Comprehensive and Detailed Explanation:
A covert channel is any communication path that allows data to be transferred in violation of a system's security policy. It's commonly used by malware or Trojans to exfiltrate data or send commands undetected.
Examples include:
* Encoding data in TCP headers (unused bits)
* Timing of packets (timing channel)
* Use of legitimate protocols to piggyback malicious traffic
From CEH v13 Courseware:
* Module 6: Malware Threats # Trojans and Covert Channels
Reference:CEH v13 Study Guide - Module 6: Trojan Communication # Covert and Overt ChannelsNIST SP
800-53 - Covert Channel Analysis

Firewalking is a technique used to determine what layer 4 protocols a firewall will allow by sending crafted packets with TTL values that expire at the firewall and analyzing ICMP Time Exceeded responses. This helps in determining what ports and services are allowed through a firewall.
# Reference - CEH v13 Study Guide, Module 11: Evading IDS, Firewalls, and Honeypots
"Firewalking is a technique used to gather information about firewalls and their rule sets by sending packets with TTL values that expire at the firewall."
# Incorrect options:
A: Session hijacking refers to taking over an active session.
C: MITM attacks involve intercepting communications between two parties.
D: Network sniffing involves capturing packets, not probing firewall rules.

The Sarbanes-Oxley Act of 2002 could be a law the U.S. Congress passed on July thirty of that year to assist defend investors from fallacious money coverage by companies.Also called the SOX Act of 2002 and also the company Responsibility Act of 2002, it mandated strict reforms to existing securities rules and obligatory powerful new penalties on law breakers.
The Sarbanes-Oxley law Act of 2002 came in response to money scandals within the early 2000s involving in public listed corporations like Enron Corporation, Tyco International plc, and WorldCom. The high-profile frauds cask capitalist confidence within the trustiness of company money statements Associate in Nursingd light-emitting diode several to demand an overhaul of decades-old restrictive standards.

Reverse engineering is the process of analyzing compiled software to reconstruct its source code or understand its structure and functionality. In the context of mobile applications:
* It involves decompiling the APK (for Android) or IPA (for iOS) files.
* Analysts can inspect the disassembled or decompiled code.
* The goal is to uncover logic flaws, identify hardcoded secrets, debug issues, or assess security weaknesses.
According to CEH v13:
* Reverse engineering is a common security assessment method to validate code quality and investigate vulnerabilities in mobile and binary applications.
* Tools like JADX, Apktool, Hopper, and Ghidra are often used.
Incorrect Options:
* B. App sandboxing restricts app access to system resources; it's a protection mechanism, not an analysis method.
* C. Jailbreaking is the process of removing OS restrictions, not source code analysis.
* D. Social engineering manipulates human behavior, unrelated to code or binary analysis.
Reference - CEH v13 Official Courseware:
Module 17: Hacking Mobile Platforms
Section: "Mobile Application Security Testing"
Subsection: "Reverse Engineering Tools and Techniques"

The Shellshock vulnerability (CVE-2014-6271) allows attackers to execute arbitrary commands via crafted environment variables in Bash. In this example, the malicious command cat /etc/passwd is executed, displaying the contents of the file (which contains system user account info).
Reference - CEH v13 Official Study Guide:
Module 6: Malware Threats
Quote:
"Shellshock allows remote code execution through environment variables processed by Bash. Exploits can be used to run commands like cat /etc/passwd on a vulnerable system." Incorrect Options:
A). No file deletion occurs.
B). It doesn't change passwords.
C). No user addition occurs.