🚀 go-pugleaf

In a prior article John F. Haugh II writes:
> In article <1992Aug13.214823.19173@fx.com> franco@fx.com (Frank Minjarez) writes:
>>The definition in "Computer Security Basics" [published by O'Reilly & 
>>Associates] is a good one:
>>
>>	"A communication channel that allows a process to transfer information
>>	in a way that violates a system's security policy."
> 
> That definition is missing the "covert" aspect.  A "covert" channel is
> one which is not a commonly thought of communications mechanism.  A
> traditional communications channel, such as disk or serial device, would
> have some policy associated with it.  If that policy is violated, it is
> either a human error (that is, you hook up a serial port with a top secret
> label to the laptop computer you smuggled in) or a bug (the secret label
> on that port wasn't checked when a top secret document was output.)
> 
> A "covert" channel is some mechanism whose usual purpose is not the
> communication of data.  For example, sending data by modulating the system
> load.

Disagree, any channel can be a covert channel regardless of whether or
not it is normally thought of as a communication mechanism.  A trojan
horse that acquires classified information formulates it into an email
messages where the information is imbedded in seemingly harmless text
and then uses the system mail system to send it out, is certainly
using a standard communication mechanism.  What makes this a "covert"
channel is that the message is hidden or disguised or masquerading as
something else as opposed to an overt channel where the information is
obvious and undisguised (or disguised in some understood manner such
as encrypting).

Mark Rowe             email: mark@hpcvlx.cv.hp.com
Hewlett Packard       voice: (503) 750-3246
Corvallis, OR         FAX:   (503) 750-3788