Journey down bmap lane.

Bmap is quite the obscure tool. (reference) Not only is it difficult to find, but, good luck with any documentation. The --help is all you've got! I was able to find the source at packetstormsecurity but had problems compiling. But, we can fast forward to the part where it is working.

Hiding ASCII in Slack

Let me walk through the example that everyone uses for bmap with the file test.gif:

> du -sch test.gif

16.0K total

> echo "redleatheryellowleather" | bmap --putslack test.gif

>du -sch test.gif

16.0K total

>echo "redleatheryellowleather" > text

>du -sch text

4.0K total

So, we can see here, that there du command should be showing a change in the file size due to the slack data. Of which it is not.

>bmap --slack test.gif

getting from block 2051

file was: 13166

slack size: 3218

block size: 4096

redleatheryellowleather

>bmap --slack --outfile sometext test.gif

The 'outfile' option dumps the contents into the file sometext.

>file sometext

sometext: ASCII text

>less sometext

redleatheryellowleather
(it actually gave me a binary file but contained the phrase I was looking for)

The md5 hash of test.gif before and after slack space has been manipulated is exactly the same. However, the cp command does not copy slack. Which I just happened to stumble upon, but was interesting none-the-less. Knowing this, I decided to delete the file with slack space stuffed to see if magicrescue would restore the document with slack in tact. After the search, rescue and another cup of coffee the results are in. The document was recovered but the slack space was empty. This result makes sense. Magicrescue will carve out only the file contents. Which also leads me to believe that a file just stored in slack space will not be recovered by magicrescue as a lost document. Or will it?

Hiding Files in Slack

Hiding ASCII in slack space is similar to carving a file into slack space. Here's how I did it:

>bmap --carve ppt2.ppt | bmap --putslack test.gif

I am testing to see if magicrescue will find ppt2.ppt, thinking it is an unallocated file needing recovery. While working with magicrescue I have noticed that it only recovers data that needed to be recovered. Meaning, files that haven't been deleted don't appear in the results. Of course data that matches the mask you throw at it. So, if something is stuffed in a file's slack space and the file is still considered allocated space, my assumption is that it will get overlooked. Well, that assumption was correct. Multiple scans of one partition with data stored in slack recovered nothing. It did recover one document that was purposefully deleted, yet the slack data was missing.

Other tools?

I haven't found any other tools that detect slack space contents, in a limited amount of searching. Sleuthkit had the ability to search through slack space, but in recent revisions of the app ils, this feature was removed. (reference) Which makes this method of hiding information very tough to detect. I would rank this method of hiding data right up there with alternate data streams in terms of quick and dirty. Now, if anyone really wanted to hide something, one could couple these methods with encrypted filesystems...but that's a topic for another time.

Concluding Remarks

I feel as though I haven't even begun to scratch the surface with forensics. When at the same time, I really learned a lot. My goal out of this course was just to basically broaden my overall understanding of forensic analysis. That was accomplished. The two books proved for perfect stepping stones to get started. They focused mainly on case studies in forensic analysis and business aspects. Also, the details of inspections and analysis were discussed, which lead me down other avenues to research.

What I really liked about this course was the fact that I got to wear the white and the black hat. Answering questions like: How do you hide information? How do you hide information on different file systems? Now that it's hidden, how would you attempt to detect/find it? What tools are are used?

It wasn't until researching these topics that I found out about HPA space on hard disks, ext2 and ext3 slack space stuffing, and NTFS alternate data streams. These three areas are where I spent most of my time. Which lead to work with Sleuthkit, TCT, magicrescue, recuva, bmap and netcat. Each of these tools were fun to learn and essential for proper analysis.

This class piqued my interest again in studying forensics and security. Next semester I am going to be taking a course on the mathematics of encryption. Which sounds very cool! I'm hoping to pair up forensics and encryption to see if anything looks promising for a research topic.

Fun with ADS

I'm surprised how easy it is to hide data via alternate data streams (ADS) in Windows. It's a quick and dirty way of hiding information. However, you must know the exact file name in order to view the contents of the hidden document. It's kind of like the Room of Requirement in Hogwarts. If you don't know where it is, you can't get to it. Although, ADS data won't just reveal itself if you really need it, like the room will... did I go too far with the Harry Potter reference? Anyways, in order to test ADS, I decided to test out Identity Finder. Identity Finder is the application that ensures each workstation does not house any FERPA protected data. So, I would assume, that this application would be aware of alternate data streams or would simply detect something in an ADS file.

The Setup

I created two text files; one with the contents being "Hello World!", the other containing "ssn: 333-44-5555." Identity finder will flag any files with a social security number or a credit card number or anything close. I probably didn't even need to put the fake ssn in that format, as Identity Finder will flag any file with a 9 digit number in it. None-the-less, I did, and the file should be flagged.

Now, to ADS-ing a document. From the command line I ran:

> type ads_data.txt > doc1.txt:a.txt

Voila! That's it! An ADS file has been created. Again, while in a shell, if you run 'notepad doc1.txt', you will see "Hello World!" However, if you run 'notepad doc1.txt:a.txt' you will see the contents of the ADS file. The neat thing is that the containing folder only contains one document. That being the doc1.txt file. The alternate data stream is not visible at all. Pretty cool stuff huh? Well, I thought it was! Okay so ADS hiding is more like using the invisibility cloak than the room of requirement. And that will be my last Harry Potter reference.

Identity Finder Scan

So, now it's time to scan my machine to see if Identity finder would locate the ADS file. I separated the ads_data.txt and doc1.txt files into different folders just for safe keeping. The scan completed in approximately 2 hours. The end result is, insert drum roll here, Alternate Data Stream wins! Identity Finder flagged the ads_data.txt file, but did not catch the doc1.txt:a.txt file. I expected it to find something in doc1.txt. I thought Identity Finder would run a more thorough scan, but apparently it does not.

So, what's next?

I'm going to see if I can get bmap running and try to do some slack space packing. (I've got a copy of the BCCD, since I can't get it compiled on my own.)

References

http://www.windowsecurity.com/articles/Alternate_Data_Streams.html
http://support.microsoft.com/kb/105763
http://www.informit.com/articles/article.aspx?p=413685&seqNum=3
http://www.linuxsecurity.com/content/view/117638/49/

Document Found!

Here's the setup. I created a partition, placed a Microsoft Office created Word document in that partition. I then deleted the document and designated the partition as HPA space. Well, magicrescue doesn't care about HPA space, as it was able to recover the deleted file. Which makes me wonder why this is so easy to find? Also, what are other ways to hide data? Which brought me to these articles on ext2 and ext3 slack space, and NTFS Alternate Data Streams (ADS). Of course I can only find bmap on packetstormsecurity.com. Yet, I can't get it compiled correctly. (sgml2latex error....and you want to be my latex salesman?) What I really want to do is hide data with bmap and see if magicrescue can find it. Also, I would like to hide a file via ADS and see if Identity Finder can locate it on my work computer. Just hoping some things go correctly for me here in the next week and a half. I've had enough of Identity Finder breaking and Symantec Endpoint Protection bombing thus removing my network drivers. But, I digress....

Anyways, this is what I've been attempting to work on. Below are links to other articles I've been reading when I have had a chance. I've been busy with some other forensic-esk work at work lately. Anyone else find that Canadians like to try and hack php servers? I have a simple chat forum running for an event in our office that has been sluggish, to say the least. I attributed it to updates, but that wasn't the case. The error and access logs showed systematic attempts to find administrator login pages. Thousands of them in a short period of time. After blocking those individuals I'm still trying to figure out why it's slow. To be continued I guess.

Articles:

http://www.linuxsecurity.com/content/view/117638/49/
http://blog.crowdway.com/2009/04/15/hide-data-in-hidden-partitions/
http://www.docstoc.com/docs/13637545/Data-hiding-and-finding-on-Linux
http://www.wikistc.org/wiki/Slack_space_data
http://books.google.com/books?id=nEqHuVht7HgC&pg=PA92&lpg=PA92&dq=linux+hide+data+in+slack+space&source=bl&ots=bLewREp97f&sig=ejFTtjwomuaIYNXBOWnL0MYyZRA&hl=en&ei=_D30SryVPInENpmz_OgF&sa=X&oi=book_result&ct=result&resnum=5&ved=0CBQQ6AEwBA#v=onepage&q=&f=false

Holy Hidden Partition Batman...

Happy dance time, again! I've been unable to recover any Microsoft Office documents that I purposefully delete. Until now! The only difference is that the document was created in Microsoft Office and not in Open Office. Apparently something is different in the file format/file signature. Which will be an investigation for another time. What I'm going to do now is, hide the partition again. (designate HPA space) and run another scan on the entire drive. I know the size of the file, and document type. So, if magic rescue is able to read HPA space, I *should* find the document in the recovery reservoir. The only problem is, scanning 30 G is going to take 9+ hours. So, time to start the scan, and we'll see where we're at tomorrow!

More magicrescue...

Well, I'm having a difficult time finding any data that I have purposefully hidden or deleted. I'm using Open Office to create Word documents and saving them to a partition. Now, magicrescue is recovering several documents just not any of the documents I want it to find. Also, this is without the partition being declared HPA space. I'm going to try a couple of different things. First, create the documents in Microsoft Word. Each of the documents recovered were created in Microsoft Office, and I'm not sure if Open Office is the problem. I'm just trying to eliminate variables. Second, I'm going to try to search for something else, like jpeg's or pdf's. The problem isn't recovering data, it's recovering files I've purposefully deleted. So, if someone is hiding data in an HPA protected partition, I can find the partition and remove the HPA designation. (Thank you Sleuth Kit tools!) Yet, if there was data in the partition that was deleted, I'm having a tough time recovering it.

To be continued...

Oh by the way, it takes 61 minutes to search a 3G partition. Did I mention this machine was slow?

Magicrescue to the rescue

I've been running magic rescue on this machine since 9:00 am. It's currently 11:15 am and I have recovered 453 office documents and it is still not done scanning. Apparently, I should have used shred before I installed over Windows XP. None the less, it's recovering a lot of data, but, not the HPA hidden files yet.

Update: 1:52pm and it's still running. We're at 570 files and 336M. I might as well let it keep running. But, I'm going to try changing the options next time around. I'll probably tinker with the default block size, as well as create a recipe file for a gif image. It's picking up every type of Microsoft Office document...sigh...

To be continued...

Update: Well it has finished scanning! Yay! I wish I would have timed it, as I am not sure when it finished Friday night or Saturday morning. The problem now is sifting through all the 1073 files recovered. Only 207 of which are Word docs. If I was thinking, before I deleted the files from HPA space, I would have noted the file size. Oh well, now I'm manually checking to see if the files were recovered. I'm also going to unhide the HPA partition and just run magic rescue just on that partition. We will see if that makes a difference.

Happy Dance!

Preparation
Well, I'm actually getting somewhere with the HPA project now. I had to do a fresh Debian 5.0.3 install, as recovery wasn't working from my latest error. Although, this was inevitable as I didn't have the drive partitioned correctly. Or, as the HPA project needed. So, here is a look at the drive.


#>sfdisk -luS

Disk /dev/hda: 3648 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0

Device Boot Start End #sectors Id System
/dev/hda1 63 16064 16002 83 Linux
/dev/hda2 16065 1975994 1959930 82 Linux swap / Solaris
/dev/hda3 * 1975995 52757459 50781465 83 Linux
/dev/hda4 52757460 58605119 5847660 83 Linux

The /dev/hda4 partition needs to be mounted manually. Which, is probably the way it would be if I were actually hiding data. A red flag would be raised instantly if /etc/fstab contained a partition that was inaccessible. So, I created a partition at the end of the disk, placed a couple images in it, now it's time to hide the partition.

HPA designation!
I have found a great new way to bomb your machine! Just run

#> ./setmax --delta 52757460 /dev/hda

Then try to do something simple like, oh, I don't know, browse the web. Slowly but surely the load on your machine will rise and lock everything up. It's kind of like a slow fork bomb, a la :(){:|:&};:. (Possible suggestion for a red team member at CDC?) It was actually kind of fun to watch the load slowly rise until it halted. Anyway, here's what went wrong. The instructions I have been following to hide data with HPA has an error. (http://niiconsulting.com/checkmate/2006/09/15/hiding-data-with-hpahost-protected-area-in-linux/) The instructions inform you to run, ./setmax --delta D /dev/hda, where D is the starting sector number you want to hide data. (or just designate HPA) I was running ./setmax --delta 52757460 /dev/hda and bombing my system. Thankfully a hard reboot and a restart fixed everything. The D does not indicate the sector number to start HPA space, it is the number of sectors *minus* the end-of-disk. Thank you code comments! So, essentially, I was trying to hide 27GB worth of space on a 30GB drive, when I wanted to hide 3GB.

Here is the command that worked to hide the data:

#>./setmax --delta 5847660 /dev/hda

And to unhide:

#>./setmax --delta 0 /dev/hda

SleuthKit has a handy tool that will detect HPA protected areas called disk_stat. When the partition was hidden disk_stat gave the following output:

#> disk_stat /dev/hda
Maximum Disk Sector: 58605119
Maximum User Sector: 52757459

** HPA Detected (Sectors 52757460 - 58605119) **

And when the data was visible:

#> disk_stat /dev/hda
Maximum Disk Sector: 58605119
Maximum User Sector: 58605119

I also tried to mount /dev/hda4 while hidden and received an error. Very cool!

Well now that the hide/unhide is possible I need to take it up a notch. I'm thinking. Delete the 2 pictures, rehide the partition, and see what I can find with magicrescue. That's on the agenda for today!