COTIIP: a new covert channel based on incomplete IP packets

A Covert Channel is a communication channel able to transfer information between two or more hosts, using the resources of another communication channel, so that who can read the information carried by the latter cannot realize an information exchange is ongoing in the former. Many types of covert channels have been described in literature, together with countermeasures to block them. After an overview of the literature on the subject, the present paper will describe COTIIP (COmmunicating Through Incomplete IP Packets) a new covert channel based on the TCP/IP protocol. COTIIP is based on the transmission of incomplete fragmented IP packets. The receiver will use the information about incomplete or missing packets to restore the original message. A first assessment of some possible countermeasures aimed at suppressing or exposing the use of such channel will also be proposed.