full-disclosure - Windows covert channel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <sf94eb51.062@mail.itd.ci.jax.fl.us>
From: WEaton at coj.net (Wally Eaton)
Subject: Windows covert channel

James,
You may be thinking of "Streams" in Windows files. Data can be hidden in secondary files on NTFS partitions. I believe it was developed to be compatible with Apple/ MAC systems. In any case the following is an example:

Run CMD
On a NTFS partition

D:\> echo Hello > FrontFile
D:\> type FrontFile
Hello

D:\> echo Good Day >> FrontFile
D:\> type FrontFile
Hello
Good Day

D:\> echo Secret Info > FrontFile:BackFile
D:\> type FrontFile
Hello
Good Day

D:\> more < FrontFile:BackFile
Secret Info

Now add data to the FrontFile only

D:\> echo Good Evening >> FrontFile
D:\> type FrontFile
Hello
Good Day
Good evening

Now add data to the BackFile only

D:\> echo More Secret Data >>FrontFile:BackFile
D:\> more < FrontFile:BackFile
Secret Info
More Secret Data

You will notice if you enter a DIR command that only the FrontFile will be displayed. Furthermore, the size of the file will reflect only the content of the FrontFile.
Have a great day.
Wally