# HTML5 Zero Configuration Covert Channels: Security Risks and Challenges

## Full Text

This Markdown is an automated text extraction for search and reading tools. The [hosted PDF](HTML5ZeroConfigurationCovertChannels.pdf) is the authoritative publication source.

Source PDF: [HTML5ZeroConfigurationCovertChannels.pdf](HTML5ZeroConfigurationCovertChannels.pdf)
Source SHA-256: `6bf64dde48d70221f28e524d79bdab35f5d3ac7c281e926fb88b4c3e1fe91e9d`
Generated with `pdftotext -nopgbrk`; formatting and reading order may differ from the PDF.

---

HTML 5 Zero Conguration Covert Channels: Security ...

2015 CDFSL Proceedings

HTML5 ZERO CONFIGURATION COVERT
CHANNELS: SECURITY RISKS AND CHALLENGES
Jason Farina

Mark Scanlon
Nhien-An Le-Khac

Stephen Kohlmann
Tahar Kechadi

School of Computer Science & Informatics,
University College Dublin, Ireland.
{jason.farina, stephen.kohlmann}@ucdconnect.ie, {mark.scanlon, an.lekhac, tahar.kechadi}@ucd.ie

ABSTRACT
In recent months there has been an increase in the popularity and public awareness of secure,
cloudless le transfer systems. The aim of these services is to facilitate the secure transfer of les
in a peer-to-peer (P2P) fashion over the Internet without the need for centralized authentication
or storage. These services can take the form of client installed applications or entirely web browser
based interfaces. Due to their P2P nature, there is generally no limit to the le sizes involved or to
the volume of data transmitted  and where these limitations do exist they will be purely reliant on
the capacities of the systems at either end of the transfer. By default, many of these services provide
seamless, end-to-end encryption to their users. The cybersecurity and cyberforensic consequences
of the potential criminal use of such services are signicant. The ability to easily transfer encrypted
data over the Internet opens up a range of opportunities for illegal use to cybercriminals requiring
minimal technical know-how.

This paper explores a number of these services and provides an

analysis of the risks they pose to corporate and governmental security. A number of methods for
the forensic investigation of such transfers are discussed.

Keywords
1.

: Covert Transfers, Encrypted Data Transmission, Counter-forensics

INTRODUCTION

tion being intercepted or duplicated and their
data being downloaded by others.

Regarding

For the typical home user, sending anything

the security of their data stored on this third-

larger than a single image or document elec-

party provider, users must blindly trust this

tronically is still a cumbersome task when re-

third-party to not access or share their data with

liant on popular online communication meth-

any unauthorized party.

ods.

Most email providers will limit the le

While the requirement to send larger volumes

size of attachments to something in the order of

of information over the Internet is ever increas-

megabytes and many will additionally restrict

ing, the potential for third-party interception, or

le types such as executables or password pro-

illicit access to, this data has become a common

tected archives based on internal security poli-

story in the general media.

cies. Sending larger les usually requires users

whistle-blowers regarding the degree of surveil-

to upload the content to third party storage

lance conducted by large government funded

providers, e.g., Dropbox, OneDrive, Box.net,

spying agencies on everyday citizens has pushed

etc., and provide a link to the content to their

the topic of cybersecurity into the public realm.

intended recipients. From a security standpoint,

Increasingly, Internet users are becoming con-

this leaves user vulnerable to their communica-

scious of their personal responsibility in the pro-

© 2015 ADFSL

Recent leaks from

Page 135

2015 CDFSL Proceedings

HTML 5 Zero Conguration Covert Channels: Security ...

1.1 Contribution of this work

tection of their digital information. This results
in many users being discontent with their personal data stored on these third party servers 
likely stored in another jurisdiction with privacy
requirements much lower than those of their own
locale.

For many, the topic of covert channels immediately brings to mind some form of steganography likely in combination with an Internet
anonymizing service, such as Tor and I2P. While
some

work

has

been

conducted

on

the

re-

verse engineering/evidence gathering of these
To respond to this demand a number of le

anonymizing P2P proxy services, little work has

exchange/transfer services have grown in pop-

been done in the area of online services provid-

ularity in recent months facilitating the secure

ing end users with the ability to securely and

transfer of les in a peer-to-peer (P2P) fashion

covertly transfer information from peer to peer

from point A to point B. Most of these services

in an largely undetectable manner.

aord the user encrypted end-to-end le trans-

presented as part of this paper examines a num-

fer and add an additional level of anonymity

ber of popular client application and web based

compared to regular le transfer services, e.g.,

services, outlines their functionality, discusses

email attachments, FTP or instant message le-

the forensic consequences and proposes a num-

sharing. The more security concerned users will

ber methods for potentially retrieving evidence

opt for the cloudless versions of these services.

from these services.

This work

This independent control over personal informa-

2.

tion has advantages and disadvantages for the
end user.

The advantage is that the user has

BACKGROUND
READING

precise knowledge over who has initial access to
his/her information and what country the data

The technology used to facilitate covert le

is stored in.

The downside comes in terms of

transfers is not new, however, until recently such

The data stored or transferred us-

measures were deemed too complex to be con-

ing these services is only available if at least one

sidered of benet to the average user. Mainte-

host storing the le is online.

nance of FTP servers, dynamic DNS for pub-

reliability.

lic IP based system shares and management of
public/private keypairs for SSH are not tasks
As with most security or privacy enhanc-

a non-technical individual can accomplish with-

ing Internet services, these services are open

out technical assistance or a very thorough how-

to abuse by cybercriminals.

to guide.

In eect, the ad-

The current transfer options, while

ditional level of anonymity and security pro-

easy to implement and in some cases, completely

vided by these services provides cybercriminals

transparent to the user, can all be found to have

with o-the-shelf  counter-forensic capabilities

a more complex root in one of the following

for information exchange.

methods or techniques.

Cybercriminal ac-

tivities such as data exltration, the distribution of illicit images of children, piracy, indus-

2.1 Anonymizing Services

trial espionage, malicious software distribution,

Today there are many anonymizing services

and can all potentially be facilitated by the

available for communication and data trans-

use of these services.

fer.

The ad hoc nature and

The popular anonymous browser Tor al-

mainstream protocol features of some of these

lows users to explore the Internet without the

services make secure detection and prevention

risk of their location or identity becoming known

problematic without causing disruption to nor-

[Loesing et al., 2010]. The Tails operating sys-

mal Internet usage.

This also causes forensic

tem which works in conjunction with Tor oers

event reconstruction diculties as any traces

an extra layer of anonymity over traditional op-

have a high degree of volatility when compared

erating systems. When a user is operating Tails

to more traditional le transfer options.

all connections are forced to go through the Tor

Page 136

© 2015 ADFSL

HTML 5 Zero Conguration Covert Channels: Security ...

network and cryptographic tools are used to encrypt the users data. The operating system will
leave no trace of any activity unless explicitly
dened by the user to do so.

2015 CDFSL Proceedings

2.2 Decentralized Osite Data
Storage
The MAIDSafe network is a P2P storage facility
that allows members to engage in a data stor-

The Invisible Internet Project, also known as

age exchange. Each member of the network en-

I2P is another anonymous service similar to Tor.

ables the use of a portion of their local hard

As I2P is designed as an anonymous network

drive by other members of the network. In re-

layer which will allow users to utilize their own

turn the member is given the use of an equiv-

applications across the network. Unlike Tor cir-

alent amount of storage distributed across the

cuits the I2P network trac utilises multiple

network and replicated to multiple locations re-

layers of encryption and an addressing system

ferred to as Vaults. This allows the authorized

not based on IP or ISP to provide anonymity.

member access from any location and resilience

This process decouples a user's online identity

should a portion of the network not be active

and physical location [Timpanaro et al., 2014].

at any time.

I2P also groups network messages together in

is deduplicated and replicated in real time with

irregular groupings for encryption to discourage

le signatures to ensure integrity.

network trac analysis.

the data is encrypted allowing secure storage on

Like Tor, I2P allows

All data stored on the network
In addition

for passage through its network to a server or

untrusted remote systems.

service not hosted within its area of inuence.

is managed through a two factor authentication

This is managed through the use of Outprox-

process involving a password and pin combina-

ies which perform the same function as Tor exit

tion.

nodes.

centivized through SafeCoin, a cryptocurrency

Both Tor and I2P provide anonymity to the
user with an open network of onion routers in
the case of Tor and Garlic routing in the case
of I2P. These networks of routers are run by

Authorized access

The use of the MAIDSafe network is in-

that members can earn by renting out space or
providing resources such as bandwidth for le
transfers.

Other users can earn SafeCoins by

participating in development of the protocol.

The result of this network growth

2.3 Data Exltration through
Standard File Transfer Channels

is an increase in anonymity and privacy for

Data exltration refers to the unauthorized ac-

each individual user [Herrmann and Grotho,

cess to otherwise condential, proprietary or

2011].

sensitive information.

participating volunteers and it is continually
growing.

However these services are not without

Giani et al. [2006] out-

drawbacks such as a severe reduction in net-

lines a number of data exltration methods in-

work throughput resulting in much slower access

cluding most regular le transfer methods for

speeds (though I2P has greater reported perfor-

inside man attacks, e.g, HTTP, FTP, SSH and

mance than Tor, in particular for P2P down-

email, and external attacks including social en-

loading protocols but it has fewer Outproxies

gineering, botnets, privilege escalation and root-

than Tor has exit nodes resulting in a lesser de-

kit facilitated access. Detection of most of these

gree of anonymization).

Many software pack-

methods is possible using a combination of re-

ages (those not SOCKS aware in the case of

walls and network intrusion detection systems

Tor) are not designed to correctly route through

or deep packet inspection [Liu et al., 2009, Sohn

these services and will instead provide informa-

et al., 2003, Cabuk et al., 2009].

tion that will potentially reveal the identity of
response trac to be delivered to. For the end

2.4 File Delivery Services Built on
Anonymizing Networks

user, there is also the issue of adding yet an-

OnionShare is a le sharing application that

other step to the already technical task they nd

leverages the anonymity of Tor to provide se-

themselves performing.

cure le transfers for its users.

the user such as the local, true, IP address for

© 2015 ADFSL

File transfers

Page 137

2015 CDFSL Proceedings

HTML 5 Zero Conguration Covert Channels: Security ...

are direct from uploader to recipient though

link is no longer considered valid and all in-

both users utilize the Tor browser to participate.

coming URLs with the same le signature

OnionShare itself is a python based application

are refused.

that sets up a le share on the local system as a
limited web server. This web server is then ad-

This combination of time and availability in

vertised as a Tor Hidden Service using the built

conjunction with the anonymity of Tor makes

in functionality of the Tor browser. The appli-

OnionShare trac extremely dicult to analyze

cation uses random data to generate a 16 char-

eectively.

acter onion address and more random data to

link is already invalidated. Similarly, if the le

generate a unique name for the le being shared

is discovered on a local lesystem by an investi-

to use as a reference for.

gator any trace of the once o connection to the

The process used by OnionShare is as follows:

If the trac is observed then the

download point, if not already lost from local
connection logs or memory, will only lead to a

1. Uploader starts Tor Browser to provide an
entry point for OnionShare to the Tor net-

Tor entry point and not to the actual source of
the le.

work.
OnionShare is started and a temporary di-

3.

INVESTIGATIVE

rectory is created in the users' default temp
folder.

TECHNIQUES

All randomly generated names in

OnionShare follow the same procedure:

While no work targeted specically at forensic investigation of these zero conguration ser-

(a) A number of random bytes are gener-

vices has been published at the time of writ-

ated using os.random. 8 are generated

ing, there are a number of digital evidence ac-

for a directory/host name and 16 for

quisition methods published for related services.

the lename "slug" used to generate

There has , however, been security focused work

the le portion of the share URL

published on HTML5 additions including an

(b) These random bytes are SHA-256 and

analysis of the

webstore and localstore in-

the rightmost 16 characters of the re-

troduced in this version of the protocol such as

sulting hash are carved

that produced by Bogaard and Parody [2012].

(c) h is then Base32 encoded, all characters are converted to lower case and
any trailing `=' signs are removed
2. The result is then used as a URL using the
format <host>.onion/<fileID> and this is
the url the Tor browser advertises to the
introduction nodes and registers on DHT.

This section outlines a number of related investigation techniques and analyses their relevancy
to the forensic recovery of evidence from covert
le transfer services.

3.1 Cloud Storage Forensics
Forensics of cloud storage utilities can prove
challenging,
[2012a].

3. The uploader then sends the URL to the

as

presented

by

Chung

et

al.

The diculty arises because, unless

complete local synchronization has been per-

downloader who must use the URL within

formed,

a timeframe (24 hours by default) or the

ous distributed locations. For example, it may

signature of the le HS timestamp will not

only reside in temporary local les,

match, a process controlled by the ItsDan-

storage (such as the system's RAM) or dis-

gerous library for python.

In addition to

persed across multiple datacenters of the ser-

this time limit, OnionShare also utilizes a

vice provider's cloud storage facility. Any digi-

download counter which has a default value

tal forensic examination of these systems must

of 1.

Once the number of downloads suc-

pay particular attention to the method of ac-

cessfully initiated matches this counter, the

cess, usually the Internet browser connecting

Page 138

the data can be stored across varivolatile

© 2015 ADFSL

HTML 5 Zero Conguration Covert Channels: Security ...

2015 CDFSL Proceedings

to the service provider's storage access page

umes of trac involved. One approach to over-

(https://www.dropbox.com/login for Dropbox

come the massive volume of network data to pro-

for example).

This temporary access serves to

cess is to simply record every packet sent and re-

highlight the importance of live forensic tech-

ceived from the Internet, in the similar manner

niques when investigating a suspect machine

to the tactic employed in the case outlined by

as a pull out the plug anti-forensic technique

Garnkel [2002]. This would facilitate an after-

would not only lose access to any currently

the-fact reconstruction of any data breaches to

opened documents but may also lose any cur-

aid in determining precisely what was compro-

rently stored sessions or other authentication to-

mised.

kens that are stored in RAM.
Martini and Choo [2013] published the results

3.3 Deep-Web Forensics

of a cloud storage forensics investigation on the

Although Tor and I2P are designed for users to

ownCloud service from both the perspective of

communicate and transfer data on the Internet

the client and the server elements of the service.

anonymously it is still viable and possible for

They found that artifacts were found on both

investigators to gather user specic information.

the client machine and on the server facilitat-

The process of an investigation into the Tor net-

ing the identication of les stored by dierent

work requires advanced digital forensic knowl-

users. The module client application was found

edge as traditional investigation methods used

to store authentication and le metadata relat-

for standard networks fail to heed the desired

ing to les stored on the device itself and on

results. Loesing et al. [2010] published a study

les only stored on the server. Using the client

measuring statistical data in the Tor network.

artifacts, the authors were able to decrypt the

The study is weighted towards protecting the

associated les stored on the server instance.

users anonymity while using Tor but nonetheless
shows that it is technically possible to gather

3.2 Network Forensics

data on Tor users by setting up a Tor relay and

Network Forensic Analysis Tools (NFATs) are

logging all relayed user trac.

designed to work alongside traditional network

When users install Tor the software rst con-

security practices, i.e., intrusion detection sys-

nects to one of the directory authorities. The di-

tems (IDSs) and rewalls. They preserve a long

rectory authorities are operated by trusted indi-

term record of network trac and facilitates

viduals of Tor and from these authorities the Tor

quick analysis of any identied issues [Corey

software downloads the list of currently available

et al., 2002].

Tor nodes.

Most rewalls allow HTTP and

These nodes are relay servers that

HTTPS trac through to allow users behind

are run by volunteers of Tor.

the rewall to have access to regular web ser-

then selects three nodes from those available

The Tor client

vices which operate over these protocols. With

and builds an encrypted channel to the entry

regards to the web based covert le transfer

node. An encrypted channel is then built from

services (outlined in detail in Section4 below),

the entry node to the middle node, and lastly

blocking network trac to these systems would

this channel connects to the exit node.

require the maintenance of a comprehensive re-

Blond et al. [2011] demonstrated the results

wall list of such servers to ensure no unautho-

of an attack on the Tor anonymity network that

rized data exltration. NFATs collecting this in-

revealed 10,000 IP addresses over 23 days. The

formation will only have the ability to capture

authors used the attack to obtain the IP ad-

the encrypted packets, their destination and as-

dresses of BitTorrent users on Tor. The study

sociated metadata.

Identifying precisely what

found that 72% of users were specically us-

has been transferred will likely prove impossible

ing Tor to connect to the tracker. The authors

for network administrators.

launched their attacks through six instrumented
network

Tor exit nodes resulting in 9 percent of all Tor

forensics is dealing real-time with the large vol-

streams being traced. Moreover, the paper anal-

The

issue

with

© 2015 ADFSL

always-on

active

Page 139

2015 CDFSL Proceedings

HTML 5 Zero Conguration Covert Channels: Security ...

yses the type of content discovered in the attack
culminating in the result that the existence of
an underground BitTorrent ecosystem existing
on Tor is plausible. Alongside these attacks Tor
users were also proled.

Using BitTorrent as

the insecure application they hijacked the statistical properties of the DHT and the tracker
responses.

4.

EVOLUTION OF HTML5

POWERED COVERT FILE
TRANSFER SERVICES
While services like Onionshare provide a method
of le transfer that is dicult to investigate due
to its limited lifespan and shifting end points, it
still requires software installation and additional
support services in the form of the Tor Browser.
These requirements allow for several methods of
access control such as a security policy blocking local services attempting to communicate
on port 9159 and 9051, the default Tor Con-

Figure 1: The Basic HTML5 Data Transfer Pro-

trol Ports. On an application level local, group

cess

or layer 7 rewall policies can block tor.exe or
onionshare.py based on path or le hash without undue interruption to normal user network
usage.

4.1 Basic HTML5 File Transfer
Basic HTML5 File transfer as depicted in Figure 1 is accomplished using native browser APIs
that allow a user to utilize a data

transfer ob-

ject. This object consists of a customizable array of key:value pairs that represent a group of
le objects. This associative array is then accessible by client side scripts run from a web page
or web application. These scripts must rst be
downloaded and allowed to run by the local user
(this depends on the trust setting for the website being visited). Any element can be added
to the array through a Drag and Drop (DnD)

 move:

An item may be moved to a new

location.

 link:

A link may be established to the

source at the new location.

 copyLink: A copy or link operation is permitted.

 copyMove:

A copy or move operation is

permitted.

 linkMove: A link or move operation is permitted.

 all: All operations are permitted.
 none: The item may not be dropped

functionality or les can be added though a le

if the element added to the array is a le

browser interface. The actions available by de-

then the element is passed to a FileReader ob-

fault are:

ject that copies the data contained in the le

 copy:

to localstorage or session
A copy of the source item may be

made at the new location.

Page 140

storage depend-

ing on the settings of the web application. Local Storage is shared across all browser sessions

© 2015 ADFSL

HTML 5 Zero Conguration Covert Channels: Security ...

2015 CDFSL Proceedings

currently active, session storage is only available to the owning application or window (for
browsers with multiple tabs or windows). This
local/session storage behaves very similarly to
the standard cookie storage but with hugely increased capacity.

( 5MB for Chrome, Firefox

and Opera, 10MB for Internet Explorer - DnD
native is only available in version 9+ of IE web storage in version 8+, and 25MB for Blackberry).
For basic data transfer, the Filereader reads
the entire le indicated into RAM for processing. Once stored in web storage a le can only be

Figure 2:

accessed by local actions that have permission

SRTP

Traditional VOIP Data vs DTLS-

to access that web storage area such as client
side scripts downloaded from the controlling web
page or session. These scripts can use any scripting language but usually JQuery, JavaScript or

lays that form the path between the source and
destination.

AJAX. The local client can also call scripts to

In Figure 2, the standard VOIP method of

run on the remote server in order to pass vari-

communication is displayed alongside the newer

ables or prepare for the establishment of addi-

WebRTC method. Both systems start with es-

tional sessions are required.

tablishing a signaling and control path to handle

4.2 Cryptographically enhanced
HTML5 data channels

non-sensitive data such as connection auditing

Following on from their acquisition of ON2 in

A and Client B involving relay through Relays

February 2010, Google continued to develop a

1 and 2. Unless the user fully trusts both relays

browser to browser data transfer protocol, which

and the security of the network path between

was made open source in 2011 when it was

each node on the network, there is a risk of

adopted by W3C as a standard for HTML5.

an adversary eavesdropping on the data stream

The protocol, which supported Real Time Com-

and either manipulating the content in transit

munication between browsers was released as

or capturing it for oine inspection.

packets. In VOIP, the data stream would follow
this established path and trac between Client

WebRTC 1.0, was developed to provide P2P
voice, video and data transfers between browsers
without an additional software requirements.

5.

ANALYSIS OF EXISTING
SERVICES

WebRTC, provides a collection of protocols and
methods as well as a group of codec libraries

Services such as those presented in Table 1 are

that can be accessed via a JavaScript API.

a sample set of HTML5 and WebRTC based le

WebRTC improved data transfer over the

transfer utilities.

While at rst glance many

standard HTML5 script based method by in-

of these applications appear to be homogenous

troducing data integrity, source authentication

closer examination shows important dierences

and end to end encryption. This is accomplished

in both capabilities and requirements.

through the use of Datagram Transport Layer

services listed, only Sharefest and JustBeamIt

Security (DTLS) Modadugu and Rescorla [2004]

allow usage without local installation or some

extension to handle key exchange for the Secure

form of authentication.

Real-time Transport Protocol (SRTP). The use

is based on basic HTML5 le transfer while

of DTLS-SRTP diers from standard VOIP en-

Sharefest

cryption by removing the need to trust SIP re-

purports to oer persistent storage, it does so

© 2015 ADFSL

utilizes

Of the

Of these, JustBeamIt

WebRTC.

While

Sharefest

Page 141

Sharefest
JustBeamIt
Transfer Big Files
Innit
Any Send
Rejetto
QikShare

Anonym
ity
Mobile
Compa
tibility
Persist
ent Sto
rage
Relay S
erver

tion Op
tion

7
7
3
3
3
3
3

3
7
3
3
3
7
7

Applica

Service Name

sed
3
3
3
3
3
7
3

Encryp
ted Tra
nsfer

Registr
ation R
equired

HTML 5 Zero Conguration Covert Channels: Security ...

HTML
Ba

2015 CDFSL Proceedings

7
7
7
3
3
3
7

7
7
7
7
7
7
7

7
3
3
7
3
7
3

3
7
3
3
3
3
3

3
7
3
3
7
3
3

Table 1: Comparison of Browser Based Transfer Services

by virtue of its distributed organization. Storage is only available as long as at least one share
member is online. While many of the services do
not provide encrypted le transfer, the threat
posed lies in the fact that any illegal or illicit
data transfer can be dicult, if not impossible,
to dierentiate from standard web trac.

5.1 HTML5 Enabled Peer-to-Peer
Transfer
This section examines a number of HTML5 enabled P2P transfer sites and describes their operation.

5.2 Sharefest
Sharefest.me

is

a

le-sharing

Figure 3: Sharefest P2P Mesh over WebRTC
one-to-many

based website that aims to dynamically generate and maintain le-sharing swarms by connecting peers that are interested in sharing the

beyond a WebRTC capable browser.
As depicted in Figure 3, the Sharefest pro-

same data. Like the BitTorrent protocol, multi-

cess is quite straightforward in design.

ple peers are utilized simultaneously to transfer

sharefest.me server acts as a transfer control

portions of the data thus increasing download

server that records all les being oered for shar-

speeds by avoiding the bottleneck that is the

ing and matches the resource to the client sys-

lower upload speed of a standard ADSL Internet

tem request.

connection. In order to achieve this, Sharefest

A has a complete le that it wants to share.

is built on Peer5's (https://peer5.com/) plat-

Client A connects to the Sharefest server at

The

In the scenario depicted, Client

form for a distributed Internet, a P2P data

https://www.sharefest.me/ over port 443 and

transfer mesh network that utilizes the capabil-

negotiate TLS1.2 where possible using SPDY if

ities of the browser without additional plugins

available for web content transfer. Given a full

Page 142

© 2015 ADFSL

HTML 5 Zero Conguration Covert Channels: Security ...

2015 CDFSL Proceedings

range of options the Sharefest server negotiates

Sharefest server and the peers throughout the

the use of the ECDHE-ECDSA with AES 128

exchange.

and GCM 256. As required by the IETF RFC

Sharefest is an example of P2P privacy in a

4492 (http://tools.ietf.org/html/rfc449),

distributed network ensuring that data can be

the Sharefest server passes the curve details as

transferred without risk of interception.

part of its serverkeyexchange packet.

level of privacy comes at a cost though as the

This

Once a secure path is established the server

ability of IT security to inspect the trac is

delivers a small set of helper scripts to the client:

greatly diminished with the level of encryption
in use at all stages of the transfer. Packet anal-

 les.js : a script to gather le details from

ysis can detect the IP addresses in use but without access to the key to decrypt the trac the

the client

content being transferred is extremely dicult

 ui.js : a script to control the update and

to determine. One option available to network

display of the le management interface on

admins is to block the use of the sharefest.me

the page.

service by blacklisting the URL. This would
have the eect of preventing casual usage of

Once a le has been selected for sharing the

the service but the source for Sharefest is pub-

Sharefest server assigns a code value in the form

licly available on Github https://github.com/

of a URL such as https://www.sharefest.me/

Peer5/Sharefest along with instruction and

67509cb244257b6643540dda512f8171

where

support for installation of a personal server.

the

is

the

Peer5 also provide the API key for free to any-

The SwarmID has 32

one interested in the code. This means that any

number

after

the

swarmID for this le.

domain

name

characters but is not based on the MD5 of the

IP or URL could become a Sharefest server.

le, instead it appears to be derived from the

One method of detecting the use of this ap-

Sharefest crypto.js script which incorporates

plication is the STUN trac generated once

SHA3 in a lengthy calculation. The swarmID is

a peer is identied and connection is initi-

deterministic meaning that any client sharing

ated. In testing an average of 5 STUN negoti-

the

ation/conrmation exchanges were recorded ev-

same

le

will

identied

with

the

same

swarmID.

ery second depending on the level of le trans-

Once clients oering and requesting the same

fer data passing between the peers.

This level

le or le set are identied the Sharefest server

of noise would make the user of Sharefest rel-

acts as a central trac control and initiates a

atively easy to discover and no eort is made to

STUN connection directly between the partic-

obfuscate the communicating peers.

ipating clients.

In Figure 3, Clients A, C and

In

an

attempt

to

determine

if

this

lack

D are all participating in the swarm for File 1,

of anonymization could be overcome, we at-

but Client B is not involved.

The STUN con-

tempted to run Sharefest through a Tor cir-

nection consists of each pair of clients issuing

cuit but both transfer utilities (JustBeamIt and

BIND requests from uploader to downloader us-

Sharefest) failed to complete the initial negotia-

ing STUN over UDP which allows each host to

tion with the relevant server.

discover its own public facing IP address in or-

using Tor Browser installed on a Windows 7

der to create end to end connections through a

VMWare image. A possible alternative may be

NAT gateway or rewall. Each BIND / Conrm

to attempt the use of a SOCKS aware proxy to

pair is re-issued on a regular, short, interval to

direct the trac to and from the application.

ensure the connection remains intact. Once the

Alternatively a server running Sharefest could

STUN session is active the two peers negotiate

be adapted to run as a Tor Service but this

a WebRTC session and switch over to the proto-

would not alleviate the lack of privacy experi-

col's encryption. ACK and STUN conrmation

enced once data transfer was initiated between

messages continue to be sent to and from the

peers.

© 2015 ADFSL

This was tested

Page 143

2015 CDFSL Proceedings

HTML 5 Zero Conguration Covert Channels: Security ...

5.3 Transfer Big Files
Transfer

Big

les

and

drop

transfer

of

https://

(TBF)

www.transferbigfiles.com/
les

It is worth noting that while this transfer ser-

oers
with

drag

size

limits

dependant on the user's account type.

At the

most basic free account level, the limit is 100mb
per le totalling up to 20gb of les awaiting
transfer at any one time. Files are held by the
server for a default of 5 days before they are

vice is just standard HTTPS and so will be discovered by standard forensic practices, if the
username and password can be recovered, the
site's account activity summary contains a full
activity log of all les uploaded including when
the transfer was started and when the recipient collected the le as well as the recipient's
account name.

5.4 JustBeamIt

removed. While this service does oer HTML5
drag and drop upload capability, it is not a true
P2P application in that it does not transfer
directly from one local peer to one or more
remote peers. Some features of TBF include:

An example of a basic HTML5 transfer application is the le transfer service oered at http://

www.justbeamit.com.

The sending user con-

nects to the server over port

 senders must have an account to avail of

8080 (alternate

HTTP port) and performs a standard TCP

the service. This account requires a name,

handshake followed by a series of HTTP

email address and a password though of

quests for client side JavaScripts.

note, there is no verication of any of these
elds

 Recipients can either have their own account or can be sent a shortened URL alias
link with the domain tbf.me and a short

 JustBeamIt.js - the base script that sets up
the variables and denes the communication functions

 BrowserDetectUtility.js - determines if the
user browser can properly support HTML5

code for the le itself

 The

GET re-

data transfers
initial

DNS

lookup

for

Transferaddress

 FileHandler.js - manages the transfer to

69.174.247.183 - a server hosted in the US

and from the le array. Handles the array

bigles.com

resolves

to

an

IP

 This account server negotiates TLS 1.0 as
part of the initial handshake

 File

upload

prompts

DNS

lookup

of

0storageuk4.transferbigles.com

and

1storageuk4.transferbigles.com

which

both resolve to 83.222.233.155 (a server
group hosted in the UK)

is emptied.

 UploadManager.js - denes the drag and
drop actions and denes the landing zone

 UploadHandler.js - Determines if the Client
needs to use XMLHttpRequest (XHR) or
FORM based uploading and generates the

 once uploaded the les remain on the storage servers until picked up by the receipient
who must be notied separately

group

QRCode.

 UploadHandler.XHR.js

and

UploadHan-

dler.FORM.js - the actual uploading scripts

 File download is performed from one of the
tbfuk4.transferbigles.com

reset and webpage notications if the array

servers

over standard HTTPS.

 TBF also oers an application and a command line client with enhanced capabilities

There is an option to drag and drop a le into
the browser but in this instance the le browser
is used to select a le from the local user pictures
folder. Once selected the button Create Link
is clicked and the link http://www.justbeamit

over the browser based interface but this is

.com/di33x is created along with a QRCode for

beyond the scope of this paper

mobile use.

Page 144

This link can copied and sent to

© 2015 ADFSL

HTML 5 Zero Conguration Covert Channels: Security ...

the receiving system, in the meantime the lo-

2015 CDFSL Proceedings

load.

cal client is redirected to a relay server URL

5.5 Any Send

for the upload itself (http://b1.justbeamit

.com/.

On the remote system, the URL is

pasted into a browser and the system and the remote client loads http://www.justbeamit.com
and immediately requests the download token
for the le ID di33x and downloads and runs the
set of JavaScripts. The server passes along the
token along with the current download status
(upload waiting) and the le descriptor (name,
size, extension). Once the remote user clicks on
the link to download the browser is redirected

http://b1.justbeamit.com where the le

to

transfer is performed.

Once complete the lo-

cal user is notied that the transfer has been
successful. The token used to download is now
invalidated and a new link must be generated if
the le is to be shared again. Similarly, there is
a 1000 second timeout period during which the
shared le must be downloaded before the opportunity expires and a new share token must
be generated.
While this method of le transfer provides
ease of use to the end user, all transfers are performed via unencrypted trac. The data being
transferred is susceptible to any form of eavesdropping capable of detecting trac on any network segment the trac passes through.

The

open nature of the transfer and the client side
execution of scripts (as well as the open exchange of tokens) allow for trivial man-in-the-

Any Send http://www.anysend.com/ is a web
based le transfer utility that oers a pure
web based alternative to its own downloadable application.

The web page anysend.com

resolves to a set of four IP addresses divided
between

Utah

and

to clickmein.com.

Texas

and

all

registered

The webpage consists of a

large background image and a single dropzone
for les to be sent.

On dropping a le, the

background javascript helpers manage the le
upload to their servers.

Once uploaded the

user is presented with a URL to send to the
recipient.

The URL is comprised of the any-

send.com domain and a le identier generated
by the server (a 32 character string). Once the
recipient enters the URL into a browser they
are taken to an anysend.com page with details
of the le corresponding to the leID part of
the URL used.

From here it is a standard

HTTPS download from the anysend servers
and the download URL will reect the anysend
server url as well as the full lename of the le
with the term %20via%20AnySend.exe

ap-

http://www.anysend.com/dl.php
?data=7f234e0920d8424833f97d3ab9380883\
...\&fn=orientdb-community-2.0.4\
%20via\%20AnySend.exe\&packageID=
ED59EE58A0380BBDB197A88F8290BDDE
pended. eg:

middle (MITM) attacks where an adversary capable of eavesdropping can use a proxy or other
interception utility to alter the packets in transit.

One possible scenario would be the sub-

6.

FORENSIC

CONSEQUENCES OF

stitution of a harmless UploadManager.js script

UNTRACEABLE FILE

for something less benign as identied by Jang-

TRANSFER

Jaccard Jang-Jaccard and Nepal [2014] as a rising risk or, even exchanging the generated down-

The facilitation of untraceable or anonymous

load token for one that leads to a virus or other

le exchange can lead to a number of potential

form of malware.

malicious use cases.

For each of the scenarios

From a security standpoint, defense against

outlined below, an added dimension can be cre-

the use of this service is quite straightforward.

ated by the originator of the content: time. Due

Because of the application's use of a centralized

to the ability to create one-time or temporary

set of servers, a standard rewall rule to block

access to any piece of content, the timeframe

access to http://*.justbeamit.com would pre-

where evidence may be recovered from remote

vent any upload but also any attempt to down-

sharing peers might be very short.

© 2015 ADFSL

Page 145

2015 CDFSL Proceedings

HTML 5 Zero Conguration Covert Channels: Security ...

6.1 Cybercriminal Community
Backup
Unmonitored covert transfer could be used to
create a share and share alike model for the remote encrypted backup of illegal content. The
sharing of these backups onto multiple remote
machines eectively could provide the user with
a cloudless backup solution requiring minimal
trust with any remote users. The encryption of
the data before distribution to the community

culty in blocking HTTP based le transfers is
that the technology is likely used during regular employee Internet usage.

fers can be used when emailing le attachments
or adding items to content management system.

play should the remote nodes delete the information or it otherwise becoming unrecoverable.
Having a secure, encrypted connection to a remote backup might be desirable to cybercriminals enabling the use of a kill-switch to their
local storage devices should the need arise.

6.2 Secure Covert Messaging
For example, the proof of concept based on
the BitTorrent Sync Protocol found at http://

missiv.es/.

The application currently oper-

ates by saving messages to an outbox folder
in a synchronized share between peers that has
a read only key shared to the person you want
to receive the message. They in turn send you a
read only key to their outbox. One to many can
be achieved by sharing the read only key with
more than one person but no testing has been
done with synchronization timing issues yet and
key management may become an issue as a new
outbox would be needed for each private conversation required.

6.3 Industrial Espionage
Many companies are aware of the dangers of

One additional scenario where these ser-

vices could be used would be to transfer les
within a LAN and subsequent external exltration from a weaker/less monitored part of the
network, e.g., guest wireless access.

6.4 Piracy

can ensure that only the owner will ever have access to decrypt the data. Trust only comes into

HTTP trans-

Like any other P2P technology, the ability to
transfer les in a direct manner from peer to
peer lends itself well to the unauthorized distribution of copyrighted material. The sharing of
copyrighted multimedia, software, etc., between
peers using these covert services is less likely to
lead to prosecution compared with public piracy
on open le-sharing networks such as BitTorrent.

6.5 Alternative to Server Based
Website Hosting
This scenario involves the creation of static websites served through a shared archive.

These

websites could be directly viewed on each user's
local machine facilitating the easy distribution
of any illegal material. The local copies of the
website could receive updates from the webmaster through the extraction of archived updated
distributed in a similar manner as the original.

7.

POTENTIAL FORENSIC
INVESTIGATION
TECHNIQUES

allowing unmonitored trac on their networks.

Assuming access (physical or remote) can be ac-

However, quite often corporate IT departments

quired to either end of the le transfer, then a

enforce a blocking of P2P technologies through

live acquisition of the evidence should be attain-

protocol blocking rules on their perimeter re-

able. Performing evidence acquisition after the

walls.

This has the eect of cutting o any

fact would rely on traditional hard drive and

le-sharing clients installed on the LAN from

memory forensic techniques to see if any rem-

the outside world. In addition to Deep Packet

nants of the network communication remain.

Inspection (DPI) to investigate the data por-

The investigation of the unauthorized trans-

tion of a network packet passing the inspection

fer for information through one of these ser-

point, basic blocking of known IP address black-

vices without access to either end of the trans-

lists in rewall rulesets can be used. The di-

fer can prove extremely dicult.

Page 146

Assuming

© 2015 ADFSL

HTML 5 Zero Conguration Covert Channels: Security ...

through some external means, the precise date
and time of the transfer were discovered.

ployed.

The

only method available to law enforcement is to
eectively wiretap the transfer by running a
software or hardware based deep packet inspection tool on the network at either end of the
transfer.
To date there has been keen interest in research performed on the forensic examination
of le sharing utilities and the type of security
risks they pose. Chung et al. [2012b] outlined a
best practice approach to the investigation of le
sharing using cloud based Storage-as-a-Service
(StaaS) utilities such as Dropbox, iCloud and
OneDrive.

2015 CDFSL Proceedings

In 2014, Federici [2014] presented

Cloud Data Imager (CDI) a utility developed
to automate the retrieval of cloud based storage
artifacts from a suspect system and use these
credentials to access their secure storage online.
Scanlon et al. [2014] described a methodology that leveraged the processes used by persistent le synchronization services to ensure data
integrity to retrieve data that would otherwise
have been inaccessible. This could be as a result
of deliberate obfuscation such as encryption or
anti-forensic activities or it could be caused by
an error in the imaging process. The methodology presented utilized the need for synchronization group ongoing communication to enumerate remote peers and to identify any authorized
peers that could provide a forensically true copy
of the suspect data.
Emerging le transfer utilities, such as the
purely browser based le transfer utilities based
on WebRTC, do not advertise persistence of
availability nor integrity checking beyond the
initial transfer and in many cases are only associated for the length of time that both parties are online and in communication, directly or
otherwise. After this time, such as with Onionshare for example, the address of the le source
will change completely and no longer be available to any peer authorized or otherwise.
This ephemeral nature of data transfer can

8.

CONCLUSION

The evolution of online le transfer systems
is becoming more and more covert through
employing encryption-based, server less, P2P
protocols.

The development of HTML5 and

JavaScript based services proves particularly interesting from a digital forensic perspective. As
these technologies mature, a future can be easily envisioned whereby the investigation and evidence retrieval from these systems will prove
extremely dicult, if not entirely impossible.
Daisy-chaining a number of the technologies
outlined in this paper has the potential to enable
malicious users to securely transfer any desired
information to another user/machine without
arousing suspicions of system administrators.
Identifying the use of a HTTPS, browser-based
P2P le transfer with relatively small transfer
sizes might prove prohibitively dicult.

The

investigation of these transfers may prove cost
prohibitive in terms of both time and money for
law enforcement to comprehensively investigate
and mitigation of the risk by way of security
policies or hardware and software based rulesets
may come at a price in terms system usability
that will be deemed too high.

8.1 Future Work
As privacy becomes easier for the end user to
accomplish, the role of forensics will become all
that much harder as not even the low hanging fruit of browser history can be expected as
a starting point. Additionally, system security
will no longer be able to react as this may already be too late.

As a future developement

in forensics there is clear potential for utilities
and techniques to be developed to help bridge
the gap between proactive security abnd reactive forensics. Some areas of interest are

 Automated

Detection

of

HTML5

and

WebRTC based Data Exltration.

make any attempt to verify or re-create the circumstances of the le transfer dicult if not

 Approximate

Hashing

Signatures



Ap-

impossible and it very much depends on the

proximate hashing facilitates the analysis

features of the individual application being em-

of network trac as it could be applied to

© 2015 ADFSL

Page 147

2015 CDFSL Proceedings

HTML 5 Zero Conguration Covert Channels: Security ...

recognise variations on patterns specic to

http://dx.doi.org/10.1016/j.diin.2014.02.002.

protocols and their timings used in HTML5

URL http://www.sciencedirect.com/

and WebRTC

 Forensic analysis of P2P over anonymizing

science/article/pii/S174228761400005X.
Simson Garnkel. Network forensics: Tapping

networks. Perhaps a lack of a footprint can

the internet. IEEE Internet Computing, 6:

be proven to be a footprint in and of itself

6066, 2002.

in a networking environment.
Annarita Giani, Vincent H Berk, and George V

REFERENCES
Stevens Le Blond, Pere Manils, Chaabane
Abdelberi, Mohamed Ali Dali Kaafar,
Claude Castelluccia, Arnaud Legout, and

Cybenko. Data exltration and covert
channels. In Defense and Security
Symposium, pages 620103620103.

International Society for Optics and
Photonics, 2006.

Walid Dabbous. One bad apple spoils the
bunch: exploiting p2p applications to trace

Michael Herrmann and Christian Grotho.

and prole tor users. arXiv preprint

Privacy-implications of performance-based

arXiv:1103.1518, 2011.

peer selection by onion-routers: a real-world

Daryl; Bogaard, Daniel; Johnson and Robert
Parody. Browser web storage vulnerability
investigation: Html5 localstorage object. In

case study using i2p. In Privacy Enhancing
Technologies, pages 155174. Springer, 2011.

Julian Jang-Jaccard and Surya Nepal. A

Proceedings of The 2012 International

survey of emerging threats in cybersecurity.

Conference on Security and Management,

Journal of Computer and System Sciences,

2012.

80(5):973  993, 2014. ISSN 0022-0000.

Serdar Cabuk, Carla E Brodley, and Clay
Shields. Ip covert channel detection. ACM
Transactions on Information and System
Security (TISSEC), 12(4):22, 2009.

Hyunji Chung, Jungheum Park, Sangjin Lee,
and Cheulhoon Kang. Digital forensic
investigation of cloud storage services.
Digital Investigation, 9(2):81  95, 2012a.

ISSN 1742-2876.
Hyunji Chung, Jungheum Park, Sangjin Lee,

http://dx.doi.org/10.1016/j.jcss.2014.02.005.
URL http://www.sciencedirect.com/

science/article/pii/S0022000014000178.
Special Issue on Dependable and Secure
Computing The 9th {IEEE} International
Conference on Dependable, Autonomic and
Secure Computing.
Yali Liu, Cherita Corbett, Ken Chiang, Rennie
Archibald, Biswanath Mukherjee, and Dipak
Ghosal. Sidd: A framework for detecting
sensitive data exltration by an insider

and Cheulhoon Kang. Digital forensic

attack. In System Sciences, 2009. HICSS'09.

investigation of cloud storage services.

42nd Hawaii International Conference on,

Digital investigation, 9(2):8195, 2012b.

pages 110. IEEE, 2009.

Vicka Corey, Charles Peterman, Sybil Shearin,

Karsten Loesing, Steven J Murdoch, and Roger

Michael S Greenberg, and James

Dingledine. A case study on measuring

Van Bokkelen. Network forensics analysis.

statistical data in the tor anonymity

Internet Computing, IEEE, 6(6):6066, 2002.

network. In Financial Cryptography and
Data Security, pages 203215. Springer,

Corrado Federici. Cloud data imager: A

2010.

unied answer to remote acquisition of cloud
storage areas. Digital Investigation, 11(1):30
 42, 2014. ISSN 1742-2876.

Page 148

Ben Martini and Kim-Kwang Raymond Choo.
Cloud storage forensics: owncloud as a case

© 2015 ADFSL

HTML 5 Zero Conguration Covert Channels: Security ...

2015 CDFSL Proceedings

study. Digital Investigation, 10(4):287  299,
2013. ISSN 1742-2876.
Nagendra Modadugu and Eric Rescorla. The
design and implementation of datagram tls.
In NDSS, 2004.
Mark Scanlon, Jason Farina, Nhien-An
Le Khac, and M-Tahar Kechadi. Leveraging
Decentralisation to Extend the Digital
Evidence Acquisition Window: Case Study
on BitTorrent Sync. Journal of Digital
Forensics, Security and Law, pages 8599,

September 2014.
Taeshik Sohn, JungTaek Seo, and Jongsub
Moon. A study on the covert channel
detection of tcp/ip header using support
vector machine. In Information and
Communications Security, pages 313324.

Springer, 2003.
Juan Pablo Timpanaro, Isabelle Chrisment,
and Olivier Festor. Group-based
characterization for the i2p anonymous
le-sharing environment. In New
Technologies, Mobility and Security
(NTMS), 2014 6th International Conference
on, pages 15. IEEE, 2014.

© 2015 ADFSL

Page 149

2015 CDFSL Proceedings

Page 150

HTML 5 Zero Conguration Covert Channels: Security ...

© 2015 ADFSL