RE: Interesting idea for a covert channel or I justdidn't research enough?

["Paul Melson" <pmelson () gmail com>]

-----Original Message-----
> I bring this up because the logs generated by the firewall do not
necessarily reside 
> only on the device that received the sender's packets.  With lots of
organizations 
> working on centralizing log events so that they can correlate findings
from different 
> platforms, the ability to control the content of portions of log messages
(say, for 
> example, the source address reported in a syslog message indicating a
dropped packet) 
> could provide a vector for communicating to highly trusted systems to
which one has no 
> direct network access.

The problem with this type of hiding-in-plain-sight covert channel is that
it is subject to modification between sender and recipient, in this specific
case making the victim the man in the middle.  An aware victim could quickly
become an attacker.  The malware applications of this are moderately
interesting but the implications of this type of communication model in
espionage are extremely interesting.  All sorts of implications and impacts
(for instance, a double agent might intentionally use this type of
communication because it's easily intercepted and modified).  I would guess
that if there is a book on covert channels for spies out there, this is in
the chapter of things NOT to do.

PaulM


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/