covert channels

Thread View: comp.security.misc

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by f.e.carey Thu, 20 Aug 1992 21:42

#435

Author: f.e.carey
Date: Thu, 20 Aug 1992 21:42

29 lines
1701 bytes

>I believe this definition intends -- although I see it doesn't state --
>that all system access controls and other security checks are functioning
>correctly.  In other words, process A and process B _are_ obeying all of
>the individual security rules imposed by the system, but somehow process
>A manages to send, and process B to receive, information that the overall
>system security policy would not permit to be sent directly.  (That's why
>its "surprising to the authorities" <1992Aug15.162611.24659@sctc.com> :-)

This is close to my understanding but I don't think 
the covert channel needs to involve communication
between two processes and you don't need a sender
per se.  For example:

If file permission settings prevent me from reading the daily 
files that contains records of production defects in the factory,
the access controls forbiding such access could be
said to be functioning.  Yet if I am able to determine
the size of the files I can infer information about
defect rates.  In such a case there would seem to be
no "sending process". 
Does such a scenario qualify as a covert channel?

Another scenario: If I've being held incommunicado in a
building and denied access to phones, mail, etc. and I am 
able to signal out a message using the venetian blinds, 
Have I utilized a covert channel?

Frank Carey at Bell Labs

Re: covert channels

#335

Author: Paul A. Karger
Date: Wed, 02 Sep 1992 22:37

29 lines
1789 bytes

In article <1992Aug20.214220.22820@cbnewsl.cb.att.com>, fec@cbnewsl.cb.att.com (f.e.carey) writes:

|> 
|> If file permission settings prevent me from reading the daily 
|> files that contains records of production defects in the factory,
|> the access controls forbiding such access could be
|> said to be functioning.  Yet if I am able to determine
|> the size of the files I can infer information about
|> defect rates.  In such a case there would seem to be
|> no "sending process". 
|> Does such a scenario qualify as a covert channel?

There are two potential security problems here.  First, the size of 
the file could imply the defect rate.  This is an example (albeit
a strange example) of the statistical database inference problems
that Dorothy Denning has written extensively about.

There is a second problem that is a covert channel, namely that
a Trojan horse program could modulate the size of the file (or
files) to encode information.  This is a covert channel.

|> 
|> Another scenario: If I've being held incommunicado in a
|> building and denied access to phones, mail, etc. and I am 
|> able to signal out a message using the venetian blinds, 
|> Have I utilized a covert channel?

Yes - in fact, the classic example of a covert channel is a POW
banging on the walls to communicate with other POWs.

Re: covert channels

#347

Author: Rick Smith
Date: Thu, 03 Sep 1992 15:51

37 lines
2084 bytes

fec@cbnewsl.cb.att.com (f.e.carey) writes:

>If file permission settings prevent me from reading the daily 
>files that contains records of production defects in the factory,
>the access controls forbiding such access could be
>said to be functioning.  Yet if I am able to determine
>the size of the files I can infer information about
>defect rates.  In such a case there would seem to be
>no "sending process". 
>Does such a scenario qualify as a covert channel?

No, because there is no attempt to place a "mandatory access control"
(MAC) boundary between you and the data. A properly implemented
mandatory access control boundary does not allow software on one side
to write things that are readable on the other. Since the size
information is visible, there isn't a real MAC boundary.

It's also important to distinguish between policy and implementation.
If the policy says "no defect info should be visible to outsiders"
then there's still the issue of whether or not someone seriously tries
to enforce that policy. In your example, the implementation is clearly
inadequate to enforce the specified access control requirement.

>Another scenario: If I've being held incommunicado in a
>building and denied access to phones, mail, etc. and I am 
>able to signal out a message using the venetian blinds, 
>Have I utilized a covert channel?

No, because covert channels have to do with electronic transmissions,
particularly ones that don't involve action by an interactive user.

The covert channel concept only makes sense in terms of MAC. Examples
based on conventional operating systems _without_ MAC really don't
work.

Rick.
smith@sctc.com            arden hills, minnesota

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads