Alternate Data Stream - Hidden Files in NTFS

Hey Hey

I've been talking to phishphreek and brought this up.. Since neither of us had seen it on AO before and he'd never heard of it.. I figure I'll post it on here. It's older news now... Can't remember the exact place i found it originally but it was prolly an issue of phrack... If this has been posted before I apologize, but neither of us were able to find it on here...

Anyways It's a paper entitled The Darker Side of NTFS and it deals with the Alternate Data Stream which MS added to allow for communication with HFS (The MAC File System).

To give you a brief summary:

Using a few varying techniques, hide a file by attaching it to another file. This hidden file will not be seen by doing a directory listing in the command prompt, or in explorer. The file can only be found using third party software (a link is in the attached article). This file can be executed while it is hidden and will show up in taskmanager as the file it is attached to. So if I were to hide virus.exe in explorer.exe and then run the hidden virus.exe your task manager would simply show a second copy of explorer.exe running. This is obviously a very big risk.

Anyways here's the complete article. The Darker Side of NTFS

So what exactly are the ways of detection?

As far as I know.. LADS is the only current app available for detection (mentioned in the article). It is available for download here.

Ahh.. that's quite intriguing. Nice source, thanks!

Quote:

---

Originally posted here by HTRegz
As far as I know.. LADS is the only current app available for detection (mentioned in the article). It is available for download here.

---

I am aware of TDS-3 from DiamondCS at http://tds.diamondcs.com.au/

It checks for ADS in NTFS files as well as a superb Trojan scanner.

Thanks for the update adm77..

It looks like a great program.. however they do want money for it... lads is a console based app and is freeware. So it gives admin's a bit of an advantage, they don't have to pay for it and they can easily add it to scripts.

However TDS-3 looks great and definately has a lot of great features.. I'll have to try it out at some point.

Now I'm intrigued.... I'll be checking out LADS :)

Thank you HTRegz !

I believe SFind from Foundstone also "detects" hidden file streams http://www.foundstone.com/resources/...ic-toolkit.htm

Ammo

To the person left the AP "When in doubt, use AFS".. it was a grey dot.. I don't really care which it was supposed to be.. but I wanted to address that comment.

Windows machines run NTFS or FAT32, MACs use HFS (not really sure if there's another FS they can use)... I'd love to see you get the Windows OS to run on AFS... The Andrew File System is a network file system which is fine if you just want a bunch of stored files... you can view them as network drives in Win32... however if you just want to network your MAC and your PC.. then this wouldn't be an option... and if you were using NTFS for the ADS support.. then you'd leave yourself open the ADS vulnerability.

You don't have to use filesharing with a mac. ADS are part of NTFS (4 and 5). So if you use NTFS (like any good sysadmin should) you are vulnerable to abuse by ADS. Even if your box is just a stand-alone machine.

What I find quite anoying about all of this is there is no way to turn this 'feature' on or off :(

Nice post. Never heard of this before. I will definatley be doing some research

Ok, I haven't yet had the time to test this out but...

Some people have posted links to programs that will find the data in ADS.

I wonder if linux would find it too? Since it ignores all file attributes and etc.

You could then just boot to a knoppix and look for the files there.

Although... a utility that is designed to specifically look for these files would be a lot easier to use than comparing file lists from the windows view and linux view.

Also... since these files are hidden completely (I'd assume until run in memory)... would an antivirus scanner be able to pick up a virus or trojan if it was just stored oh the hard disk or would it pick it up after/as it was being run?

Yes, streaming is *very* difficult to detect.

OK gang, now that you know about streaming, here is some technical details that you need to know about.

To stream a file, you'll need the POSIX utility CP from the NT resource kit. The syntax to hide a file is as follows:

cp nc.exe hidden.file:nc.exe

This hides nc.exe in the nc.exe stream of hidden.file.

To unstream netcat, simply type this:

cp hidden.file:nc.exe nc.exe

Now that you can stream a file, try to see if your favorite virus scanner can pick up an infected streamed file. The results may surprise you ;)

A few more notes on streaming that are important:
1) The mod date on hidden.file changes but not the size. This makes streamed files difficult to ferret out.
2) Deleting a streamed file involves copying the front file to a FAT partition, then copying it back to NTFS
3) Streamed files can be executed while hiding behind the front file but cannot be executed directly due to limitations in CMD.EXE. You need to use the start command to launch it:

start hidden.file:nc.exe

Anyway, hope this adds dome value to the thread here.

--TH13

Quote:

---

Originally posted here by phishphreek80
Also... since these files are hidden completely (I'd assume until run in memory)... would an antivirus scanner be able to pick up a virus or trojan if it was just stored oh the hard disk or would it pick it up after/as it was being run?

---

Most (if not all) do not check the ADS. Maybe an on-access scanner can pick it up when it actually gets executed.

This should be easy to test. Just stream the EICAR test file behind say notepad and scan your machine.

Quote:

---

Originally posted here by thehorse13
To stream a file, you'll need the POSIX utility CP from the NT resource kit.

---

If you cannot run POSIX (because you killed it) try using Perl:

#!/usr/bin/perl

open(SRC, "<file2stream");
open(DEST, ">notepad.exe:hiddenstream");

@stream=<SRC>; #suck it in

print DEST @stream;

close(SRC);
close(DEST);

Yeah, I found this a very interesting thing when I found out about it. I learned about it through a Tripwire Seminar - I think it was called "The Art of Hacking." Anyways, I pasted in the thread I posted before.

Alternate Data Streams

You guys definitely bring up some interesting thoughts. Nice!

Oh, by the way, Tripwire picks up the ADS files also. When I found out about them, I stumbled upon lads, and it was a great tool.


Cheers,


t2k2

I think all bases have been covered by this thread, and the articles listed. I would like to add one thing though - and thats why ADSs exist in the first place.

ADS is supported by NTFS for compatability with the MAC OS. MACs use the ADS to determine the file type and to store application associations with those file types (such as associating MS WORD with *.DOC files). Windows, as we all know, uses the 3 character file extension.

This doesn't make any difference to the threat of ADSs, or how to deal with them, but I thought it might be useful background anyway.

Cheers all.

Alan Mott