Covert Channels

Even though there are protection mechanisms in place, if unauthorized information can be transferred using a signaling mechanism or a storage mechanism, using some way that is not normally considered to be able to communicate, then a covert channel may exist.

In simplified terms, it is any flow of information, unintentional or inadvertent, that enables an unauthorized observer to have access to the sensitive information.

This may allow the observer to infer more sensitive information than is allowed.

Covert channels can be created in two basic ways: wittingly or unwittingly.

Wittingly

Unwittingly

Wittingly, by the cooperative, willful design

Unwittingly, by the hostile process of the two processes to create, use, and exploiting hitherto unrecognized manage the covert channel exposures of information, resources, or other characteristics by the target system

Covert storage channels (CSCs) involve the direct or indirect use (reading or writing) of storage locations by one process and a direct or indirect use of the same storage location by another process. Typically, a covert storage channel involves memory locations or sectors on a disk that may be shared by two subjects.

This could include hard drive space, cache, or other typically used memory types in computer architectures. Another opportunity for covert channels is the presence of unused bits in the headers of network traffic or records, files, or objects when in various storage systems. Storage covert channels may violate security policies directly (if the hostile process operates at a lower security level than access to the information would otherwise require), or indirectly by being part of a data exfiltration pipeline of processes.

Covert timing channels (CTCs) operate by changing the timing of the behavior of a system resource or element in a way that can be used to pass information to an observing process. This is similar to modulating information onto a pulse train. [A timing covert channel depends upon being able to influence the rate or timing issue that some other process is able to acquire resources. Examples of this may be the CPU, memory, or 1/O devices. The variation in rate may be used to pass signals that may be used to infer more sensitive information.

Essentially, sending process in the covert channel signals information to another process by modulating its own use of system resources in such a way that this manipulation affects the real response time observed by the second process and therefore, may signal sensitive information.

The variation in rate may be used to pass signals that may be used to infer more sensitive information.

Covert Channel Controls

All covert channels involve the use of a shared resource to facilitate the transmitting and receiving of objects. Covert channels should first be identified during the design and development phases, by identifying shared resources that might be subject to abuse (as part of such a covert channel).

In some cases, focused inspection, testing, and analysis may be necessary to verify that suspected covert channels do exist. Security risk managers must then determine which of these covert channels need to be mitigated, either by redesign, by applying more stringent access controls (to the shared resources in question), or by other means.