A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.
Typically the system has not given authorization for the transmission and has no knowledge of its occurrence.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
| Operation | N/A |
Intro: In this example, the attacker observes how long an authentication takes when the user types in the correct password.
Body: When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.
def validate_password(actual_pw, typed_pw): if len(actual_pw) <> len(typed_pw): return 0 for i in len(actual_pw): if actual_pw[i] <> typed_pw[i]: return 0 return 1