Crafting Web Counters into Covert Channels
ABSTRACT Almost all the previously proposed network storage channels write covert messages in the packets’ protocol fields. In contrast,
we present in this paper a new network storage channel WebShare that uses the plentiful, public Web counters for storage. Therefore, the physical locations of the WebShare encoder and decoder
are not restricted to a single path. To make WebShare practical, we have addressed a number of thorny issues, such as the
“noise” introduced by other legitimate Web requests, and synchronization between encoder and decoder. For the proof-of-concept
purpose, we have experimented a WebShare prototype in the Internet, and have showed that it is practically feasible even when
the Web counter and the encoder/decoder are separated by more than 20 router hops.