Technologies such as Docker help to improve the efficiency of software development lifecycles. They are portable and lightweight packages that can be specially tailored to a wide range of use cases. That said, the nature of shared resources and portability regarding container technology poses serious risks to the security of containers as a whole. While platforms such as DockerHub enable developers to share software packages like never before, they also facilitate the distribution of container risks and vulnerabilities, including opportunities for covert channels. We present a covert channel methodology that leverages Docker-Hub as a distribution platform for covert messages embedded in Docker images. Contrary to existing container covert channels, we focus on static data embedding in Docker images rather than runtime behavior. Our implementation embeds encoded data into files within Docker images, and using sending/receiving orchestrators, we establish a reliable method for encoding, transmitting, and retrieving covert messages via DockerHub. This proof-of-concept highlights the potential for leveraging container platforms like DockerHub for covert communications. We discuss the limitations of our approach and propose future enhancements involving advanced steganography techniques and resilience testing against machine-learning-based detection methods.

The lack of quality datasets is a critical problem that limits machine learning experimentation in the areas of intelligent networks and security. Datasets are often a poor fit, insufficient for experiment needs, out of date or simply inaccessible. To address these issues we present the RIT dataset collections. These two collections consist of balanced and unbalanced capture files, topology diagrams and scenario descriptions. The network capture files in the collection are available in text and pcapng formats. The base network collection also contains image files created from the packet capture data samples. These formats offer researchers an unparalleled opportunity to benchmark a wider variety of machine learning models. The balanced training and validation datasets contain 5,000 and 500 samples for each of fourteen classes. Classes include TCP and UDP variations, layer 3 protocols such as the Address Resolution Protocol and layer 2 management protocols such as spanning tree. The base collection includes five other curated but unbalanced test sets. Expanding on the original fourteen classes, typical network activities are captured in the second set of uncurated files. The security collection includes capture files, topology diagrams and the associated scenario descriptions. The current collection consists of Man in the Middle (MITM) attacks, TCP port scans and Active Directory (AD) enumeration attacks. Additional datasets and their topology diagrams continue to be added to the collections. The repository also provides some multi-layer perceptron and convolutional neural network model classification accuracy values for comparison. The dataset collections are publicly available via RIT Scholar-works and the following DOIs: www.doi.org/10.57673/gccis-yg55 and www.doi.org/10.57673/gccis-qj60

Over the past decade, the number and scale of ransomware attacks has grown. These attacks have stretched across multiple industries globally and caused billions of dollars of damages. Recent attacks have disrupted critical infrastructure and have served as prelude to war. Studies have shown that there is a lack of awareness among industry practitioners surrounding appropriate responses to ransomware. This failure during a career-defining moment is largely due to the gap between cyber security academic knowledge and industry practice. We therefore provide a learning resource for ransomware response education that is academically adequate, practically viable, and ultimately illustrates a process for proper employment of technology. This case, exposes students to technical requirements for a ransomware response and explores ransomware best practices. Discussion questions and a wargaming-style purple team exercise for individuals or groups extend the opportunity for delivering additional technical depth.

This paper discusses a new music-based covert channel implemented within The Lord of the Rings Online, an online MMORPG.Many MMORPG video games have been used to implement covert channels to communicate between a sender and receiver while an observer is denied knowledge of the communication.Covert channels can be used as a method of secret communication between malicious actors or to provide a voice for those who are silenced by censorship.This covert channel is unique in that it utilizes the ingame music system to send messages by encoding ASCII characters into binary and then into music notes which can be played in the game.The implementation of this covert channel involves a sender who generates an ABC file containing the notes that represent the encoded message.The ABC file can be used to play the music within the game.The receiver uses audio recording software and music transcription software to extract the decoded message.A proof of concept implementation of this covert channel proved that it is effective for covertly communicating messages within The Lord of the Rings Online.

In this paper, we utilize a music streaming platform called Spotify to create two distinct covert channels.The usage for these covert channels is based on the ability for various users to access publicly available playlists.Users can use these playlists to send and receive covert messages.The first method uses the first letter of an album name to construct a message, and the second uses song's explicit tags to create binary messages.We concluded that these covert channels were successful.This is because they could send messages with adequate obscurity that outside actors would not be privy to the covert message contained.

Governments across the world are increasingly pushing for encryption backdoors and other privacy breaking features. One possible method to maintain privacy in a post-encryption environment is to utilize covert channels as a means to hide traffic from monitoring authorities. Covert channels have often been used to hide unwanted or prohibited web traffic, however, the traffic need not be malicious for there to be a necessity for privacy. In this paper we explore a novel covert channel named Minecraft Altered Skin Channel (MASC) that exploits the inherent inefficiencies within Minecraft skin images. Data is transferred by reflecting a modified skin image off of the publicly accessible Minecraft Skin servers. We utilize a custom steganographic algorithm and a public Application Programming Interface (API), which when combined, grant the ability to quickly and asynchronously send and receive encoded messages without any direct communication between the two or more participating parties. We demonstrate the effectiveness of the scheme by implementing an efficient sender-receiver proof of concept. Finally, we go on to empirically analyze the program’s results and show the comparatively high bitrate of the channel.

Internet of Things (IoT) is a part of Cyber Science that has been gaining popularity exponentially.IoT are generally referred to as smart devices since they carry out their operations with minimal human intervention.The IoT devices are connected to each other via a device such as a centralized modem.Through this method, IoT helps provide an easier life for its consumers.Even so, these smart devices are flawed and face privacy challenges and can be exploited at the physical level to obscurely perform information exchange that they are not intended to do.This is known as a covert channel.By definition, a covert channel is some form of a medium which is used to exploit the functionalities of an overt channel to secretly send and receive messages which they are not originally programmed to do so.Following this definition, "MODBUS Protocol" was chosen to be used as a communication protocol in a Master-Slave model for a covert channel.The MODBUS protocol uses a Master and Slave system model where the Master sends functional instructions to the slaves and the slaves return the output corresponding to the instruction.By exploiting this feature of the Master-Slave architecture, we have built a covert channel wherein the receiver maps each character of the covert message into an instruction and sends it to the slave and the slave strips off the data in that instruction and sends it to the intended receiver, where the receiver maps the instruction back to the character and prints out the message.

- Internet of Things (IoT) is a part of Cyber Science that has been gaining popularity exponentially. IoT are generally referred to as smart devices since the carry out their operations with minimal human intervention. The IoT devices are connected to each other via a device such as a centralized modem. Through this method, IoT helps provide an easier life for its consumers. Even so, these smart devices are flawed and face privacy challenges and can be exploited at the physical level to obscurely perform information exchange that they are not intended to do. This is known as a covert channel. By definition, a covert channel is some form of a medium which is used by exploiting its functionalities to secretly send and receive messages which they are not originally programmed to do so. Hence following the above definition, “MODBUS Protocol” was chosen to be used as a communication protocol in a Master-Slave model for a covert channel. The MODBUS protocol uses a Master and Slave system model where the Master sends functional instructions to the slaves and the slaves return the output corresponding to the instruction. By exploiting this feature of the Master-Slave architecture, we have built a covert channel wherein the receiver maps each character of the covert message into an instruction and sends it to the slave and the slave strips off the data in that instruction and sends it to the intended receiver, where the receiver maps the instruction back to the character and prints out the message.

The goal is to raise awareness and encourage learning cybersecurity principles by making competitions appealing to a wider audience. In an effort to make events compelling, attractive, and watchable, the researchers will develop systems to support visualizations and make the transactions between teams in different cybersecurity competitions easy to comprehend. In informing and educating the audience on the intricacies of the competition through engaging visualizations, cybersecurity competitions will be opened up to a world beyond just participants. In doing so, we can potentially attract new talent into the field. Our team seeks to make prototype visualizations for key actions in various student cybersecurity competitions and assess spectator understanding of key principles of the competition.

Covert communication enables the hidden transfer of data. Unlike encrypted communication, where the goal is to make the transmitted data unreadable, covert communication aims to hide the existence of the communication. There have been research efforts on developing and preventing numerous types of channels. We present a novel storage covert channel by leveraging a music streaming platform and take an in depth look into its inner workings. The channel aims to enable data transmission between one sender and multiple receivers. The channel, presented in two different methods of encoding, utilizes a public music streaming platform playlists and encodes data by selectively adding music tracks. The first method of encoding leverages song names while the second uses data embedded within the song track id. We were successful in implementing both encoding schemes, thus demonstrating the covert channels' feasibility.

When disasters happen, the speed with which first responders and emergency personnel can contact and be contacted by the people affected by the disaster during the first minutes or hours is critical. Early communications can make the difference between life and death. During a disaster communications infrastructure of the affected area is likely to be compromised. This project proposes an inexpensive, rapidly deployable cloud of autonomous drones, each coupled with a micro-cellular base station that deploys from a transportable deployment module. The goal is to temporarily restore communications for both first responders to communicate amongst themselves as well as for the rest of the impacted population.

This paper describes an open-source project called RATCHET whose goal is to create software that can be used by large groups of people to construct attack trees. The value of an attack tree increases when the attack tree explores more scenarios. Crowdsourcing an attack tree reduces the possibility that some options might be overlooked. RATCHET has been tested in classroom settings with positive results. This paper gives an overview of RATCHET and describes some of the features that we plan to add. Keywords—crowdsourcing, attack tree, security, attack surface

In this paper, we scrutinize a way through which covert messages are sent and received using the Network Time Protocol (NTP), which is not easily detected since NTP should be present in most environment to synchronize the clock between clients and servers using at least one time server. We also present a proof of concept and investigate the throughput and robustness of this covert channel. This channel will use the 32 bits of fraction of seconds in timestamp to send the covert message. It also uses "Peer Clock Precision" field to track the messages between sender and receiver.

We describe the recent developments of an open-source project called RATCHET that can be used by groups of users to collectively construct attack trees. We present the RATCHET framework as well as a model for testing and evaluation of the produced attack trees. RATCHET has been tested in classroom settings with positive results and this paper presents the plans for expanding its outreach to the community at large and building attack trees through crowdsourcing. This paper gives an overview of RATCHET and an introduction to its use.

The goal of this covert channel is to prove the feasibility of using encrypted HTTPS traffic to carry a covert channel. The encryption key is not needed because the original HTTPS payload is not decrypted. The covert message will be appended to the HTTPS data field. The receiver will extract the covert channel and restore the original HTTPS traffic for forwarding. Only legitimate HTTPS connections will be used as the overt channel. A Man-in-the-Middle (MITM) attack at the sending and receiving ends will give access to modify the traffic streams. The HTTPS return traffic from the server can carry a covert channel. Without the original HTTPS traffic for comparison or the original encryption keys, this covert channel is undetectable.

This paper proposes a new covert channel utilizing open web relays. While the channel described is very straightforward, the addition of a trusted relay dramatically increases the anonymity and efficacy of this channel. Indirect, relayed communications disguise the actual endpoints of the communication making analysis, detection, and prevention more difficult.

In “Exploring a High-Capacity Covert Channel for the Android Operating System” [1], a covert channel for communicating between different applications on the Android operating system was introduced and evaluated. This covert channel proved to be capable of a much higher throughput than any other comparable channels which had been explored previously. This article will expand on the work which was started in [1]. Specifically, further improvements on the initial covert channel concept will be detailed and their impact with regards to channel throughput will be evaluated. In addition, a new protocol for managing connections and communications between collaborating applications purely using this channel will be defined and explored. A number of different potential mechanisms and techniques for detecting the presence and use of this covert channel will also be described and discussed, including possible counter-measures which could be implemented.

The worldwide dial plan proposed by the International Telecommunication Union recommendation E.164 reserves multiple country codes for future use. These unused codes present an opportunity for a potential covert channel over the public switched telephone network utilizing a spoofed source phone number of a call to send information to a mobile device. The reserved country codes can act as a delimiter indicating that a secret message is being sent. By spoofing a call using a reserved country code number, the application listening on the mobile device will be able to intercept the call and extract information from the remaining digits based on ASCII encoding in a decimal format. The purpose of using a reserved country code number is so that there will be no denied service to the user with a call from a legitimate phone number. Keywords—Covert channel; Public Switched Telephone Network; Dial plan; Android; Phone number