[Paper Review] New Covert Channels in HTTP

Matthias Bauer|ArXiv.org|Apr 26, 2004

Internet Traffic Analysis and Secure E-voting1 references5 citations

TL;DR

This paper proposes a novel covert communication protocol that leverages HTTP traffic from unwitting web browsers to create an anonymous overlay network, significantly enlarging the anonymity set beyond just senders and receivers. By embedding messages within benign HTTP transactions and using universal re-encryption, the protocol achieves unobservability, making it indistinguishable from regular web traffic even to a global passive observer.

ABSTRACT

This paper presents new methods enabling anonymous communication on the Internet. We describe a new protocol that allows us to create an anonymous overlay network by exploiting the web browsing activities of regular users. We show that the overlay network provides an anonymity set greater than the set of senders and receivers in a realistic threat model. In particular, the protocol provides unobservability in our threat model.

Motivation & Objective

• Address the limitation of existing mix networks, where passive adversaries can de-anonymize users through traffic analysis due to sparse participation.
• Overcome the problem of limited anonymity sets in Chaumian mix networks by incorporating non-participating web users as cover traffic sources.
• Develop a practical protocol that enables unobservable communication by hiding messages within normal HTTP traffic patterns.
• Ensure that the protocol remains secure and undetectable even to adversaries inspecting full packet payloads or application-layer headers.
• Explore the feasibility of using existing web infrastructure—like IFRAMEs and cookies— to transport covert messages without altering user behavior.

Proposed method

• Exploit the widespread use of HTTP as a cover protocol, leveraging the fact that it constitutes the majority of internet traffic.
• Embed covert messages within HTTP request and response bodies using CGI scripts or IFRAME-based data exfiltration techniques.
• Use universal re-encryption (e.g., El-Gamal-based) to transform encrypted messages at each hop, ensuring that repeated messages appear different and are indistinguishable from random data.
• Integrate JavaScript and Java applets in browsers to perform re-encryption operations client-side, enabling end-to-end message forwarding without requiring users to run mix nodes.
• Leverage web linkers and advertising networks to distribute nodes and maintain persistent communication channels.
• Apply pooling and batching strategies to mask message timing and prevent Trickle-style timing attacks based on user behavior.

Experimental results

Research questions

• RQ1 Can non-participating web users be effectively used as cover traffic providers to expand the anonymity set in a mix network?
• RQ2 Is it possible to achieve unobservability—where an observer cannot detect whether any communication is occurring—by hiding messages within HTTP traffic?
• RQ3 How can universal re-encryption be used to prevent traffic analysis attacks such as message repetition or timing correlation?
• RQ4 What are the practical limitations of relying on web surfers’ behavior and website maintainers’ cooperation for message delivery?
• RQ5 Can existing web technologies like IFRAMEs and cookies be repurposed to transport covert messages without raising suspicion?

Key findings

• The anonymity set is expanded to include not only senders and receivers but also unwitting web users generating normal HTTP traffic, significantly increasing resistance to traffic analysis.
• By using universal re-encryption, repeated messages are transformed into distinct ciphertexts, preventing pattern-based correlation attacks by passive observers.
• The protocol achieves unobservability: an adversary cannot distinguish between real messages, random noise, or legitimate HTTP traffic, even when inspecting full packet payloads.
• The use of JavaScript and Java applets enables client-side re-encryption and message forwarding, allowing the protocol to function without requiring users to operate mix nodes.
• The protocol remains undetectable to global passive observers who inspect headers and payloads, as long as universal re-encryption is applied and message patterns are randomized.
• Practical deployment is feasible through integration with existing web infrastructure such as advertising networks, which already use IFRAMEs and cookies for data transmission.