An off-the-shelf, low detectability, low data rate, timing-based covert channel for IEEE 802.11 wireless networks

In this paper, we propose and implement a novel covert channel for wireless networks employing the IEEE 802.11 standard. This timing-based covert channel trades off data rate to provide a covert channel that is detectable only at the physical layer (layer 1) and is compatible with all off-the-shelf versions of the current standard. Information is embedded in the interarrival times of probe request frames or beacon frames and data rates in excess of 50 bps with observed symbol error rates of less than 2% and 6.25% in a controlled environment and uncontrolled environment respectively.