[Full-Disclosure] Windows covert channel

["Wally Eaton" <WEaton@coj.net>]

James,
You may be thinking of "Streams" in Windows files. Data can be hidden in 
secondary files on NTFS partitions. I believe it was developed to be compatible 
with Apple/ MAC systems. In any case the following is an example:

Run CMD
On a NTFS partition

D:\> echo Hello > FrontFile
D:\> type FrontFile
Hello

D:\> echo Good Day >> FrontFile
D:\> type FrontFile
Hello
Good Day

D:\> echo Secret Info > FrontFile:BackFile
D:\> type FrontFile
Hello
Good Day

D:\> more < FrontFile:BackFile
Secret Info

Now add data to the FrontFile only

D:\> echo Good Evening >> FrontFile
D:\> type FrontFile
Hello
Good Day
Good evening

Now add data to the BackFile only

D:\> echo More Secret Data >>FrontFile:BackFile
D:\> more < FrontFile:BackFile
Secret Info
More Secret Data

You will notice if you enter a DIR command that only the FrontFile will be 
displayed. Furthermore, the size of the file will reflect only the content of 
the FrontFile.
Have a great day.
Wally 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html