Covert Channel
Definition
Any communication path that was not intended by the system designer and that bypasses access-control or monitoring policies. Network covert channels are a subset that operate over standard network infrastructure by exploiting protocol properties.
- Definition scope
- Any unintended communication path bypassing access control
- Subset
- Network covert channels operate over standard network infrastructure
- Method examples
- Protocol field abuse, timing channels, steganographic encoding
- Detection difficulty
- Traffic often appears as normal, permitted protocol use
Common questions
How does a network covert channel differ from ordinary encrypted traffic?+
Encrypted traffic hides content but is still visible and identifiable as a communication of a known type, while a covert channel hides the very existence or purpose of the communication, often by piggybacking data inside fields or timing patterns of an otherwise unremarkable protocol exchange.
What is a timing-based covert channel?+
It encodes information in the timing or spacing between otherwise legitimate network events, such as packet inter-arrival delays, rather than in the packet content itself, which makes it resistant to content-inspection tools that only examine payload data.
Why are covert channels significant in a forensic investigation of data exfiltration?+
An attacker using a covert channel can move data out of a network past monitoring tools that only flag known-bad content or destinations, so investigators must analyse traffic patterns and protocol anomalies rather than relying solely on signature or content-based detection to find the exfiltration.
Related terms
- Carrier (Cover Object)
- The original file, image, audio recording, or video clip used to conceal the hidden message. The modified version containing the hidden data...
- DCT Coefficient Manipulation
- A transform-domain technique that embeds data in the discrete cosine transform coefficients of a JPEG block, operating within the compressed representation rather...
- DNS Tunnelling
- Encoding data inside DNS queries and responses to exfiltrate information or carry command-and-control traffic through a network that permits DNS but blocks...
- Entropy Analysis
- A statistical technique that measures the randomness of data in a field or stream. Protocol fields that should contain low-entropy predictable values...
- LSB Substitution
- Least-significant-bit substitution: the lowest-order bit of each sample value (pixel colour channel or audio sample) is overwritten with one bit of the...
- Payload
- The action the malware performs once active: data encryption (ransomware), credential theft (banking trojan), resource hijacking (cryptominer), or system destruction (wiper). The...
- Protocol Anomaly Detection
- A detection method that compares observed network traffic against the formal specification of each protocol (its RFC or standard) and flags fields...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- Storage Channel
- A covert channel that encodes information in the value of a protocol field, such as the IP Identification field or a DNS...
- Timing Channel
- A covert channel that encodes information in the intervals between network events, such as inter-packet delays, rather than in packet content. Timing...
Explained in these topics
- Network Steganography and Covert Channels
- Steganography Methods in Images, Audio, and VideoAny pathway used to transfer information outside of intended or visible communication channels. In digital forensics, metadata fields, file-header padding, and...