CWE-385:COVERTTIMINGCHANNELWEAKNESSID:385ABSTRACTION:BASESTRUCTURE:SIMPLESTATUS:INCOMPLETEPRESENTATIONFILTER:BASICCOMPLETEHIGHLEVELMAPPING-FRIENDLYDESCRIPTIONCOVERTTIMINGCHANNELSCONVEYINFORMATIONBYMODULATINGSOMEASPECTOFSYSTEMBEHAVIOROVERTIME,SOTHATTHEPROGRAMRECEIVINGTHEINFORMATIONCANOBSERVESYSTEMBEHAVIORANDINFERPROTECTEDINFORMATION.EXTENDEDDESCRIPTIONINSOMEINSTANCES,KNOWINGWHENDATAISTRANSMITTEDBETWEENPARTIESCANPROVIDEAMALICIOUSUSERWITHPRIVILEGEDINFORMATION.ALSO,EXTERNALLYMONITORINGTHETIMINGOFOPERATIONSCANPOTENTIALLYREVEALSENSITIVEDATA.FOREXAMPLE,ACRYPTOGRAPHICOPERATIONCANEXPOSEITSINTERNALSTATEIFTHETIMEITTAKESTOPERFORMTHEOPERATIONVARIES,BASEDONTHESTATE.COVERTCHANNELSAREFREQUENTLYCLASSIFIEDASEITHERSTORAGEORTIMINGCHANNELS.SOMEEXAMPLESOFCOVERTTIMINGCHANNELSARETHESYSTEM'SPAGINGRATE,THETIMEACERTAINTRANSACTIONREQUIRESTOEXECUTE,ANDTHETIMEITTAKESTOGAINACCESSTOASHAREDBUS.RELATIONSHIPSTHISTABLESHOWSTHEWEAKNESSESANDHIGHLEVELCATEGORIESTHATARERELATEDTOTHISWEAKNESS.THESERELATIONSHIPSAREDEFINEDASCHILDOF,PARENTOF,MEMBEROFANDGIVEINSIGHTTOSIMILARITEMSTHATMAYEXISTATHIGHERANDLOWERLEVELSOFABSTRACTION.INADDITION,RELATIONSHIPSSUCHASPEEROFANDCANALSOBEAREDEFINEDTOSHOWSIMILARWEAKNESSESTHATTHEUSERMAYWANTTOEXPLORE.NATURETYPEIDNAMECHILDOFCLASS-AWEAKNESSTHATISDESCRIBEDINAVERYABSTRACTFASHION,TYPICALLYINDEPENDENTOFANYSPECIFICLANGUAGEORTECHNOLOGY.MORESPECIFICTHANAPILLARWEAKNESS,BUTMOREGENERALTHANABASEWEAKNESS.CLASSLEVELWEAKNESSESTYPICALLYDESCRIBEISSUESINTERMSOF1OR2OFTHEFOLLOWINGDIMENSIONS:BEHAVIOR,PROPERTY,ANDRESOURCE.514COVERTCHANNELCANFOLLOWBASE-AWEAKNESSTHATISSTILLMOSTLYINDEPENDENTOFARESOURCEORTECHNOLOGY,BUTWITHSUFFICIENTDETAILSTOPROVIDESPECIFICMETHODSFORDETECTIONANDPREVENTION.BASELEVELWEAKNESSESTYPICALLYDESCRIBEISSUESINTERMSOF2OR3OFTHEFOLLOWINGDIMENSIONS:BEHAVIOR,PROPERTY,TECHNOLOGY,LANGUAGE,ANDRESOURCE.208OBSERVABLETIMINGDISCREPANCYRELEVANTTOTHEVIEW"RESEARCHCONCEPTS"(CWE-1000)THISTABLESHOWSTHEWEAKNESSESANDHIGHLEVELCATEGORIESTHATARERELATEDTOTHISWEAKNESS.THESERELATIONSHIPSAREDEFINEDASCHILDOF,PARENTOF,MEMBEROFANDGIVEINSIGHTTOSIMILARITEMSTHATMAYEXISTATHIGHERANDLOWERLEVELSOFABSTRACTION.INADDITION,RELATIONSHIPSSUCHASPEEROFANDCANALSOBEAREDEFINEDTOSHOWSIMILARWEAKNESSESTHATTHEUSERMAYWANTTOEXPLORE.NATURETYPEIDNAMEMEMBEROFCATEGORY-ACWEENTRYTHATCONTAINSASETOFOTHERENTRIESTHATSHAREACOMMONCHARACTERISTIC.417COMMUNICATIONCHANNELERRORSRELEVANTTOTHEVIEW"SOFTWAREDEVELOPMENT"(CWE-699)MODESOFINTRODUCTIONTHEDIFFERENTMODESOFINTRODUCTIONPROVIDEINFORMATIONABOUTHOWANDWHENTHISWEAKNESSMAYBEINTRODUCED.THEPHASEIDENTIFIESAPOINTINTHELIFECYCLEATWHICHINTRODUCTIONMAYOCCUR,WHILETHENOTEPROVIDESATYPICALSCENARIORELATEDTOINTRODUCTIONDURINGTHEGIVENPHASE.PHASENOTEARCHITECTUREANDDESIGNIMPLEMENTATIONAPPLICABLEPLATFORMSTHISLISTINGSHOWSPOSSIBLEAREASFORWHICHTHEGIVENWEAKNESSCOULDAPPEAR.THESEMAYBEFORSPECIFICNAMEDLANGUAGES,OPERATINGSYSTEMS,ARCHITECTURES,PARADIGMS,TECHNOLOGIES,ORACLASSOFSUCHPLATFORMS.THEPLATFORMISLISTEDALONGWITHHOWFREQUENTLYTHEGIVENWEAKNESSAPPEARSFORTHATINSTANCE.LANGUAGESCLASS:LANGUAGE-INDEPENDENT(UNDETERMINEDPREVALENCE)COMMONCONSEQUENCESTHISTABLESPECIFIESDIFFERENTINDIVIDUALCONSEQUENCESASSOCIATEDWITHTHEWEAKNESS.THESCOPEIDENTIFIESTHEAPPLICATIONSECURITYAREATHATISVIOLATED,WHILETHEIMPACTDESCRIBESTHENEGATIVETECHNICALIMPACTTHATARISESIFANADVERSARYSUCCEEDSINEXPLOITINGTHISWEAKNESS.THELIKELIHOODPROVIDESINFORMATIONABOUTHOWLIKELYTHESPECIFICCONSEQUENCEISEXPECTEDTOBESEENRELATIVETOTHEOTHERCONSEQUENCESINTHELIST.FOREXAMPLE,THEREMAYBEHIGHLIKELIHOODTHATAWEAKNESSWILLBEEXPLOITEDTOACHIEVEACERTAINIMPACT,BUTALOWLIKELIHOODTHATITWILLBEEXPLOITEDTOACHIEVEADIFFERENTIMPACT.SCOPEIMPACTLIKELIHOODCONFIDENTIALITYOTHERTECHNICALIMPACT:READAPPLICATIONDATA;OTHERINFORMATIONEXPOSURE.LIKELIHOODOFEXPLOITMEDIUMDEMONSTRATIVEEXAMPLESEXAMPLE1INTHISEXAMPLE,THEATTACKEROBSERVESHOWLONGANAUTHENTICATIONTAKESWHENTHEUSERTYPESINTHECORRECTPASSWORD.WHENTHEATTACKERTRIESTHEIROWNVALUES,THEYCANFIRSTTRYSTRINGSOFVARIOUSLENGTH.WHENTHEYFINDASTRINGOFTHERIGHTLENGTH,THECOMPUTATIONWILLTAKEABITLONGER,BECAUSETHEFORLOOPWILLRUNATLEASTONCE.ADDITIONALLY,WITHTHISCODE,THEATTACKERCANPOSSIBLYLEARNONECHARACTEROFTHEPASSWORDATATIME,BECAUSEWHENTHEYGUESSTHEFIRSTCHARACTERRIGHT,THECOMPUTATIONWILLTAKELONGERTHANAWRONGGUESSES.SUCHANATTACKCANBREAKEVENTHEMOSTSOPHISTICATEDPASSWORDWITHAFEWHUNDREDGUESSES.(BADCODE)EXAMPLELANGUAGE:PYTHONRETURN0FORIINLEN(ACTUAL_PW):RETURN0IFACTUAL_PW[I]<>TYPED_PW[I]:RETURN1IFLEN(ACTUAL_PW)<>LEN(TYPED_PW):FORIINLEN(ACTUAL_PW):RETURN1DEFVALIDATE_PASSWORD(ACTUAL_PW,TYPED_PW):NOTETHAT,INTHISEXAMPLE,THEACTUALPASSWORDMUSTBEHANDLEDINCONSTANTTIME,ASFARASTHEATTACKERISCONCERNED,EVENIFTHEACTUALPASSWORDISOFANUNUSUALLENGTH.THISISONEREASONWHYITISGOODTOUSEANALGORITHMTHAT,AMONGOTHERTHINGS,STORESASEEDEDCRYPTOGRAPHICONE-WAYHASHOFTHEPASSWORD,THENCOMPARETHEHASHES,WHICHWILLALWAYSBEOFTHESAMELENGTH.POTENTIALMITIGATIONSPHASE:ARCHITECTUREANDDESIGNWHENEVERPOSSIBLE,SPECIFYIMPLEMENTATIONSTRATEGIESTHATDONOTINTRODUCETIMEVARIANCESINOPERATIONS.PHASE:IMPLEMENTATIONOFTENONECANARTIFICIALLYMANIPULATETHETIMEWHICHOPERATIONSTAKEOR--WHENOPERATIONSOCCUR--CANREMOVEINFORMATIONFROMTHEATTACKER.PHASE:IMPLEMENTATIONITISREASONABLETOADDARTIFICIALORRANDOMDELAYSSOTHATTHEAMOUNTOFCPUTIMECONSUMEDISINDEPENDENTOFTHEACTIONBEINGTAKENBYTHEAPPLICATION.MEMBERSHIPSTHISMEMBEROFRELATIONSHIPSTABLESHOWSADDITIONALCWECATEGORIESANDVIEWSTHATREFERENCETHISWEAKNESSASAMEMBER.THISINFORMATIONISOFTENUSEFULINUNDERSTANDINGWHEREAWEAKNESSFITSWITHINTHECONTEXTOFEXTERNALINFORMATIONSOURCES.NATURETYPEIDNAMEMEMBEROFCATEGORY-ACWEENTRYTHATCONTAINSASETOFOTHERENTRIESTHATSHAREACOMMONCHARACTERISTIC.968SFPSECONDARYCLUSTER:COVERTCHANNELTAXONOMYMAPPINGSMAPPEDTAXONOMYNAMENODEIDFITMAPPEDNODENAMELANDWEHRTIMINGCLASPCOVERTTIMINGCHANNELRELATEDATTACKPATTERNSCAPEC-IDATTACKPATTERNNAMECAPEC-462CROSS-DOMAINSEARCHTIMINGREFERENCES[REF-18]SECURESOFTWARE,INC.."THECLASPAPPLICATIONSECURITYPROCESS".2005.
.CONTENTHISTORYSUBMISSIONDATESUBMITTERORGANIZATION2006-07-19LANDWEHRMODIFICATIONDATEMODIFIERORGANIZATION2008-07-01ERICDALCICIGITALUPDATEDTIME_OF_INTRODUCTION2008-09-08CWECONTENTTEAMMITREUPDATEDCOMMON_CONSEQUENCES,RELATIONSHIPS,OTHER_NOTES,TAXONOMY_MAPPINGS2008-10-14CWECONTENTTEAMMITREUPDATEDDESCRIPTION2009-07-27CWECONTENTTEAMMITREUPDATEDDESCRIPTION,OTHER_NOTES,POTENTIAL_MITIGATIONS2010-09-27CWECONTENTTEAMMITREUPDATEDCOMMON_CONSEQUENCES,DESCRIPTION2011-03-29CWECONTENTTEAMMITREUPDATEDDESCRIPTION2011-06-01CWECONTENTTEAMMITREUPDATEDCOMMON_CONSEQUENCES2012-05-11CWECONTENTTEAMMITREUPDATEDRELATED_ATTACK_PATTERNS,RELATIONSHIPS2014-07-30CWECONTENTTEAMMITREUPDATEDRELATIONSHIPS2017-11-08CWECONTENTTEAMMITREUPDATEDAPPLICABLE_PLATFORMS,DEMONSTRATIVE_EXAMPLES2020-02-24CWECONTENTTEAMMITREUPDATEDREFERENCES,RELATIONSHIPSMOREINFORMATIONISAVAILABLE—PLEASESELECTADIFFERENTFILTER.
