Site Glossary

A covert channel is a type of communication method which allows for the transfer of data by exploiting resources that are commonly available on a computer system. Covert channels are types of communication that are invisible to the eyes of the system administrators or other authorized users. Covert channels are within a computer or network system, but are not legitimate or sanctioned forms of communication. They may be used to transfer data in a clandestine fashion.

Examples of covert channels include:

• Embedding data in the headers of packets - The covert data is embedded in the headers of normal packets and sent over a protocol related to the normal activities of the computer system in question.
• Data piggybacked on applications - Malicious applications are piggybacked with legitimate applications used on the computer system, sending confidential data.
• Time-based channel - The timing of certain actions or transmissions is used to encode data.
• Covert storage channel - Data is stored within a computer system on disk or in memory and is hidden from the system's administrators.
• Data diddling - This involves manipulating data to contain malicious code or messages.
• Steganography - This is a process of hiding messages within other types of media such as images and audio files.

Covert channels are commonly used for malicious purposes, such as the transmission of sensitive data or the execution of malicious code on a computer system. They can also be used for legitimate purposes, however, such as creating an encrypted communication channel.

Crime as a service (CaaS) is a term used to describe the practice of selling illegal or malicious products or services online. These products and services can include things such as malware, stolen personal information, and tools for committing cybercrimes.

One example of CaaS is the sale of malware-as-a-service (Maas). Maas refers to the sale of malware or tools for creating malware, often with the added convenience of technical support and updates. This allows individuals or organizations to purchase and use malware without having the technical knowledge or resources to create it themselves.

Another example of CaaS is the sale of stolen personal information, such as credit card numbers or login credentials. This information can be used for identity theft or other fraudulent activities.

CaaS can also include the sale of tools or services for committing cybercrimes, such as distributed denial of service (DDoS) attacks or phishing campaigns. These tools can be used to disrupt or compromise websites or steal sensitive information from individuals or organizations.

Overall, CaaS is a growing concern for law enforcement agencies, as it allows individuals or organizations to access and use illegal or malicious products and services without having to have the necessary knowledge or resources. It is important for individuals and organizations to be aware of the potential risks of CaaS and take steps to protect themselves from these types of threats.