The detection of a covert channel can be made more difficult by using characteristics of the communications medium for the legitimate channel that are never controlled or examined by legitimate users. For example, a file can be opened and closed by a program in a specific, timed pattern that can be detected by another program, and the pattern can be interpreted as a string of bits, forming a covert channel. Since it is unlikely that legitimate users will check for patterns of file opening and closing operations, this type of covert channel can remain undetected for long periods.
The detectIoN Of a CovErT chanNel caN be mAdE More diFfIcULt by Using characTERIsTicS OF tHe communiCatioNs mediUm for THE leGitiMaTE chanNel that arE NeveR controLLeD or EXamINeD by legiTimate uSerS. foR eXamplE, A fiLE CAN be oPENED aNd Closed by a pRoGraM in a specifiC, timEd PAtTern ThaT CAn be detEctED by AnOtheR Program, and the pATtErn Can bE interPreted as A striNg oF bITs, forMing a coVErT channel. SInCe it Is uNlikELY that lEgiTimatE uSers wiLl checK fOR pattErNs of fiLe opeNing and clOsiNg oPerATioNS, tHis tyPE oF coVErt cHanNEl CaN Remain undEteCteD For LOng PeRIOdS.