🚀 go-pugleaf

In article <FAIGIN.92Aug17115056@soldan.aero.org> Daniel P. Faigin writes:
>On Mon, 17 Aug 1992 17:51:23 GMT, mark@hpcvxmsr.cv.hp.com (Mark Rowe) said:
>> It is true that properly implemented MAC would prevent the use of my
>> example.  That does not in any way prevent this from being an example
>> of a covert channel, it's simply a covert channel that can be eliminated
>> by MAC.  
> 
> Wrong, bucko! If properly implemented access controls would close the channel,
> then the channel is a *flaw*, not a covert channel.

It's only a flaw if there is something to be flawed.  On a C2 system there is
no MAC, I would argue my example still denotes a covert channel and not a
flaw in the non-existant MAC.

>> MAC does not define a covert channel.  

> I'd agree with you on this; however, covert channels other than MAC-type ones
> aren't interesting. Why would I care about a DAC covert channel, when I just
> just exploit the weaknesses inherent in DAC.

If what you are saying is that my example is an uninteresting covert channel
then I may agree with you.

>> What defines a covert
>> channel is how the data is being transmitted.  It is either overt or
>> covert.  An overt channel is a channel that transmits data in a known
>> manner as intended by the system administrators.  A covert channel is
>> anything else.

> Judging intent, however, is quite difficult. Let's take some examples here.
> Suppose I have a system where I can observe contention for a system resource,
> say memory. I exploit this to transmit information. That's a clear channel.
> Other cases aren't so clear. Look at Unix. There are many ways I can
> communicate with processes. Are signals a covert channel? Is the use of ptrace
> a covert channel? Is the use of the process number address space a covert
> channel? 

> It's not always so clear cut (alas).

I agree, it is not always clear cut, but I think the wrong questions are being
asked.  It is not, "Is the use of XXX a covert channel?", but rather, "Was XXX
intended to transmit information about YYY?".  It is (as you said) this intent
that is often not clear cut.  That in itself is not a fault in the definition.
It is often much easier to define what something is than it is to accurately
identify one when it is encountered.

Mark Rowe             email: mark@hpcvlx.cv.hp.com
Hewlett Packard       voice: (503) 750-3246
Corvallis, OR         FAX:   (503) 750-3788