Bankrupt Covert Channel: Turning Network Predictability into Vulnerability

by   Dmitrii Ustiugov, et al.

Recent years have seen a surge in the number of data leaks despite aggressive information-containment measures deployed by cloud providers. When attackers acquire the sensitive data in a secure cloud environment, covert communication channels are a key tool to exfiltrate the data to the outside world. While the bulk of prior work focused on covert channels within a single CPU, they require the spy (transmitter) and the receiver to share the CPU, which might be difficult to achieve in a cloud environment with hundreds or thousands of machines. This work presents Bankrupt, a high-rate highly clandestine channel that enables covert communication between the spy and the receiver running on different nodes in an RDMA network. In Bankrupt, the spy communicates with the receiver by issuing RDMA network packets to a private memory region allocated to it on a different machine (an intermediary). The receiver similarly allocates a separate memory region on the same intermediary, also accessed via RDMA. By steering RDMA packets to a specific set of remote memory addresses, the spy causes deep queuing at one memory bank, which is the finest addressable internal unit of main memory. This exposes a timing channel that the receiver can listen on by issuing probe packets to addresses mapped to the same bank but in its own private memory region. Bankrupt delivers up to 99Kb/s transmission bandwidth with 96 undetectable to the existing monitoring capabilities, such as CPU performance counters.


page 1

page 2

page 3

page 4


Fundamental Limits of Covert Packet Insertion

Covert communication conceals the existence of the transmission from a w...

Leaking Information Through Cache LRU States

The widely deployed Least-Recently Used (LRU) cache replacement policy a...

Multiaccess Communication via a Broadcast Approach Adapted to the Multiuser Channel

A broadcast strategy for multiple access communication over slowly fadin...

Mice and Covert Channels

Any secure network is only as secure as its weakest component. With over...

On Blowback Traffic on the Internet

This paper considers the phenomenon where a single probe to a target gen...

On the Capacity of "Beam-Pointing" Channels with Block Memory and Feedback: The Binary Case

Millimeter-wave (mmWave) communication is one of the key enablers for 5G...

Online Memory Leak Detection in the Cloud-based Infrastructures

A memory leak in an application deployed on the cloud can affect the ava...

Please sign up or login with your details

Forgot password? Click here to reset