gmane.comp.security.covert-channels

New Covert Channel Discussion Group

Steffen Wendzel — 2010-09-28T22:32:04

Hi list,

since I already quit my webspace and since there is some activity on 
this list, I set up a discussion group at google groups:

Announcement:
http://groups.google.de/group/covert-channel-research/browse_thread/thread/f14a72b765719961

I also updated the posting:
http://www.wendzel.de/?sub=showpost&blogid=1&postid=183

The group itself can be found here:
http://groups.google.de/group/covert-channel-research

The mail address of the new group is:
covert-channel-research-/JYPxA39Uh5TLH3MbocFFw< at >public.gmane.org

The subject prefix '[covertchan]' is the same.

Feel free to subscribe/read/post to it.

With best regards

Steffen

Port Knocker

James Lawrie — 2010-09-28T21:16:42

Hi,

I forgot I was on this list! I wrote a PortKnocking implementation in
Perl a couple of weeks back. It's basic but it works - thought you
guys might be interested in a simple script that does it:
http://jdlawrie.co.uk/scripts/PortKnocker.txt

Let me know if you have any feedback, suggestions, or want to
contribute to it (I'll move it to github if anyone does).

--
James Lawrie

(unknown)

2010-09-28T20:12:38

authorized to use 'zoggified-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org' in 'mfrom' identity (mechanism 
'ip4:209.85.128.0/17' matched)) receiver=basicbox1.server-home.net; 
identity=mfrom; envelope-from="zoggified-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org"; 
helo=mail-ey0-f179.google.com; client-ip=209.85.215.179
[209.85.215.179])
by basicbox1.server-home.net (Postfix) with ESMTP id A7CC6958070
for <covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org>; Tue, 28 Sep 2010 21:50:56 +0200 (CEST)
-0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
         d=gmail.com; s=gamma;
         h=domainkey-signature:received:received:message-id:date:from
          :user-agent:mime-version:to:subject:references:in-reply-to
          :content-type:content-transfer-encoding;
         bh=KVT/IJD2ldWI3nTVJlCNHqmCb7JyA2ZWT3QjqrJOo6A=;
b=Q8VB89A0/0Z6zRzM0o1lgKck45tw579eSnK07A/Gqiu/Bm4Pu09RLfDmrumItQCqtv
L+ehv5/xRTqgE3MDVJ8GaGvz7IJ0gXwHJxEW1r5xYAO5CDoXLysPBHM6Ka18pE+iRaUO
          EDcFpjgcBbEPuNHzwDVOIk5niql

Covert Channel Mailinglist Shutdown

Steffen Wendzel — 2010-09-28T19:39:19

[2nd try, this time with a correct subject, sorry for the duplicate]

Hi < at >ll,

I currently receive lots of annoying spam for approval to this
mailinglist, and since there was no real traffic for a long time on this
mailing list, I will close it. I also quit with my ISP so I will lose
the mailing list nevertheless.

Thank you for participating.

With best regards

Steffen Wendzel

Fwd: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:

Steffen Wendzel — 2010-09-28T19:37:49

Hi < at >ll,

I currently receive lots of annoying spam for approval to this
mailinglist, and since there was no real traffic for a long time on this
mailing list, I will close it. I also quit with my ISP so I will lose
the mailing list nevertheless.

Thank you for participating.

With best regards

Steffen Wendzel

Fw: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:

Steffen Wendzel — 2010-03-19T13:32:57

Begin forwarded message:

Date: Fri, 19 Mar 2010 14:29:34 +0100 (CET)
From: owner-covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
To: covertchan-approval-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org
Subject: BOUNCE covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org: Approval required:     


Return-Path: <owner-covertchan-1390-wvLxzkr0EQ1kIpNHJ+hlBYwBHQbwwUxVXqFh9Ls21Oc< at >public.gmane.org>
Delivered-To: covertchan-1390-wvLxzkr0EQ1kIpNHJ+hlBYwBHQbwwUxVXqFh9Ls21Oc< at >public.gmane.org
Received-SPF: pass (gmx.net: 213.165.64.20 is authorized to use 'cdp_xe< at >gmx.net' in 'mfrom' identity (mechanism 'ip4:213.165.64.0/23' matched)) receiver=basicbox1.server-home.net; identity=mfrom; envelope-from="cdp_xe-hi6Y0CQ0nG0< at >public.gmane.org"; helo=mail.gmx.net; client-ip=213.165.64.20
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
by basicbox1.server-home.net (Postfix) with SMTP id 134EB958047
for <covertchan-ZWP4Cux5wsPFH5NC/+J8NB2eb7JE58TQ< at >public.gmane.org>; Fri, 19 Mar 2010 14:29:34 +0

Article "Protocol Channels" from Hakin9 Magazine

Steffen Wendzel — 2009-12-19T18:24:09

Hi list members,

I just want to inform you that I uploaded the PDF file of my latest article
"Protocol Channels" from Hakin9 6/09. Protocol channels are a kind of covert
channels and very difficult to detect. You can find the paper here:
  => http://www.wendzel.de/?sub=showpost&blogid=3&postid=257

A full and detailed description of protocol channels is available in my
diploma thesis (but in german only). You can find all papers here:
  => http://www.wendzel.de/?sub=publ

Feedback is always welcome!

With best regards

Steffen Wendzel

Speech on Covert Channels

Steffen Wendzel — 2009-08-31T08:24:57

[since the last msg included garbage, here is a 2nd try ;)]

Hi covert channel list,

I just want to inform you that I will hold a speech about protocol
channels and protocol hopping covert channels on Sun, Sep. 06, 2009 in
Darmstadt, Germany at MRMCD0x8:

http://mrmcd0x8.metarheinmain.de/fahrplan/events/3344.de.html

with best regards

Steffen