基于GTALK即时通讯协议的隐蔽通道研究

Research of covert channel based on GTALK instant messenger protocol

针对现有基于公共网络通信协议的网络隐蔽通道易被检测的不足,详细分析了第三方即时通讯协议GTALK,利用GTALK文本消息通信模型,提出了一种基于GTALK即时通讯协议构建网络隐蔽通道的方法,给出了该隐蔽通道方案的详细设计和代码框架,GTALK协议本身的"合法性"为该隐蔽通道的伪装提供了有利条件。实验测试表明,该隐蔽通道具有良好的穿透性和隐蔽性。针对该隐蔽通道可能被恶意利用而带来的危害,给出了几点防御建议。

To alleviate the weakness of existed network covert channels in anti-detection, GTALK instant messenger protocol is analyzed and, a new method of constructing covert channel based on GTALK chat is proposed, and the detail design and code framework is provided. The legality of GTALK provides protection of the covert channel. In the end some experiments are car- ried to verify that the covert channel has excellent penetrability and covertness, and some safety suggestions are given to protect against this kind of network covert channel.