  We analyzed the generation of protocol header fields in the implementations
of multiple TCP/IP network stacks and found new ways to leak information about
global protocol states. We then demonstrated new covert channels by remotely
observing and modifying the system's global state via these protocol fields.
Unlike earlier works, our research focuses on hosts that reside in firewalled
networks (including source address validation -- SAV), which is a very common
scenario nowadays. Our attacks are designed to be non-disruptive -- in the
exfiltration scenario, this makes the attacks stealthier and thus extends their
longevity, and in case of host alias resolution and similar techniques -- this
ensures the techniques are ethical. We focused on ICMP, which is commonly
served by firewalls, and on UDP, which is forecasted to take a more prominent
share of the Internet traffic with the advent of HTTP/3 and QUIC, though we
report results for TCP as well.
  The information leakage scenarios we discovered enable the construction of
practical covert channels which directly pierce firewalls, or indirectly
establish communication via hosts in firewalled networks that also employ SAV.
We describe and test three novel attacks in this context: exfiltration via the
firewall itself, exfiltration via a DMZ host, and exfiltration via co-resident
containers. These are three generic, new use cases for covert channels that
work around firewalling and enable devices that are not allowed direct
communication with the Internet, to still exfiltrate data out of the network.
In other words, we exfiltrate data from isolated networks to the Internet. We
also explain how to mount known attacks such as host alias resolution,
de-NATting and container co-residence detection, using the new information
leakage techniques.
