BlackHat Windows Security 2004 Data Hiding on a Live System by Harlan Carvey

Slides:

Advertisements

Similar presentations

COMP091 – Operating Systems 1

Advertisements

Computer Forensics: Basics Media Analysis. Agenda Common Data Hiding Techniques Windows Registry Writing files Deleting and Reformatting Recycle Bin.

How an attacker can maintain control over their victim’s system without being discovered.

Bypassing antivirus detection with encryption

Windows Rootkits – Userland API Hooking Robert Vinson – IT Security Analyst – University of Iowa 09/06/06.

ROOTKIT VIRUS by Himanshu Mishra Points to be covered Introduction History Uses Classification Installation and Cloaking Detection Removal.

Defense-in-Depth Against Malicious Software Jeff Alexander IT Pro Evangelist Microsoft Australia

Windows Security and Rootkits Mike Willard January 2007.

Lecture 10: The FAT, VFAT, and NTFS Filesystems 6/17/2003 CSCE 590 Summer 2003.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 7: Advanced File System Management.

COS/PSA 413 Day 16. Agenda Lab 7 Corrected –2 A’s, 1 B and 2 F’s –Some of you need to start putting more effort into these labs –I also expect to be equal.

Security SIG: Introduction to Tripwire Chris Harwood John Ives.

Information Networking Security and Assurance Lab National Chung Cheng University F.I.R.E. Forensics & Incident Response Environment.

ROOT KITS. Overview History What is a rootkit? Rootkit capabilities Rootkits on windows OS Rootkit demo Detection methodologies Good tools for detection.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 7: Advanced File System Management.

2004, Jei F.I.R.E. Forensics & Incident Response Environment Information Networking Security and Assurance Lab National Chung Cheng University.

Chapter 11 Basic Windows and Windows Commands. Overview of what an Operating System does To identify and use common desktop and home screen icons To manipulate.

Installing Windows XP Professional Using Attended Installation Slide 1 of 41Session 2 Ver. 1.0 CompTIA A+ Certification: A Comprehensive Approach for all.

Mastering Windows Network Forensics and Investigation Chapter 9: Registry Evidence.

Root Kits and Windows Hardening Team BAM! Scott Amack Everett Bloch Maxine Major.

Linux Networking and Security Chapter 10 File Security.

Tasks Necessary for Setting Up a Hard Disk Initializing the disk with basic or dynamic storage type Creating partitions on basic disks or volumes on dynamic.

TDL3 Rootkit A Sans NewsBite Analysis by Marshall Washburn.

Mastering Windows Network Forensics and Investigation Chapter 9: Registry Evidence.

MSIT 458 – The Chinchillas. Offense Overview Botnet taxonomies need to be updated constantly in order to remain “complete” and are only as good as their.

WINDOWS SYSTEMS AND ARTIFACTS John P. Abraham Professor UTPA.

Tripwire Enterprise Server Rule Sets Vincent Fox, Doreen Meyer, and Paul Singh UC Davis, Information and Educational Technology July 25, 2006.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 7: Advanced File System Management.

Mastering Windows Network Forensics and Investigation Chapter 7: Windows File Systems.

Caleb Walter. Created when Microsoft made the NTFS File system in NT 3.1 Made for Compatibility with HFS HFS uses Data Forks ; NTFS uses File Extensions.

MODERN OPERATING SYSTEMS Third Edition ANDREW S. TANENBAUM Chapter 11 Case Study 2: Windows Vista Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall,

Operating Systems Concepts 1/e Ruth Watson Chapter 2 Chapter 2 Windows File and Environment Ruth Watson.

IT Essentials 1 v4.0 Chapters 4 & 5 JEOPARDY RouterModesWANEncapsulationWANServicesRouterBasicsRouterCommands RouterModesWANEncapsulationWANServicesRouterBasicsRouterCommands.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 7: Advanced File System Management.

Mastering Windows Network Forensics and Investigation Chapter 7: Windows File Systems.

Rootkits. EC-Council The Problem  Microsoft Corp. security researchers are warning about a new generation of powerful system-monitoring programs, or.

Vijay Krishnan Avinesh Dupat. A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators.

CIS 450 – Network Security Chapter 15 – Preserving Access.

CIS 450 – Network Security Chapter 16 – Covering the Tracks.

Rootkits in Windows XP  What they are and how they work.

1 Higher Computing Topic 8: Supporting Software Updated

Windows NT Chapter 13 Key Terms By Bill Ward NT Versions NT Workstation n A desktop PC that both accesses a network and works as a stand alone PC NT.

A+ Guide to Managing and Maintaining Your PC Fifth Edition Chapter 13 Understanding and Installing Windows 2000 and Windows NT.

Monnappa KA  Info Security Cisco  Member of SecurityXploded  Reverse Engineering, Malware Analysis, Memory Forensics 

File System Management File system management encompasses the provision of a way to store your data in a computer, as well as a way for you to find and.

Compatibility and Interoperability Requirements

14 Step-by-Step Instructions for an Upgrade Installation n Prepare for the installation Verify that all devices and applications are Windows 2000 compatible.

Mathieu Castets October 17th,  What is a rootkit?  History  Uses  Types  Detection  Removal  References 2/11.

CAP6135: Malware and Software Vulnerability Analysis Rootkits Cliff Zou Spring 2012.

1 CHAPTER 5 DIFFING. 2 What is Diffing? Practice of comparing two sets of data, before and after a changed has occurred Practice of comparing two sets.

Troubleshooting Security Issues Lesson 6. Skills Matrix Technology SkillObjective Domain SkillDomain # Monitoring and Troubleshooting with Event Viewer.

Panda Anti-Rootkit & password storage tools

Homework tar file Download your course tarball from web page – Named using your PSU ID – Chapter labeled for each binary.

The world leader in serving science Overview of Thermo 21 CFR Part 11 tools Overview of software used by multiple business units within the Spectroscopy.

Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #8 File Systems September 22, 2008.

 Introduction  Tripwire For Servers  Tripwire Manager  Tripwire For Network Devices  Working Of Tripwire  Advantages  Conclusion.

Lecture 5 Rootkits Hoglund/Butler (Chapters 1-3).

Rootkits Jonathan Barella Chad Petersen. Overview What are rootkits How do rootkits work How to detect rootkits How to remove rootkits.

CHAPTER 3 Securing your PC and LAN Suraya Alias. Securing your desktop or Notebook Computer ◦Know an access control ◦Limit use of the administrator accounts.

IDS And Tripwire Rayhan Mir COSC 356. What is IDS IDS - Intrusion detection system Primary function – To monitor network or host resources to detect intrusions.

On the Analysis of the Zeus Botnet Crimeware Toolkit H. Binsalleeh, T. Ormerod, A. Boukhtouta, P. Sinha, A. Youssef, M. Debbabi, and L. Wang Presented.

Windows XP File Systems

Microsoft /6/ :30 PM BRK3293 Explore adventures in the underland: Forensic techniques against hackers evading the hook Paula Januszkiewicz.

Rootkit A rootkit is a set of tools which take the ability to access a computer or computer network at administrator level. Generally, hackers install.

Windows Internals Brown-Bag Seminar Chapter 1 – Concepts and Tools

IS3440 Linux Security Unit 9 Linux System Logging and Monitoring

Rootkits Jonathan Hobbs.

File System Management

Presentation transcript:

BlackHat Windows Security 2004 Data Hiding on a Live System by Harlan Carvey

Purpose  Present/discuss different techniques for hiding data on LIVE systems (NTFS)  Address methods of preventing and detecting this activity  What is NOT covered?  Maintenance tracks, boot sector, file slack, etc.

What is being hidden?  Data  Text  Output of commands (samdump, etc.)  Executables  Programs  Games  Rootkits

Who are we hiding it from?  Other users  Administrators  Investigators/forensics analysts

Altering files  File Changes  Name  Extension  Information regarding extensions and associations is maintained in the Registry  ‘assoc’ command  File Signature (this is NOT a hash)

Altering Names/Extensions Samdump.log -> C:\winnt\system32 \MSODBC32.DLL

Altering file signatures  First 20 bytes of the file  Change JFIF/GIF89a in graphics file to something else  Executables (.exe,.dll,.sys,.ocx,.scr) begin w/ “MZ”  Sigs.pl performs signature analysis

DOS Attributes  'Attrib' command  Explorer settings  'dir' switch (dir /a[:h])  Perl ignores (opendir/readdir, glob)  hfind.exe (FoundStone)

File Splitting  File Splitting  Almost as old as DOS  Many programs available  Malicious uses

File Splitting Original File Arbitrarily sized segments

“touching” files  Alter the creation, last access, last modification dates  'touch' in Unix  Microsoft SetFileTime() API  Used to hide from search tools  dir /t[:a]  afind.exe (FoundStone)  macmatch.exe (NTSecurity.nu)

File Binding  Elite Wrap  Saran Wrap, Silk Rope

OLE/COM  MS OLE/COM API  “Structured Storage”, “Compound files”  “File system within a file”  MergeStreams Demo  May discover using “strings” or “grep”  wd.exe

NTFS Alternate Data Streams  NTFS4 (NT) and NTFS5 (2K)  Creating  Using  Running executables hidden in ADSs  NTFS4 vs. NTFS5

Creating ADSs  Type command  Type notepad.exe > myfile.txt:np.exe  Cp.exe from Resource Kit  Bind to file or directory listing  Notepad myfile.txt:hidden.txt  Notepad :hidden.txt

Executing ADSs  Running executables hidden in ADSs  Native methods  NTFS4 - ‘start’ (FoundStone)  NTFS5 - several methods

Detecting ADSs  lads.exe, by Frank Heyne (heysoft.de)  sfind.exe (FoundStone)  streams.exe (SysInternals)  ads.pl (Perl)

Encryption  PGP  Fcrypt (ntsecurity.nu)  Perl (Crypt::TripleDES)

Steganography  The art of hiding information  S-Tools4 

Registry  Licensing information  Software installation dates and information  Contains binary and string data types

"Hidden" Functionality  Registry keys  Used by various malware  The ubiquitous "Run" key  Services  ClearPagefileAtShutdown Registry key  StartUp directories

Rootkits  Kernel-mode vs. user-mode  API Hooking/DLL Injection  NTRootkit  HackerDefender (DLL Injection)  AFX Rootkit 2003 (DLL Injection)  Vanquish (DLL Injection)  FU (DKOM)

How to prevent/detect  Configuration Policies/Management  Monitoring  Event Logs  Additional monitoring applications  Scans

Questions?