Diese Diplomarbeit befasst sich mit mehreren Unterthemen der verdeckten Kommunikationskanäle (Covert Channels) und möchte vor allen Dingen neue Themen vorstellen und diskutieren: Erstmalige und detaillierte Behandlung von Protocol Hopping Covert Channels: Protocol Hopping Covert Channels sind Storage Channels die, während sie existieren, das Netzwerkprotokoll, in dem die versteckten Informationen untergebracht werden, wechseln. Vorstellung der Idee der Protocol Channels: Im Gegensatz zu Protocol Hopping Covert Channels sind Protocol Channels schwerer zu detektieren, da sie ausschließlich durch den Wechsel eines Protokolls (ohne zusätzliche Informationen zu verstecken), versteckte Daten übertragen. Sowohl für Protocol Hopping Covert Channels als auch für Protocol Channels beschreibt diese Arbeit deren jeweilige Technik und untersucht deren Detektionsmöglichkeiten. Vorstellung der Idee der Header-Strukturveränderung: Ziel der Header-Strukturveränderung ist es, die Möglichkeiten, die Angreifer bei der Erstellung von Storage Channels innerhalb von Paket-Headern haben, einzugrenzen. Bei der Header-Strukturveränderung wird der Aufbau von Paket-Headern für jedes neu verschickte Paket verändert. Eine entsprechende Strukturinformation, die den Headeraufbau bestimmt, ist nur vertrauenswürdigen Komponenten beim Empfänger bzw. Sender zugänglich. Diese Arbeit stellt sowohl ein theoretisches Modell der Header-Strukturveränderung als auch eine praktische Umsetzung vor.

A fresh perspective on covert channels is presented in this work. A new class, air-gap covert channels, is defined as an unintentional communication channel established between systems that are physically and electronically isolated from one another. A specific class of air-gap covert channel is studied in depth, out-of-band covert channels (OOB-CCs), which are defined as policy-breaking communication channels established between isolated, physically unmodified systems. It is shown that OOB-CCs can be categorized by the physical channel that they communicate over: acoustic, light, seismic, magnetic, thermal, and radio-frequency, and the hardware that is required at the transmitter and receiver to make covert communication possible. In general, OOB-CCs are not as high-bandwidth as conventional radio-frequency channels; however, they are capable of leaking sensitive information that requires low data rates to communicate (e.g., text, recorded audio, cryptographic key material). The ability for malware to communicate information using a specific type of OOB-CC, the covert-acoustic channel, is also analyzed. It is empirically demonstrated that using physically unmodified, commodity systems (e.g., laptops, desktops, and mobile devices), covert-acoustic channels can be used to communicate at data rates of hundreds of bits per second, without being detected by humans in the environment, and data rates of thousands of bits per second when nobody is around to hear the communication. Defence mechanisms to counter covert-acoustic channels are also proposed and evaluated, and, as a result, best practices for the designers of secure systems and secure facilities are presented. Additionally, the covertness of OOB-CCs, i.e., the amount of data that can be leaked before the channel is detected, is also determined for classical communication channels as well as for covert-acoustic channels.

No description available.

Selective attention has been studied extensively and it is shown, for example, that individuals with conditions such as anxiety show attention bias to threat-related stimuli. It has been proposed that humans are predisposed or that it is naturally adaptive to selectively attend to emotional stimuli (Lang, 2000). Similarly, LeDoux (1996) and others have proposed limbic brain networks allowing for quick and automatic, but sometimes inaccurate, processing of emotion which bypasses primary cortical areas. Along these lines, automatic attention bias to subliminal image cues in an adapted Posner Covert Attention Task was examined in the current study. A sample of 64 participants was used in each of three separate experiments to examine how individuals were cued subliminally by negative or positive emotional vs. neutral images and the modulation of covert attention by emotion. Due to automatic or motivated attention to emotionally salient stimuli, participants were expected to be facilitated in task performance by negative and positive emotional image cues, relative to neutral cues. Further, state anxiety and depression were expected to impact performance on emotional cueing as well. As expected in Experiment 1, subliminal images produced significant covert attentional cueing and only negative image cues compared to neutral ones produced response time (RT) reduction by valid cueing across both cue-target delay conditions. Further, cueing differences between neutral and negative images were seen only at short delays, supporting differential subliminal processing of emotional cues in attentional paradigms and supporting previous evidence of unconscious fear processing and specialized automatic fear networks. Moreover, in Experiment 2, when delays following subliminal cues were extended further, emotional cues did not differentially modulate covert attention, suggesting that subliminal emotional cueing seems to occur more immediately. Positive subliminal imagery in Experiment 3 was largely unsuccessful in differentially modulating covert attention compared to neutral cues, suggesting that positive information is either not effective in modulating covert attention or occurs over similar immediate time durations as negative cues in Experiment 1. Finally, the presence of self-reported state anxiety and depression affected task performance, especially in Experiment 1 negative for subliminal discrimination of negative vs. neutral image cues. Overall, the current study adds to the research literature which demonstrates that emotional information, especially negative imagery processed at short intervals, can be processed below awareness to modulate attention in a different manner than less salient neutral stimuli and this modulation is further influenced by state anxiety or depressive symptomatology. Implications of these findings and future directions for research are discussed.

In this thesis I contribute to the growing literature on the structure of covert networks by exploring the organisation and functioning of two new groups. (1) The Right Club, a Right-wing, Pro-German group active in the UK at the outbreak of World War Two, and (2) The leadership group of the Provisional Irish Republican Army (PIRA) between 1969 and 1986. Specifically, I focus upon the formation of these groups, and how, and indeed if, they maintained covertness in practice. Whilst there has been a wealth of research in this area, many studies simply assume covertness and its impact upon structure due to the illegal nature of their case studies. In this thesis I develop a more nuanced concept of covertness, and a more detailed analysis of the myriad factors which affect the structure of a clandestine group. I employ a mixed methods approach combining Social Network Analysis with qualitative inquiry of the environment and processes which influence the functioning of each group. The qualitative analysis, which was guided by factors identified in the existing covert networks literature, in the Social Movements literature, and by dynamics noted in work on the Sociology of Secrecy, is used to explore and explain the sociometric findings. This provides a more in-depth, more sociological understanding of clandestine organisation than that which currently exists in this field of research. However, more and varied case studies analysed in this way are also necessary if we are to improve our understanding of the structure and functioning of covert groups. With this knowledge more sensitive and successful deradicalisation and/or destabilisation techniques can be crafted.

Background 200 million patients undergo noncardiac surgery every year. Overt stroke after noncardiac surgery is not common, but has a substantial impact on duration and quality of life. Covert stroke in the nonsurgical setting is much more common than overt stroke, and associated with an increased risk of cognitive decline and dementia. Little is known about covert stroke after noncardiac, noncarotid artery surgery. Methods We undertook a prospective cohort pilot study to inform the incidence of covert stroke after noncardiac, noncarotid artery surgery, and to determine the feasibility of a full prospective cohort study to characterize the epidemiology of perioperative covert stroke. Patients underwent a brain MRI study between postoperative days 3-10, and were followed up at 30 days after surgery. Results of the pilot study We enrolled a total of 100 patients from 6 centres in 4 countries, demonstrating excellent recruitment and no loss to follow-up at 30 days after surgery. The incidence of perioperative covert stroke was 10.0% (10/100 patients, 95% confidence interval 5.5% to 17.4%). Full study protocol We describe a proposal for a prospective cohort study of 1,500 patients. An MRI study of the brain will be performed between postoperative days 2 and 9. The primary outcome is cognitive function, measured 1 year after surgery using the Montreal Cognitive Assessment tool. We will perform multivariable logistic regression analysis where the dependent variable is the change in cognitive function 1 year after surgery, and the independent variables are incidence of perioperative covert stroke and other risk factors for cognitive decline. Conclusions This international multicentre pilot study suggests that 1 in 10 patients ≥65 years of age experiences a perioperative covert stroke. The proposed protocol describes a larger study which will determine the impact of perioperative covert stroke on patient-important outcomes. / Thesis / Master of Science (MSc) / This thesis describes a program of research to investigate silent stroke after surgery.

The objective of this study is to investigate and analyse covert action as an option in national security policy. To achieve this aim, the study focused on aspects such as changes in the current international security environment; new challenges that exist; and a conceptual framework of covert action as an element of intelligence. An analysis of the conduct of covert action by the United States of America (US) during the Cold War era as well as the post-Cold War era was also done with the specific intention of identifying problem areas, reasons for success, as well as legislative control measures instituted to regulate the activity. A similar study referring to the situation in South Africa, with the focus on the pre- and post-1994 eras, is also presented. The nature of covert action and especially negative perceptions within society, have led to the questioning of the use of covert action as a legitimate option within security policy. However, as shown in the analysis of case studies, reality indicates that governments continue to conduct covert action. The importance of the study lies in its clarification of the concept of covert action, not only for policy-makers but also for intelligence functionaries. It indicates the measures that should be in place for covert action to be an effective element of national security options; its advantages and disadvantages; the circumstances in which it should be conducted; and the fact that it is still a viable option in the current security milieu. / Dissertation (MSS (Political Science))--University of Pretoria, 2007. / Political Sciences / unrestricted

Problemformulering och syfte: I dagens samhälle med ständig uppkoppling blir vi i allt större utsträckning utsatta för reklam i syfte att påverka oss. I denna undersökning eftersträvas att se hur påverkan kan komma fram i fenomenet podcast. Med undersökningen avser dels att få svar på vilket sätt de marknadskommunikativa budskapen sker genom varumärkesomnämnanden och dels hur väl anpassade de är till befintliga teorier som existerar för framgångsrik marknadskommunikation. I undersökningen appliceras även ett branschetiskt perspektiv. Metod och material: För att få en generaliserbar bild av hur frekvent varumärkesomnämnanden sker i podcasts har en kvantitativ innehållsanalys genomförts. En kvantitativ ansats antogs också för att undersökningen till stor del handlar om att undersöka kvantiteten av marknadskommunkation, för att sedan analysera resultatet. Det teoretiska ramverk som undersökningen utgår från retoriska, marknadskommunikativa och etiska aspekter. Huvudresultat: Huvudresultatet bestod i att podasts som fenomen innehåller en stor mängd marknadskommunikativa budskap som når mottagarna, efter denna undersöknings mätinstument, med 5 minuter och 47 sekunders mellanrum. Att använda dolda budskap utan en uttalad avsändare är det vanligaste sättet att kommunicera mot marknaden detta gör att podcastens innehåll ej följer till de branschetiska riktlinjer kring transparens som finns. Det vanligaste sättet som mottagarna får sina argument på är genom emotionella argument.

Intrusion defense system (IDS) development has been largely reactionary in nature. This is especially troubling given that botnets are capable of compromising and controlling thousands of computers before security professionals develop a mitigation technique. As new exploits are created, new mitigation techniques are developed to detect infections and, where possible, remove them. This thesis breaks from this tradition of reacting to malware. Instead, it looks at possible malicious software models through analyzing existing defense systems for exploitable weaknesses. First, this thesis presents a new specialized botnet that circumvents current network intrusion detection mechanisms. The proposed botnet coordinates external communication among bots located within the same switched network. This model is designed to prevent a perimeter-based IDS from adequately correlating external communication for a given internal host. The idea is to localize botnet communication, thus enabling a portion of the compromised systems to hide from existing detection techniques without a significant increase in network monitoring points - an increase that currently has not been effectively addressed. Second, this thesis presents a prototype of an IDS that addresses the aforementioned weakness in current IDSs. The proposed method augments existing IDSs in order to efficiently detect this new botnet specialization or "sub-botnet''. Our method has added lightweight monitoring points within its switched network. These points relay necessary information back to a centralized perimeter-based IDS instance for bot detection. The IDS is also able to effectively relay signature information to the additional monitoring points for analysis.

In a world that relies heavily on data, protection of that data and of the motion of that data is of the utmost importance. Covert communication channels attempt to circumvent established methods of control, such as rewalls and proxies, by utilizing non-standard means of getting messages between two endpoints. The Domain Name System (DNS), the system that translates text-based resource names into machine-readable resource records, is a very common and e ective platform upon which covert channels can be built. This work proposes, and demonstrates the e ectiveness of, a novel technique that estimates data transmission throughput over DNS in order to identify the existence of a DNS tunnel against the background noise of legitimate network tra c. The proposed technique is robust in the face of the obfuscation techniques that are able to hide tunnels from existing detection methods.