A Zero-Day Cloud Timing Channel Attack

The Intrusion Detection and Prevention System (IDPS) services of a North American cloud service provider were ineffective against a simulated network timing channel attack. During the tests, three conspiring white hat agents exchanged a total of 33,024 network packets. As the proxy based attack executed, the vendor&#x2019;s intrusion detection service did not generate a warning, nor did its intrusion prevention service drop packets. Throughout the experiment, 4,096 bytes of randomized data (simulating covert traffic) were exchanged over a 2.06 hour period (4.4 bits-per-second); however, the vendor&#x2019;s Artificial Intelligence (AI) enabled threat detection service did not issue an alert. A Wilcoxon Ranked Sum test on the before-and-after throughput confirmed none of the vendor&#x2019;s countermeasures triggered/intervened to a statistically significant degree (threat intel: <inline-formula> <tex-math notation="LaTeX">$p=0.703, \text { IDPS: } p=0.998$ </tex-math></inline-formula>, threat intel &#x002B; <inline-formula> <tex-math notation="LaTeX">$\text { IDPS: } p=0.118$ </tex-math></inline-formula>). These results indicate those accountable for data-oriented Service Organization Control (SOC) 2/3 reports (e.g., auditors, cybersecurity executives, etc.) should carefully examine the assurances offered by cloud service providers with regard to their network steganography defenses.

Abstract licence: CC BY-NC-ND

31 more references, whose wording the paper’s licence keeps private.

A person counts once a day per paper. We keep no cookie and no address: a reader is a hash that changes every day. Any month under five reads shows no number.