A Ghost in your Transmitter : analyzing polyglot signals for physical layer covert channels detection

Abstract

During the last 5 years, the possibility of using physical covert channels to communicate with air-gapped information systems has been widely investigated, the main idea being the instrumentation of software or hardware components in order to code information on a shared physical medium. In complement, logical covert channels in communication protocols have been intensively studied for several decades, mostly relying on unused or reserved fields in frames at logical layers or on the instrumentation of timings and state transitions in the target protocols. Interestingly, the exploitation of physical layer characteristics of legitimate transmissions as covert channels seems to have been underestimated. More recently, an approach was proposed to superimpose two different protocols, one ASK-based and one PSK-based, within the same transmitted PHY frames, thus illustrating the possibility of covert channels using so-called polyglot signals.

In this study, we decided to focus on the possibility of using a compromised radiofrequency transceiver in order to create a covert channel on the physical layer while preserving a legitimate communication. To this end, we considered a classical QPSK transmission system on which a covert communication was implemented by modulating the legitimate (modulated) signal. Several modulation schemes were formalized showing that covert channels based on polyglot signals are not restricted to the use of complementary carrier characteristics (e.g. amplitude for channel 1 and phase for channel 2). For each attack model, a specific receiver has been designed. Finally, we will show that the detection of this kind of RF covert channel, which is not possible with a classical receiver, can be achieved by monitoring some simple RF characteristics with state-of-the-art signal processing algorithms.

Full text

A Ghost in your Transmitter :
analyzing polyglot signals for physical layer covert
channels detection
José LOPES ESTEVES,
Emmanuel COTTAIS and Chaouki KASMI

E. Cottais, C.Kasmi & J.Lopes Esteves
WHO WE ARE
E. COTTAIS, C. KASMI, J. LOPES ESTEVES
ANSSI-FNISA / Wireless Security Lab
11 members, including 3 PhD
Electromagnetic security
RF communications security
Embedded systems
Signal processing
2

E. Cottais, C.Kasmi & J.Lopes Esteves
OUTLINE
Covert channels
Polyglot signals
Target QPSK transmission
Generating covert polyglot signals
Exploiting covert polyglot signals
Detection techniques and counter-measures
Conclusion
3

Definitions
Covert channels

E. Cottais, C.Kasmi & J.Lopes Esteves
COVERT CHANNELS
5
Covert channel:
Information transfer (uni- or bi-directional)
Entities not allowed to communicate
Channel not intended for communication
Prerequisite: preliminary infection
Both ends know the covert channel
Both ends know the covert protocol
Out of scope of this talk

E. Cottais, C.Kasmi & J.Lopes Esteves
COVERT CHANNELS
6
Host based: communication between
processes on a host [1]
Shared file system: file contents, file lock…
Shared hardware: DRAMA [2]…
Two classes :
Storage based
Timing based
A lot of studies on design, characterization
and detection

E. Cottais, C.Kasmi & J.Lopes Esteves
COVERT CHANNELS
7
Network based: communication between
remote processes on connected hosts
Information hidden in [1,3]:
Protocol Data Units
Through the timing of PDUs or protocol
commands
A lot of studies on design, characterization
and detection
Mostly > layer 3 channels

E. Cottais, C.Kasmi & J.Lopes Esteves
COVERT CHANNELS
8
Air gap based: communication between
remote processes on disconnected hosts
Exploitation of shared physical medium:
Light, pressure, vibration, sound, temperature,
EM environment
Also called physical covert channels
Modulate information directly on physical
medium
Recent security hype

Physical layer network-based covert channels
Polyglot Signals

E. Cottais, C.Kasmi & J.Lopes Esteves
POLYGLOT SIGNALS
10
Goodspeed, Bratus, ReCon 2015 [4]
RF receivers are parsers
Info received is different from info transmitted
to upper layers:
Modulation
Error correction
Try to recover familiar structures from
unknown received signal

E. Cottais, C.Kasmi & J.Lopes Esteves
POLYGLOT SIGNALS
Can be exploited for covert communications
Exploit complementary modulations
ASK modulation added to a PSK based
protocol
The legitimate receiver will still get the PSK
messages and will not consider amplitude
variations, and likely correct them
The covert receiver is a ASK demodulator which
will not consider the phase variations
11

E. Cottais, C.Kasmi & J.Lopes Esteves
POLYGLOT SIGNALS
Covert polyglot signal for data exfiltration
ASK modulation added to a PSK based protocol
12
PSK PSK
PSK PSK

E. Cottais, C.Kasmi & J.Lopes Esteves
POLYGLOT SIGNALS
Covert polyglot signal for data exfiltration
ASK modulation added to a PSK based protocol
13
ASK+PSK
PSK PSK
PSK
ASK

E. Cottais, C.Kasmi & J.Lopes Esteves
POLYGLOT SIGNALS
Covert polyglot signal for data exfiltration
ASK modulation added to a PSK based protocol
Attacker needs:
Minimize impact on legit channel
Maximize covert transmission quality
Minimize detectability
Of course: trade-off !
14

E. Cottais, C.Kasmi & J.Lopes Esteves
POLYGLOT SIGNALS
Is this technique limited to complementary
modulations ?
How can an attacker generate a covert
polyglot signal ?
Is it possible to efficiently detect such covert
channels?
15

Back to school
Target QPSK transmission

E. Cottais, C.Kasmi & J.Lopes Esteves
QPSK TRANSMISSION
Architecture of an IQ transmitter
17
Binary data
Transmitted signal:
= It.cos0t + 0Qt. sin(0t + 0)
Filters
Filters

E. Cottais, C.Kasmi & J.Lopes Esteves
QPSK TRANSMISSION
Received signal (ideal channel):
After low-pass filtering:
18
Transmitted signal:

E. Cottais, C.Kasmi & J.Lopes Esteves
QPSK TRANSMISSION
19
Received signal constellation (ideal channel):

E. Cottais, C.Kasmi & J.Lopes Esteves
QPSK TRANSMISSION
20
Non-ideal channel:
Presence of noise
The receiver implements several correction
blocks
Especially:
IQ imbalance: amplitude and phase correction

Finding entry points for attacking
Generating Covert Polyglot Signals

E. Cottais, C.Kasmi & J.Lopes Esteves
QPSK TRANSMISSION
Target QPSK transmitter
22
Binary data
Filters
Filters
Hardware or software Hardware

E. Cottais, C.Kasmi & J.Lopes Esteves
QPSK TRANSMISSION
Transmitted signal:
23
Binary data
Local
oscillator(s)
IQ samples
= It.cos0t + 0Qt. sin(0t + 0)
Filters
Filters
Hardware or software Hardware

E. Cottais, C.Kasmi & J.Lopes Esteves
GENERATING POLYGLOT SIGNALS
Transmitted signal
24
Binary data
Hardware or software Hardware Local
oscillator(s)
IQ samples
Software attack:
•Amplitude of I
•Amplitude of Q
Hardware attack:
•Amplitude of cos
•Amplitude of sin
•Cos frequency
•Cos phase
•Sin frequency
•Sin phase
Filters
Filters

E. Cottais, C.Kasmi & J.Lopes Esteves
GENERATING POLYGLOT SIGNALS
Software level
Configuration of radio front-end
Modification of IQ samples of SDR
Modification of FPGA code of SDR
How
Malicious device drivers
Software flowgraph alteration
Specially crafted firmware/bitstream [12]
Modification of I and Q independently
possible
26

E. Cottais, C.Kasmi & J.Lopes Esteves
GENERATING POLYGLOT SIGNALS
Hardware level
Alteration of local oscillator(s) behaviour
Hardware trojan
EMC phenomena
How
Crosstalk, parasitic coupling, impedance
mismatch
On power lines, on oscillator configuration lines
(e.g. VCO, capacitors) [5]
Separate operation on I and Q not
straightforward 27

Playing with the amplitude of I and Q
Exploiting Covert Polyglot Signals

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
Modulating the amplitude of IQ channels
Can be done from hardware or software
Two example polyglot signals:
ASK over QPSK
QPSK over QPSK
29
= It.1 + . cos0t + 0Qt.1 + . sin(0t + 0)
= It.1 + . cos0t + 0Qt.1 + . sin(0t + 0)

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
Transmitted signal:
Received signal (ideal channel):
After low-pass filtering:
30

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
31
IQ imbalance correction block will:
Consider α and β effects as noise
Compensate α and β
Transparent for legit receiver
x1
x2
y2
y1

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
32
On the covert receiver, how to recover α and β ?
We suppose α and β small
Do not change symbol quadrant (we target QPSK)
Compare received samples with expected ones

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
33
Covert receiver data recovery:

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
34
Original and recovered
α
Spectrum of recovered
α

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
ASK over QPSK
Just choose α = β
35
Data bit
Interference
sign
0
α>0 and β>0
1
α<0 and β<0

E. Cottais, C.Kasmi & J.Lopes Esteves
EXPLOITING POLYGLOT SIGNALS
QPSK over QPSK
Just give α and β
two possible values
36
Data
Interference
sign
00
α>0 and β>0
01
α>0 and β<0
10
α<0 and β>0
11
α<0 and β<0

Advanced signal processing
Detection techniques
and
Counter-measures

E. Cottais, C.Kasmi & J.Lopes Esteves
DETECTION TECHNIQUES
38
Detection of such data exfiltration
Instrumentation of observables
Extract features of correction blocks at receiver
IQ imbalance correction [6]
Measuring the mismatch between parallel section of receivers
Fixing coefficient update interval -> limitation for detection !
Carrier recovery [7]
Phase/ Frequency differences
Estimate and compensate differences between RX and TX signals
Equalization algorithm [8]
Inter-symbol interference suppression -> detecting cyclic symbol
modifications
Coefficients updated each packet
Monitoring of the variation of the correction coefficients

E. Cottais, C.Kasmi & J.Lopes Esteves
DETECTION TECHNIQUES
39
Almost random
correction
Repetitive correction
Presence of periodic
variations

E. Cottais, C.Kasmi & J.Lopes Esteves
DETECTION TECHNIQUES
40
Detection of such data exfiltration
Implementation of a dedicated detection system
Prospective thoughts
Use of signal processing algorithms
Wavelet transform: recursive LF vs HF analysis [9]
Use blind demodulation techniques [10]
Input: IF signal, baseband
Features : amplitude, phase, phase difference, frequency, Cyclic
Spectral analysis, complex envelop
Statistics: histogram, STD,
Classifier: maximum likelihood, max correlation, decision tree

E. Cottais, C.Kasmi & J.Lopes Esteves
COUNTER-MEASURES
41
At FPGA level
Verify the integrity of the code at startup
Prevent code to be modified/rewritten
At hardware level
Design hardened RF front-end
Active self test of hardware with control loops
Avoid coupling path (follow electronic rules and guidelines)
EMC Tests of PCB’s with improved EMSEC capabilities
At fab. level
Check PCB’s fabrication process
Masks validation

Conclusion

E. Cottais, C.Kasmi & J.Lopes Esteves
CONCLUSION
Polyglot signals:
Interesting phy layer network covert channels
Attack vector:
Software based: can be a malware
Hardware based: can be a HW trojan (or
interference)
Not limited to complementary modulations
QPSK in QPSK
Any modulation should work on any modulation
43

E. Cottais, C.Kasmi & J.Lopes Esteves
CONCLUSION
Channel capacity depends on:
Legitimate transmission
Covert transmission choices
We propose detection methods:
Use correction blocks
Already present in receivers
Look for periodicity in correction factors
Additional ideas:
Blind demodulation techniques
44

E. Cottais, C.Kasmi & J.Lopes Esteves
FURTHER THOUGHTS
Explore the hardware based attack
We like RF interference
And HW trojans
Covert channel is a hot topic
Need of new detection systems
Investigate physical layers against hidden
communication
Implementation of specific processes to
avoid/detect HW trojans
45

References

E. Cottais, C.Kasmi & J.Lopes Esteves
REFERENCES
[1] Wojciech Mazurczyk et al., “Information Hiding in Communication Networks: Fundamentals, Mechanisms” March 2016,
Wiley and Sons, 2016
[2] Peter Pessl, “DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks”, 25th Usenix Security Symposium 2016,
August 2016
[3] E. Tumoian and M. Anikeev, "Network Based Detection of Passive Covert Channels in TCP/IP," The IEEE Conference on
Local Computer Networks 30th Anniversary (LCN'05)l, Sydney, NSW, 2005
[4] Travis Goodspeed, Sergey Bratus , “Polyglots and Chimeras in Digital Radio Modes”, Recon 2015, 2015
[5]Ramon Cerda, “Sources of Phase Noise and Jitter in Oscillators”, March 2006, online:
http://www.crystek.com/documents/appnotes/SourcesOfPhaseNoiseAndJitterInOscillators.pdf
[6] J. Tubbax et al., "Compensation of IQ imbalance and phase noise in OFDM systems," in IEEE Transactions on Wireless
Communications, vol. 4, no. 3, pp. 872-877, May 2005.
[7] Timo Pfau et al., “Hardware-Efficient Coherent Digital Receiver Concept With Feedforward Carrier Recovery for -QAM
Constellations”, Journal of lightwave technology, April 15, 2009
[8] L. He and S. A. Kassam, "Convergence analysis of blind equalization algorithms using constellation-matching," in IEEE
Transactions on Communications, vol. 56, no. 11, pp. 1765-1768, November 2008.
[9] QI Li-mei et al., “Wavelet Transform Theory and Its Application in Signal Processing”, Journal of University of Electronic
Science and Technology of China, March 2008
[10] Octavia A. Dobre et al., “Blind Modulation Classification: A Concept Whose Time Has Come”, Course online material:
http://ntrg.cs.tcd.ie/en/TCD_VT_Course_Cognitive_Radios_and_Networks/Week%204/Readings%20and%20discussion%20Q
uestions/dobre2005.pdf
[11] S. Ghosh, A. Basak and S. Bhunia, "How Secure Are Printed Circuit Boards Against Trojan Attacks?," in IEEE Design &
Test, vol. 32, no. 2, pp. 7-16, April 2015.
[12] Chrsitian Krieg, Clifford Wolf, and Axel Jantsch. Malicious LUT: A stealthy FPGA trojan injected and triggered by the
design flow. In Proceedings of the International Conference on Computer Aided Design (ICCAD), Austin, Texas, November
2016.
47

Thank You

E. Cottais, C.Kasmi & J.Lopes Esteves
QUESTIONS ?
Emmanuel COTTAIS, emmanuel.cottais@ssi.gouv.fr
Chaouki KASMI, chaouki.kasmi@ssi.gouv.fr
Jose LOPES ESTEVES, jose.lopes-esteves@ssi.gouv.fr
49

E. Cottais, C.Kasmi & J.Lopes Esteves
AMPLITUDE-BASED EXFILTRATION
50
Simulation results
α=±0,1
β=±0,1
Freq. legit = 500Hz
Freq. α = 100Hz
Freq. β = 100Hz
Received constellation