# A Novel Covert Channel for IEEE 802.11 Networks Utilizing MAC Address Randomization
## 4 The Proposed MAC Address Randomization Covert Channel  
### Concept  
The underlying concept of the covert channel described in this paper involves the transmission of secret messages by utilizing random MAC addresses. In this method, the secret message is the content of the field source address (SA) in the PR frame as presented in Figure 3. These random addresses are disposable to network observers and hold no meaning apart from their use in channel scanning and concealing the device's identity. The covert channel is disguised as MAC address randomization, leveraging the widespread adoption of this practice in modern Wi-Fi networks. We also use the sequence control (SC) field of the PR frame for the implementation of the covert channel as shown in Figure 3. The SC is a 16-bit field divided into two subfields: 4 bits for fragmentation number (FN) and 12 bits allocated for sequence number (SN). The FN signifies the frame's order in case of fragmentation, facilitating proper reassembly. For non-fragmented frames, such as PR, its value is always set to 0. The SN indicates the sequence in which the frame is transmitted from a single transmitter's perspective, incrementing by one with each transmission. In the proposed covert channel, the AP must differentiate between PR frames containing random MAC addresses from the covert station and PR frames from regular stations. To effectively address this distinction, we implemented the use of the cyclic redundancy  
Figure 3: Covert message encoded as random MAC address in probe request frame. check (CRC), specifically CRC-8, in the SN field. The procedure remains the same as the original algorithm. The covert STA generates a 4-bit random number and appends eight zeros to create a 12-bit initial value (e.g., 101100000000). The STA then divides the initial value by the shared generator polynomial. After the division, the covert STA inserts the 4-bit random number and the remainder of the division (the CRC) into the SN field. To verify the source of the PR frame, the AP takes the SN value and divides it by the shared generator polynomial. If the remainder is zero, it indicates that the PR frame originated from the covert STA. Otherwise, the AP interprets the PR frame as a regular PR. Changing the sequence number does not have any impact on regular network operations. In fact, it is a recommended practice to modify the sequence number during MAC randomization. This practice further increases the difficulty of reverse engineering the random MAC address and linking it back to the original global address [7]. Detecting the covert channel presents challenges due to two key factors. First, generating disposable random MAC addresses is recommended and lacks standardization. This allows for the creation of various additional randomization schemes to further enhance the disguise. Secondly, in the event of suspicion regarding implicit data transmission within the channel, the sender and receiver can employ a dictionary to encode and decode the covert messages. This dictionary enables the interpretation of seemingly random messages only by parties with the dictionary. Figure 4 presents the operation of the covert channel. In this scenario, the STA and AP share two specific random MAC addresses: one for indicating the initiation of covert communication, and the other for indicating its termination. To initiate the covert channel, the STA sends a PR frame with the SA field set to the MAC address indicating the initiation of covert communication. From that point onward, each subsequent PR frame is sent at regular intervals (i.e., every 10 ms), and its SA field is interpreted as a secret message. The covert channel is reliable. Employing retransmission, as illustrated in the case of PR number 3 not being acknowledged, STA retransmits PR with the same random MAC address. After transmitting the messages, the STA sends a PR frame with the appropriate random MAC address to signal the channel's termination. Subsequent PR frames are treated as regular requests by the AP.