL s/de/com/ on the website.

Steffen

Am 29.09.2010 03:57, schrieb Hal Wigoda:

Re: New Covert Channel Discussion Group

Hal Wigoda — 2010-09-29T01:57:50

Thanks.

Done.

Joined.

On Sep 28, 2010, at 8:13 PM, James Lawrie wrote:

Re: New Covert Channel Discussion Group

James Lawrie — 2010-09-29T01:13:27

http://groups.google.com/group/covert-channel-research

Re: New Covert Channel Discussion Group

Hal Wigoda — 2010-09-29T01:01:43

It is in German, is there a translation available?

On Sep 28, 2010, at 5:32 PM, Steffen Wendzel wrote:

New Covert Channel Discussion Group

Steffen Wendzel — 2010-09-28T22:32:04

Hi list,

since I already quit my webspace and since there is some activity on 
this list, I set up a discussion group at google groups:

Announcement:
http://groups.google.de/group/covert-channel-research/browse_thread/thread/f14a72b765719961

I also updated the posting:
http://www.wendzel.de/?sub=showpost&blogid=1&postid=183

The group itself can be found here:
http://groups.google.de/group/covert-channel-research

The mail address of the new group is:
covert-channel-research-/JYPxA39Uh5TLH3MbocFFw< at >public.gmane.org

The subject prefix '[covertchan]' is the same.

Feel free to subscribe/read/post to it.

With best regards

Steffen

Re: Port Knocker

Steffen Wendzel — 2010-09-28T22:00:20

I'm pretty surprised that there really is activity on this list :)
I think I will find a solution to keep something up and running for the 
list members since it would be too bad to destroy an active list that 
seems to be the only list on this topic.

I will announce a solution ASAP (maybe tomorrow).

good night
-Steffen

Am 28.09.2010 23:34, schrieb Darren Thurston:

Re: Port Knocker

Darren Thurston — 2010-09-28T21:34:24

James thanks for this PortKnocking script. 

and with luck, maybe someone else will pick up, revive this list and move it. 

Thanks for your work on the list in the past Steffen.


cheers,
Darren


On 2010-09-28, at 2:16 PM, James Lawrie wrote:


__________________________________________________________________________
Darren Thurston - darren.t.thurston-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org

PGP Key ID: 0x6E43BED7
Fingerprint: A596 0ED5 CD20 A620 0038 A917 CEC4 E5BB 6E43 BED7

Port Knocker

James Lawrie — 2010-09-28T21:16:42

Hi,

I forgot I was on this list! I wrote a PortKnocking implementation in
Perl a couple of weeks back. It's basic but it works - thought you
guys might be interested in a simple script that does it:
http://jdlawrie.co.uk/scripts/PortKnocker.txt

Let me know if you have any feedback, suggestions, or want to
contribute to it (I'll move it to github if anyone does).

--
James Lawrie

Re: Re:

Zogg — 2010-09-28T20:38:02


On 09/28/2010 11:17 PM, Steffen Wendzel wrote:
To be honest... I actually forgot I had membership in this group. :( 
Random posts could have received attention.
Theory and implementation possess entangled relationship. ;) I mean - I 
seek the knowledge of two worlds! Damn, getting all poetic this eve...
Thats the only one i know too.
Will look into it. Thank you!
I recall writing PoC bluetooth covert chan as a task for my security 
class. The subject intrigued me, tho never found enough time to delve 
deeper. If you could point to bleeding edge research papers in this 
field, i would really appreciate it. :)

~ Z

Re:

Steffen Wendzel — 2010-09-28T20:17:54

Damn, I forgot how to approve messages :-) I just removed the approval 
thing in the config ... Let's hope to receive not too many spam within 
the last few days this list exists. However:

Are you looking for research groups or hacker groups?

Hacker Groups: http://gray-world.net/ (seem to be inactive)
Research Groups: different. try google scholar.

I am also still doing research in this area for my Ph.D. but I'm 
currently in no real CC research group.

-Steffen

(unknown)

2010-09-28T20:12:38

authorized to use 'zoggified-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org' in 'mfrom' identity (mechanism 
'ip4:209.85.128.0/17' matched)) receiver=basicbox1.server-home.net; 
identity=mfrom; envelope-from="zoggified-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org"; 
helo=mail-ey0-f179.google.com; client-ip=209.85.215.179
[209.85.215.179])
by basicbox1.server-home.net (Postfix) with ESMTP id A7CC6958070
for <covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org>; Tue, 28 Sep 2010 21:50:56 +0200 (CEST)
-0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
         d=gmail.com; s=gamma;
         h=domainkey-signature:received:received:message-id:date:from
          :user-agent:mime-version:to:subject:references:in-reply-to
          :content-type:content-transfer-encoding;
         bh=KVT/IJD2ldWI3nTVJlCNHqmCb7JyA2ZWT3QjqrJOo6A=;
b=Q8VB89A0/0Z6zRzM0o1lgKck45tw579eSnK07A/Gqiu/Bm4Pu09RLfDmrumItQCqtv
L+ehv5/xRTqgE3MDVJ8GaGvz7IJ0gXwHJxEW1r5xYAO5CDoXLysPBHM6Ka18pE+iRaUO
          EDcFpjgcBbEPuNHzwDVOIk5niql

Covert Channel Mailinglist Shutdown

Steffen Wendzel — 2010-09-28T19:39:19

[2nd try, this time with a correct subject, sorry for the duplicate]

Hi < at >ll,

I currently receive lots of annoying spam for approval to this
mailinglist, and since there was no real traffic for a long time on this
mailing list, I will close it. I also quit with my ISP so I will lose
the mailing list nevertheless.

Thank you for participating.

With best regards

Steffen Wendzel

Fwd: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:

Steffen Wendzel — 2010-09-28T19:37:49

Hi < at >ll,

I currently receive lots of annoying spam for approval to this
mailinglist, and since there was no real traffic for a long time on this
mailing list, I will close it. I also quit with my ISP so I will lose
the mailing list nevertheless.

Thank you for participating.

With best regards

Steffen Wendzel

Fw: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:

Steffen Wendzel — 2010-03-19T13:32:57

Begin forwarded message:

Date: Fri, 19 Mar 2010 14:29:34 +0100 (CET)
From: owner-covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
To: covertchan-approval-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
Subject: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:     


Return-Path: <owner-covertchan-1390-wvLxzkr0EQ1kIpNHJ+hlBYwBHQbwwUxVXqFh9Ls21Oc< at >public.gmane.org>
Delivered-To: covertchan-1390-wvLxzkr0EQ1kIpNHJ+hlBYwBHQbwwUxVXqFh9Ls21Oc< at >public.gmane.org
Received-SPF: pass (gmx.net: 213.165.64.20 is authorized to use 'cdp_xe< at >gmx.net' in 'mfrom' identity (mechanism 'ip4:213.165.64.0/23' matched)) receiver=basicbox1.server-home.net; identity=mfrom; envelope-from="cdp_xe-hi6Y0CQ0nG0< at >public.gmane.org"; helo=mail.gmx.net; client-ip=213.165.64.20
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
by basicbox1.server-home.net (Postfix) with SMTP id 134EB958047
for <covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org>; Fri, 19 Mar 2010 14:29:34 +0

Article "Protocol Channels" from Hakin9 Magazine

Steffen Wendzel — 2009-12-19T18:24:09

Hi list members,

I just want to inform you that I uploaded the PDF file of my latest article
"Protocol Channels" from Hakin9 6/09. Protocol channels are a kind of covert
channels and very difficult to detect. You can find the paper here:
  => http://www.wendzel.de/?sub=showpost&blogid=3&postid=257

A full and detailed description of protocol channels is available in my
diploma thesis (but in german only). You can find all papers here:
  => http://www.wendzel.de/?sub=publ

Feedback is always welcome!

With best regards

Steffen Wendzel

Speech on Covert Channels

Steffen Wendzel — 2009-08-31T08:24:57

[since the last msg included garbage, here is a 2nd try ;)]

Hi covert channel list,

I just want to inform you that I will hold a speech about protocol
channels and protocol hopping covert channels on Sun, Sep. 06, 2009 in
Darmstadt, Germany at MRMCD0x8:

http://mrmcd0x8.metarheinmain.de/fahrplan/events/3344.de.html

with best regards

Steffen