1219
A covert channel is a path that can be used to transfer information in a way not intended by the
system's designers.
Extended Description
Typically the system has not given authorization for the transmission and has no knowledge of its
occurrence.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1229 Creation of Emergent Resource 2006
ParentOf 385 Covert Timing Channel 940
ParentOf 515 Covert Storage Channel 1220
CanFollow 205 Observable Behavioral Discrepancy 526
Common Consequences
Scope Impact Likelihood
Confidentiality
Access Control
Read Application Data
Bypass Protection Mechanism
Detection Methods
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code,
etc.)
Effectiveness = SOAR Partial
Demonstrative Examples
Example 1:
In this example, the attacker observes how long an authentication takes when the user types in the
correct password.
When the attacker tries their own values, they can first try strings of various length. When they
find a string of the right length, the computation will take a bit longer, because the for loop will
run at least once. Additionally, with this code, the attacker can possibly learn one character of the
password at a time, because when they guess the first character right, the computation will take
longer than a wrong guesses. Such an attack can break even the most sophisticated password with
a few hundred guesses.
Example Language: Python (Bad)
def validate_password(actual_pw, typed_pw):
if len(actual_pw) <> len(typed_pw):
return 0
for i in len(actual_pw):
if actual_pw[i] <> typed_pw[i]:
return 0
return 1
Note that in this example, the actual password must be handled in constant time as far as the
attacker is concerned, even if the actual password is of an unusual length. This is one reason why
CWE Version 4.14
CWE-515: Covert Storage Channel
CWE-515: Covert Storage Channel