Actual use of covert channel in malware

Question

I have seen several academic sources mentioning covert channels in computers, such as one process sending data to another process/thread on the same machine in a way that attempts to avoid detection. Covert channels methods include for instance timing, resource contention... According to the Trusted Computer Security Evaluation Criteria, covert channels are

ways of transferring information from a higher classification compartment to a lower classification.

Is there an example of an actual malware having this behavior?

I am interested more in covert channels inside a single computer than network channels.

Answer 1

It depends on what do you want to achieve: to hide the information that is being sent between the processes or the fact that they are communicating. If your goal is only to obtain confidentiality you can encrypt the information that is being sent between two or more processes.

Prior to this you need to some background information on IPC(on both windows and *NIX), a number of implemented cryptographic primitives(i.e. openssl) and a protocol that actually requires two or more processes to communicate.

An example would be stuxnet.

Answer 2

Some (most) malware needs a way to contact its master (the "C&C" as "Command and Control" -- a military expression). This can be to exfiltrate some confidential data that was plundered from the affected system, or, possibly, to obtain fresh information from the C&C, e.g. more commands to execute on the target. Most of the time, the malware wishes to do so discreetly so as not to warn the victim of the malware presence. This is typical of a key logger, that captures user passwords, and normally wishes to keep on doing so, which entails NOT letting the user become aware of the key logger presence.

Covert channels are what malware uses to avoid detection from systems designed to detect anomalous traffic, often called Intrusion Detection Systems. IDS exist because malware needs to get data out discreetly.

---

A covert channel being by definition a matter of communication between two entities, I am not sure about what you mean by "covert channels within a single computer".