940
CAPEC-ID Attack Pattern Name
21 Exploitation of Trusted Identifiers
31 Accessing/Intercepting/Modifying HTTP Cookies
39 Manipulating Opaque Client-based Data Tokens
59 Session Credential Falsification through Prediction
60 Reusing Session IDs (aka Session Replay)
61 Session Fixation
196 Session Credential Falsification through Forging
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-385: Covert Timing Channel
Weakness ID : 385
Structure : Simple
Abstraction : Base
Description
Covert timing channels convey information by modulating some aspect of system behavior
over time, so that the program receiving the information can observe system behavior and infer
protected information.
Extended Description
In some instances, knowing when data is transmitted between parties can provide a malicious
user with privileged information. Also, externally monitoring the timing of operations can potentially
reveal sensitive data. For example, a cryptographic operation can expose its internal state if the
time it takes to perform the operation varies, based on the state.
Covert channels are frequently classified as either storage or timing channels. Some examples
of covert timing channels are the system's paging rate, the time a certain transaction requires to
execute, and the time it takes to gain access to a shared bus.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 514 Covert Channel 1218
CanFollow 208 Observable Timing Discrepancy 529
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 417 Communication Channel Errors 2325
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
CWE Version 4.14
CWE-385: Covert Timing Channel
CWE-385: Covert Timing Channel