gmane.comp.security.covert-channels

New Covert Channel Discussion Group

Steffen Wendzel — 2010-09-28T22:32:04

Hi list,

since I already quit my webspace and since there is some activity on 
this list, I set up a discussion group at google groups:

Announcement:
http://groups.google.de/group/covert-channel-research/browse_thread/thread/f14a72b765719961

I also updated the posting:
http://www.wendzel.de/?sub=showpost&blogid=1&postid=183

The group itself can be found here:
http://groups.google.de/group/covert-channel-research

The mail address of the new group is:
covert-channel-research-/JYPxA39Uh5TLH3MbocFFw< at >public.gmane.org

The subject prefix '[covertchan]' is the same.

Feel free to subscribe/read/post to it.

With best regards

Steffen

Port Knocker

James Lawrie — 2010-09-28T21:16:42

Hi,

I forgot I was on this list! I wrote a PortKnocking implementation in
Perl a couple of weeks back. It's basic but it works - thought you
guys might be interested in a simple script that does it:
http://jdlawrie.co.uk/scripts/PortKnocker.txt

Let me know if you have any feedback, suggestions, or want to
contribute to it (I'll move it to github if anyone does).

--
James Lawrie

(unknown)

2010-09-28T20:12:38

authorized to use 'zoggified-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org' in 'mfrom' identity (mechanism 
'ip4:209.85.128.0/17' matched)) receiver=basicbox1.server-home.net; 
identity=mfrom; envelope-from="zoggified-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org"; 
helo=mail-ey0-f179.google.com; client-ip=209.85.215.179
[209.85.215.179])
by basicbox1.server-home.net (Postfix) with ESMTP id A7CC6958070
for <covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org>; Tue, 28 Sep 2010 21:50:56 +0200 (CEST)
-0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
         d=gmail.com; s=gamma;
         h=domainkey-signature:received:received:message-id:date:from
          :user-agent:mime-version:to:subject:references:in-reply-to
          :content-type:content-transfer-encoding;
         bh=KVT/IJD2ldWI3nTVJlCNHqmCb7JyA2ZWT3QjqrJOo6A=;
b=Q8VB89A0/0Z6zRzM0o1lgKck45tw579eSnK07A/Gqiu/Bm4Pu09RLfDmrumItQCqtv
L+ehv5/xRTqgE3MDVJ8GaGvz7IJ0gXwHJxEW1r5xYAO5CDoXLysPBHM6Ka18pE+iRaUO
          EDcFpjgcBbEPuNHzwDVOIk5niqlTkrXJaiWTY=
DomainKey-Signature: a=rsa-sha1; c=nofws;
         d=gmail.com; s=gamma;
h=message-id:date:from:user-agent:mime-version:to:subject:references
          :in-reply-to:content-type:content-transfer-encoding;
b=tq0zOWdK8nRIjD2jnIPNAE6aN0t54m5UjP8o/jGZfNgI4JgGYojeJRFReegl6Waz0N
jZfQnmMvD/w+hcA5rknZIDMaWEKGh/mRoSzjbnbb0ivfPbkvEC1f2Gk8NlpEVy0Wn/Sm
          u9Rz6wcCCQU85TVkCsN7tekh8nem6o+Kv8N38=
u9sm10982219eeh.11.2010.09.28.12.50.53
         (version=SSLv3 cipher=RC4-MD5);
         Tue, 28 Sep 2010 12:50:54 -0700 (PDT)
Message-ID: <4CA2471A.5090102-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
Date: Tue, 28 Sep 2010 22:50:50 +0300
From: Zogg <zoggified-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.12) 
Gecko/20100915 Thunderbird/3.0.8
MIME-Version: 1.0
To: covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
Subject: Re: [covertchan] Covert Channel Mailinglist Shutdown
References: <4CA24467.4030208-hi6Y0CQ0nG0< at >public.gmane.org>
In-Reply-To: <4CA24467.4030208-hi6Y0CQ0nG0< at >public.gmane.org>
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
Precedence: bulk
Reply-To: covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org

Are there any other groups online working around this topic?

On 09/28/2010 10:39 PM, Steffen Wendzel wrote:

Covert Channel Mailinglist Shutdown

Steffen Wendzel — 2010-09-28T19:39:19

[2nd try, this time with a correct subject, sorry for the duplicate]

Hi < at >ll,

I currently receive lots of annoying spam for approval to this
mailinglist, and since there was no real traffic for a long time on this
mailing list, I will close it. I also quit with my ISP so I will lose
the mailing list nevertheless.

Thank you for participating.

With best regards

Steffen Wendzel

Fwd: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:

Steffen Wendzel — 2010-09-28T19:37:49

Hi < at >ll,

I currently receive lots of annoying spam for approval to this
mailinglist, and since there was no real traffic for a long time on this
mailing list, I will close it. I also quit with my ISP so I will lose
the mailing list nevertheless.

Thank you for participating.

With best regards

Steffen Wendzel

Fw: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:

Steffen Wendzel — 2010-03-19T13:32:57

Begin forwarded message:

Date: Fri, 19 Mar 2010 14:29:34 +0100 (CET)
From: owner-covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
To: covertchan-approval-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
Subject: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:     

Return-Path: <owner-covertchan-1390-wvLxzkr0EQ1kIpNHJ+hlBYwBHQbwwUxVXqFh9Ls21Oc< at >public.gmane.org>
Delivered-To: covertchan-1390-wvLxzkr0EQ1kIpNHJ+hlBYwBHQbwwUxVXqFh9Ls21Oc< at >public.gmane.org
Received-SPF: pass (gmx.net: 213.165.64.20 is authorized to use 'cdp_xe< at >gmx.net' in 'mfrom' identity (mechanism 'ip4:213.165.64.0/23' matched)) receiver=basicbox1.server-home.net; identity=mfrom; envelope-from="cdp_xe-hi6Y0CQ0nG0< at >public.gmane.org"; helo=mail.gmx.net; client-ip=213.165.64.20
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
by basicbox1.server-home.net (Postfix) with SMTP id 134EB958047
for <covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org>; Fri, 19 Mar 2010 14:29:34 +0100 (CET)
Received: (qmail invoked by alias); 19 Mar 2010 13:29:32 -0000
Received: from pD95EBFE1.dip.t-dialin.net (EHLO koschka) [217.94.191.225]
  by mail.gmx.net (mp006) with SMTP; 19 Mar 2010 14:29:32 +0100
X-Authenticated: #10360708
X-Provags-ID: V01U2FsdGVkX18jeuJtSw4j2vQszKNu2TCpPnVnPGTDy3jYFMRxXO
L8CaunjtXYym70
Date: Fri, 19 Mar 2010 14:29:30 +0100
From: Steffen Wendzel <cdp_xe-hi6Y0CQ0nG0< at >public.gmane.org>
To: covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
Subject: Covert Channel Speech, Sa, March 27, 2010.
Message-Id: <20100319142930.0dc83d37.cdp_xe-hi6Y0CQ0nG0< at >public.gmane.org>
X-Mailer: Sylpheed 2.7.1 (GTK+ 2.18.3; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
X-FuHaFi: 0.59999999999999998

Hi cc list,

I will give a talk on covert channels (in german) at

Linux Informationstag, Augsburg (http://www.luga.de/Aktionen/LIT-2010/)

Topic: Einführung in verdeckte Kanäle (Covert Channels)
Date: March 27, 2010
Time: 16:00–16:45 Uhr (Raum I401)
Abstract: Verdeckte Kanäle (Covert Channels) sind eine Form der Steganografie. Ein verdeckter Kanal dient dazu, geheime Daten innerhalb von nicht geheimen Daten zu verstecken. Dieser Vortrag gibt eine Einführung in das Thema mit Ausblick auf einige fortgeschrittene Themen. Der Schwerpunkt liegt dabei darin, dem Zuhörer zu vermitteln, wie er selbst praktischen Nutzen aus verdeckten Kanälen ziehen kann.

More information: http://www.luga.de/Aktionen/LIT-2010/Programm

With best regards
St. Wendzel

Article "Protocol Channels" from Hakin9 Magazine

Steffen Wendzel — 2009-12-19T18:24:09

Hi list members,

I just want to inform you that I uploaded the PDF file of my latest article
"Protocol Channels" from Hakin9 6/09. Protocol channels are a kind of covert
channels and very difficult to detect. You can find the paper here:
  => http://www.wendzel.de/?sub=showpost&blogid=3&postid=257

A full and detailed description of protocol channels is available in my
diploma thesis (but in german only). You can find all papers here:
  => http://www.wendzel.de/?sub=publ

Feedback is always welcome!

With best regards

Steffen Wendzel

Speech on Covert Channels

Steffen Wendzel — 2009-08-31T08:24:57

[since the last msg included garbage, here is a 2nd try ;)]

Hi covert channel list,

I just want to inform you that I will hold a speech about protocol
channels and protocol hopping covert channels on Sun, Sep. 06, 2009 in
Darmstadt, Germany at MRMCD0x8:

http://mrmcd0x8.metarheinmain.de/fahrplan/events/3344.de.html

with best regards

Steffen