43:54
Simple Linux Forensics Christchurch Hacker Con 2017 With Craig Rowland From Sandfly Security
Sandfly Security
Overview
This video focuses on practical, basic Linux forensics for detecting suspicious activity, emphasizing that attackers often leave traces even with sophisticated methods. The presenter, Craig Rowland, advocates for prioritizing common attack indicators over complex, marketing-driven threats like advanced persistent threats (APTs) and zero-day exploits. The core message is that by understanding how attackers hide and by using readily available Linux commands, defenders can effectively identify compromises by looking for anomalies in directories, files, and running processes. The presentation aims to equip viewers with the knowledge to perform quick, effective "fast forensics" on Linux systems.
How was this?
Save this permanently with flashcards, quizzes, and AI chat
Chapters
- Defenders face a 'thousand-to-one' disadvantage: attackers only need one successful entry method, while defenders must secure thousands.
- Once inside, attackers need to cover their tracks using thousands of methods, creating opportunities for detection.
- Prioritize common, simple attacks (CRAP: Commonly Run Attacks Preferred) over rare and expensive advanced threats.
- Advanced attacks are often specific to system configurations and can be brittle, while common attacks are reliable and widely applicable.
Understanding this fundamental asymmetry helps prioritize defensive efforts and avoid being distracted by low-probability, high-complexity threats.
Instead of worrying about a million-dollar zero-day exploit, focus on spotting common misconfigurations or easily exploitable vulnerabilities that attackers frequently use.
- Attackers often hide tools and data in common system directories like /tmp, /dev, /var/log, and /bin.
- Suspicious directories may mimic legitimate ones but can be identified by unusual permissions, creation times, or naming conventions.
- Using `ls -lp` can reveal hidden characters or spaces in directory names that might otherwise be missed.
- Extended file attributes, such as the 'immutable' flag set using `lsattr`, can indicate attempts at persistence and should be investigated.
Recognizing common hiding places and subtle anomalies in directory structures is a primary step in uncovering malicious activity.
A directory named 'space' or containing unusual characters like '.. ' (dot dot space) within a system directory is highly suspicious and warrants further investigation.
- Attackers frequently tamper with or delete audit logs (e.g., wtmp, lastlog, btmp) to cover their tracks.
- Zero-byte log files or logs with identical, suspicious timestamps can indicate log cleaning attempts.
- Files that are not what they appear to be, or binaries in unusual locations (like /tmp), are red flags.
- Tools like `rpm -Va` (Red Hat) or `debsums` (Debian) can identify modified system files.
Log files are critical for understanding system activity; their integrity is paramount, and tampering is a strong indicator of compromise.
Finding a syslog file that has been zeroed out, or a btmp file showing no failed login attempts on a system exposed to the internet, suggests malicious activity.
- Suspicious processes might appear legitimate but have unusual characteristics like unexpected open ports (especially raw sockets) or high PIDs.
- Processes running from non-standard locations such as /dev or /tmp are highly suspect.
- The `/proc` filesystem provides detailed information about running processes, including their executable path and whether they've been deleted from disk.
- The `strings` command can reveal embedded text within binaries, potentially exposing network connections, commands, or hidden directories used by malware.
Running processes are the active components of an attack; identifying anomalies here is crucial for detecting ongoing malicious operations.
A process named 'apache' running on port 2222, utilizing a raw socket, having a very high Process ID, and originating from the `/dev` directory, is a strong indicator of a backdoor.
Key takeaways
- Focus on detecting common, simple attacks before worrying about advanced threats.
- Attackers, even skilled ones, often leave detectable traces in directories, files, and logs.
- Familiarize yourself with basic Linux commands (`ls`, `lsattr`, `strings`, `netstat`, `ps`, `rpm`, `debsums`) for forensic analysis.
- Anomalies in system logs (tampering, zeroing, unusual timestamps) are strong indicators of compromise.
- Processes running from unusual locations or with unexpected network activity warrant immediate investigation.
- The `/proc` filesystem is an invaluable resource for understanding process behavior and detecting deleted binaries.
- Careful attention to detail and understanding normal system behavior are key to spotting deviations.
Key terms
Intrusion Detection System (IDS)Intrusion Prevention System (IPS)Advanced Persistent Threat (APT)Zero-day exploitRootkitImmutable flagExtended file attributesAudit logs (wtmp, lastlog, btmp)Process ID (PID)Raw socketProc filesystemStrings command
Test your understanding
- Why is it more effective to focus on 'Commonly Run Attacks Preferred' (CRAP) rather than advanced threats?
- What are some common Linux directories where attackers might hide malicious files, and how can you identify suspicious activity within them?
- How can tampering with or deleting log files be an indicator of a security breach, and what specific log files should be checked?
- What characteristics of a running process might suggest it is malicious, and what tools can be used to investigate further?
- Explain the significance of the `/proc` filesystem in identifying compromised processes, particularly those that have been deleted from disk.