On Covert Channels Using QUIC Protocol Headers

On Covert Channels Using QUIC Protocol Headers

Speakers: David Cheeseman

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=-_jUZBMeU5w

Overview

In this ShmooCon talk, David Cheeseman, a Johns Hopkins Master's student and cybersecurity professional, delved into the intriguing world of covert channels, specifically demonstrating how he engineered one using the QUIC (Quick UDP Internet Connections) protocol headers. The presentation, born from a two-week academic assignment, showcases an innovative method for surreptitious communication, leveraging a protocol designed for efficient and secure web traffic. Cheeseman's work highlights a critical area of concern for network defenders: the potential for seemingly benign, high-entropy fields within modern protocols to be repurposed for malicious activities such as command and control (C2) or data exfiltration.

The significance of this research lies in its exploration of QUIC, a relatively new and increasingly prevalent transport protocol often seen as a replacement for TCP with TLS. Its inherent design, which prioritizes encryption and performance, also presents new challenges for detection and analysis when exploited for covert purposes. By focusing on the Connection ID field—a required, high-entropy element within QUIC headers—Cheeseman illustrates how an attacker can embed encrypted payloads in a way that is statistically indistinguishable from legitimate traffic, thereby evading traditional network monitoring techniques. This talk serves as a vital reminder for security practitioners to consider the evolving threat landscape presented by next-generation protocols.

Background

▶ Watch: Introduction and talk overview (0:00)

The concept of covert channels originated from the broader field of information security, addressing the challenge of unauthorized information flow. Cheeseman categorized these channels into two primary problems: the confinement problem and the prisoners' problem. The confinement problem, exemplified by the WWII-era SIGSALY teletype encryptor where plaintext could be observed via oscilloscope (a side channel leakage related to TEMPEST), deals with unintended information disclosure from a system. In contrast, the prisoners' problem, which Cheeseman focused on, describes a scenario where two parties (Alice and Bob) wish to communicate secretly under the watchful eye of a warden (Wendell) who can inspect and manipulate their messages. This latter scenario is highly relevant to malicious actors seeking C2 capabilities or journalists requiring secure communication.

The formal classification of covert channels dates back to 1973 with the Department of Defense's TCSEC (Trusted Computer System Evaluation Criteria), which divided them into storage channels (data directly stored) and timing channels (data encoded in time-varying signals). TCSEC notably rated anything above 100 bits per second as "risky." More modern takes, such as Okra et al., expand this to a three-dimensional classification: storage vs. timing, network vs. OS vs. hardware, and value vs. transition. Wang et al. further introduced a risk measure considering bandwidth as a function of time, alongside weight difference (sensitivity of information) and threat rate/degree (immediate vs. cumulative risk). Cheeseman's motivation for this research stemmed from a two-week assignment in a Johns Hopkins cybersecurity class, prompting him to explore novel covert channel implementations.

His search for a suitable protocol led him to QUIC, which he encountered by chance while "screwing around" with WireShark. Initially proposed by Jim Roskind of Google, QUIC (Quick UDP Internet Connections) was later standardized in RFC 9000. It functions as a modern replacement for TCP with TLS, offering several advantages: fewer round-trip times for connection establishment, combined encryption and connection in a single handshake, and support for Application Layer Protocol Negotiation (ALPN), most commonly seen with HTTP/3. This flexibility allows various application protocols, like SMB, to run over QUIC, making it an attractive target for covert communication due to its increasing adoption and inherent encryption, which can mask illicit data flows.

Prior research on QUIC in a security context includes work by Boran da, who focused on scanning for QUIC services and proposed using trusted Port 443 to run services like SMB over QUIC for data exfiltration. His tools help blue teams identify not just QUIC services but also the specific applications running on them. Additionally, the "QuickStep" technique, mentioned by the speaker, explores methods to prevent censorship firewalls from dropping QUIC connections, indicating the protocol's growing importance in evading network controls.

Key Findings

▶ Watch: Modern risk evaluation for covert channels (3:34)

The central discovery and contribution of David Cheeseman's research is the successful implementation of a covert channel utilizing the Connection ID field within QUIC protocol headers. This field, which is mandatory in every QUIC header, possesses a crucial characteristic: it can range from 64 bits to a substantial 160 bits and is explicitly required to have "64 bits of entropy to be considered valid." This wide range and high-entropy requirement make it an ideal, high-capacity vector for embedding hidden information.

Cheeseman demonstrated that by carefully crafting encrypted payloads and segmenting them into these Connection IDs, he could achieve a covert communication channel that is statistically challenging to distinguish from legitimate QUIC traffic. The critical insight here is that if the embedded covert data, particularly when encrypted, maintains a high level of entropy comparable to truly random bytes, it will blend seamlessly with the expected statistical properties of normal Connection IDs. His proof of concept, despite being a two-week assignment, managed to achieve a bandwidth of approximately 10.3 bytes per second (or roughly 82.4 bits per second) for transmitting a 4096-bit RSA key under realistic network conditions (loading YouTube pages). While slightly below the 100 bits per second threshold historically considered "high risk" by TCSEC, this bandwidth is still significant for exfiltrating sensitive information or maintaining a low-and-slow C2 channel, especially given the difficulty of detection. This finding underscores a significant blind spot for network monitoring tools that primarily focus on payload content rather than the statistical properties of header fields.

Technical Deep Dive

▶ Watch: Why QUIC was chosen and its basic function (5:25)

The technical implementation of this QUIC-based covert channel involved several crucial steps, beginning with protocol selection and vector identification. Cheeseman's choice of QUIC was serendipitous, discovered through WireShark while looking for unfamiliar protocols. The protocol's design, particularly its emphasis on encryption and its use of UDP, makes it a challenging target for traditional deep packet inspection.

The core of the covert channel relies on exploiting the Connection ID field within QUIC headers. This field is present in every QUIC packet and serves to identify the connection. Critically, the Connection ID is not only required but also has a specified entropy requirement (at least 64 bits) and a flexible length, ranging from 64 to 160 bits. This flexibility and the expectation of high entropy make it an ideal candidate for embedding seemingly random, yet controlled, data. The large size (up to 20 bytes) allows for significant data chunks to be transmitted in each packet.

For implementation, Cheeseman opted to reuse existing code rather than building from scratch, leveraging the aioquic library on GitHub, a Python implementation of a QUIC HTTP/3 server. This allowed him to focus on manipulating the target field without reinventing the entire protocol stack. The process involved:

1. Locating the Connection ID: Identifying where the Connection ID is set and how it can be manipulated without disrupting the underlying QUIC protocol's functionality.
2. Protocol Design: A custom, simple message format was devised: a single character indicating message type, followed by the content. For instance, 'K' for a keep-alive message.
3. Encryption Strategy: To ensure the covert data maintained high entropy and blend with legitimate traffic, strong encryption was paramount. The channel uses a hybrid approach:

• Key Exchange: A 4096-bit RSA public modulus is exchanged. Chunks of this public key are sent across as Connection IDs. Cheeseman noted that an out-of-band key exchange would be more secure, but for the proof of concept, it was transmitted over the covert channel itself.
• Data Encryption: Once the RSA key exchange is complete, AES encryption is used for subsequent data transmission.

1. Entropy Matching: A critical aspect of making the covert channel undetectable is ensuring that the entropy of the encrypted data, when placed in the Connection ID, is statistically indistinguishable from truly random bytes. Cheeseman used CyberChef to verify that the RSA public modulus and 512-byte chunks of AES-encrypted data had entropy values within the same order of magnitude as random bytes. This is crucial because a noticeable difference in entropy would immediately flag the traffic as suspicious.
2. Communication Flow: The client and server both queue up chunks of their RSA public key and transmit them as Connection IDs. Once the key exchange is complete, they switch to AES. The server maintains a queue of encrypted data, sending keep-alive messages (encrypted 'K's) as CIDs to keep the channel active when no other data is present. When a remote command, such as "whoami," is sent by the client, it is encrypted, chunked into CIDs, and transmitted. The server receives, decrypts, executes the command, encrypts the response (standard out/error), and sends it back as CIDs.

This detailed manipulation of a core protocol header, combined with robust encryption and careful attention to statistical properties, forms the backbone of Cheeseman's successful covert channel implementation.

Demo / Proof of Concept

▶ Watch: Existing research on QUIC for data exfiltration (6:18)

David Cheeseman's presentation included an animated demonstration that visually walked through the process of establishing and utilizing the covert channel within QUIC headers. The demo, which mirrored the communication flow described in the technical deep dive, showcased the key stages of the covert operation:

1. Key Exchange Initialization: Both the client and server begin by queuing up chunks of their respective 4096-bit RSA public keys. These chunks are then sequentially submitted and transmitted as Connection IDs within QUIC packets. This initial phase establishes the cryptographic basis for secure communication over the covert channel.
2. Client Command Transmission: At any point after the key exchange has begun or completed, the client can queue up a message for transmission. In the demonstration, this was a remote command: "whoami". This command is encrypted using AES (once the keys are exchanged) and then segmented into multiple Connection IDs for covert delivery.
3. Server Keep-Alive Mechanism: To maintain the continuous flow of Connection IDs and avoid suspicion, the server continuously encrypts the letter 'K' (representing a keep-alive message) and sends these small, encrypted chunks as Connection IDs when no other messages are queued. This ensures that the channel remains active and appears statistically similar to benign traffic, even during periods of inactivity from the covert data perspective.
4. Command Reception and Response: Once the "whoami" command's encrypted segments are received and reassembled by the server, it is decrypted and executed. The standard output and standard error from the command execution are then captured, encrypted using AES, and queued up to be sent back to the client as a series of Connection IDs.

The demo effectively illustrated how seemingly random, high-entropy Connection IDs are used to shuttle encrypted data back and forth, making the covert communication appear indistinguishable from normal QUIC traffic. It visually reinforced the concept that the channel’s effectiveness relies on blending in with the protocol's expected statistical properties, particularly the high entropy of its header fields.

Defensive Implications

▶ Watch: Identifying the QUIC Connection ID as a vector (7:44)

The covert channel demonstrated by David Cheeseman using QUIC Connection IDs presents significant challenges for network defenders, primarily due to its stealthy nature. The core issue is that if an attacker can find a high-entropy field within a protocol and inject high-entropy data (especially encrypted payloads) into it, detection becomes exceedingly difficult. Traditional network security tools, often relying on signature-based detection or deep packet inspection of payload content, are likely to miss such an attack. This necessitates a shift towards more sophisticated detection mechanisms.

Several specific defensive implications and potential mitigation strategies were discussed:

1. Detection Challenges:

• Statistical Indistinguishability: The primary challenge is that encrypted data, when properly implemented, has high entropy and appears statistically random. When placed in a field like the QUIC Connection ID, which is designed to be high-entropy, it blends in seamlessly with legitimate traffic.
• Protocol Blind Spots: QUIC is a relatively new and encrypted protocol, making it harder for existing network monitoring tools to inspect its internal structures or differentiate between benign and malicious use of its fields.

1. Statistical Anomalies (Potential Weaknesses):

• Odd/Even CID Distribution: Cheeseman noted a fringe case where, if a public modulus is always odd, a perfectly high-entropy data stream should have an even split of odd versus even Connection IDs. A statistically significant deviation could indicate covert activity. However, this is a subtle anomaly and easily mitigated by an attacker distributing keys out-of-band.

1. Manipulation and Man-in-the-Middle (MITM) Attacks:

• Lack of Authentication: In the proof of concept, there was no mechanism to authenticate that the RSA public key truly originated from the intended sender. This makes the channel susceptible to man-in-the-middle attacks, where an adversary could intercept and substitute public keys, potentially leading to decryption and manipulation of subsequent AES-encrypted traffic.
• AES Bit-Flip Attacks: Without robust confidentiality and integrity checking mechanisms, the AES encryption is vulnerable to bit-flip attacks. An attacker could subtly alter encrypted bits, causing predictable changes in the decrypted plaintext without the sender or receiver knowing the data was tampered with.

1. Disruption Challenges:

• Costly CID Swapping: One theoretical defense involves dynamically swapping out real Connection IDs with placeholder IDs. However, this would be computationally intensive and antithetical to QUIC's design goals of performance and efficiency, making it impractical for real-time implementation.
• Breaking Encryption Sync: Simply dropping a connection could break the encryption synchronization between Alice and Bob. However, a robust covert channel implementation would include a re-synchronization mechanism to recover from such disruptions.

1. Recommended Defensive Measures:

• Endpoint Protection and DLP: Given the difficulty of network-level detection, endpoint protection and Data Loss Prevention (DLP) controls become even more critical to prevent the initial compromise and subsequent data exfiltration attempts.
• Out-of-Band Key Exchange: To counter MITM attacks, establishing cryptographic keys through a secure, out-of-band mechanism is crucial.
• Robust Integrity Checking: Implementing strong integrity checking mechanisms (e.g., Message Authentication Codes - MACs or Authenticated Encryption with Associated Data - AEAD modes) would allow Alice and Bob to detect if a bit-flip attack or any other form of tampering has occurred.
• Avoid Entropy Reduction: Any changes to the covert channel implementation, such as embedding sequence numbers directly into the Connection ID, must be carefully considered to avoid lowering the overall entropy of the CIDs. Lower entropy would create statistically noticeable patterns, making detection easier. Defenders could leverage this principle by monitoring for Connection IDs with unusually low entropy or predictable patterns.
• Behavioral Analytics: Future defense mechanisms might involve behavioral analytics that look for unusual patterns in QUIC connection establishments, durations, or the statistical properties of Connection IDs over time, even if individual CIDs appear random.

In essence, defending against such sophisticated covert channels requires moving beyond superficial packet inspection to deep statistical analysis of protocol fields and robust endpoint security measures.

Key Takeaways

• High-Entropy Fields are Covert Channel Gold: Identifying and exploiting high-entropy, flexible fields within network protocols, like QUIC Connection IDs, is a highly effective method for building stealthy covert channels that are difficult to detect.
• Encryption is Key to Evasion: When covert data is strongly encrypted (e.g., with AES) and its entropy matches that of legitimate traffic, it becomes statistically indistinguishable from benign communication, rendering traditional network monitoring largely ineffective.
• QUIC Presents New Challenges: As a modern, encrypted, and increasingly adopted protocol, QUIC introduces new blind spots for network defenders, necessitating novel detection strategies beyond basic payload inspection.
• Statistical Analysis is Crucial: Detecting such channels may require advanced statistical analysis of header field properties (like entropy distribution, odd/even patterns) rather than relying solely on content-based signatures.
• Endpoint Security Remains Paramount: Due to the difficulty of network-level detection, robust endpoint protection and DLP controls are critical last lines of defense against initial compromise and data exfiltration via covert channels.
• Continuous Improvement for Resilience: Covert channels, like any exploit, are vulnerable to manipulation and detection. Implementing out-of-band key exchange, robust integrity checking, and re-synchronization mechanisms are crucial for building a more resilient covert communication system.

About the Speaker(s)

David Cheeseman is a cybersecurity professional with a diverse background, currently pursuing a Master's degree in Cybersecurity at Johns Hopkins University. His professional experience leans towards the blue and purple team side of cybersecurity, indicating a focus on defensive and analytical roles. A proud Navy veteran, Cheeseman served on both a submarine and an aircraft carrier, bringing a unique operational perspective to his technical work. Beyond his academic and professional pursuits, he is an active hacker, building security tools in his spare time and sharing them on GitHub as a hobby. He also participates in CTFs (Capture The Flag), demonstrating his practical skills and competitive spirit in the cybersecurity community. His interests further extend to science and skepticism, homebrewing, gaming, and making, showcasing a well-rounded and inquisitive personality dedicated to continuous learning and building.