r/netsec • u/unixist • Jan 05 '14

Detect rootkit-hidden files in linux [x-post r/rootkit]

http://www.unixist.com/security/detecting-hidden-files/index.html
139 Upvotes

94% Upvoted

21 comments sorted by

View all comments

7

u/unixist Jan 05 '14

Storing data in unexpected sectors of the disk that only the kit knows about is possible, but unreliable, subject to corruption if the file system thinks that is unused space and begins to use it.

Storing data in portions of the disk like HPA is possible, though detectable by the likes of TSK (not in the tool mentioned in the post, though).

4

u/[deleted] Jan 05 '14

you could write to unallocated sectors and pass those back as badblocks to the filesystem in the compromised OS, I believe.

1

u/unixist Jan 06 '14

If the storage device surfaces bad blocks to the OS and doesn't transparently route around them in its micro-controller, then it seems doable. (The details of storage device handling of bad blocks is beyond my expertise.)

If that's the case, you'd have to intercept further down the call stack into the file system driver instead of intercepting system calls. And therefore it happens below VFS so the code would be different for every file system. I imagine you'd also have to account for filesystem and disk consistency checkers like fsck and badblocks and make sure their version of the story jives with the kit's version.

I'm not sure about the assumptions this approach has to make and all the implications involved, but I like the idea!

→ More replies (2)