Linux Blog

Introduction to Investigating Unknown Files on Linux

Filed under: General Linux — TheLinuxBlog.com at 12:00 pm on Saturday, December 20, 2014

Introduction

This article was written by Adam Palmer, a Linux Consultant. It covers the first few steps in basic Linux forensic work – investigating unknown files. Linux provides a range of powerful tools to investigate files and filesystems.

Preparing an Environment

First and foremost, before performing any kind of forensics work on Linux, it’s important to set up a usable environment. Even if you intend to perform ‘read only’ actions, and not run any binaries for example, buffer overflows and other exploit vectors have existed in the tools we’ll be using and so running them on maliciously crafted files could result in a system compromise.
If you intend to analyze files, I recommend using a sandboxed virtual machine with no networking access. The virtual machine should be destroyed and recreated as required. If you plan to analyze a hard disk, I recommend using a write blocker to ensure that nothing can physically be altered on the disk under investigation.

Finding File Type & Status

Using the `file’ utility, we can match the file’s header to a known database:

root@kali:~# file rack.png
rack.png: PNG image data, 576 x 576, 8-bit/color RGBA, non-interlaced

Using the `stat’ utility, we can find out permissions, as well as disk, inode and meta information on the file:

root@kali:~# stat rack.png
  File: `/opt/metasploit/apps/pro/ui/vendor/bundle/ruby/1.9.1/gems/rack-1.4.5/contrib/rack.png'
  Size: 23805     	Blocks: 48         IO Block: 4096   regular file
Device: 801h/2049d	Inode: 6165        Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2014-12-04 23:45:51.087400697 +0000
Modify: 2013-04-17 20:50:40.000000000 +0100
Change: 2013-04-27 18:10:38.317049114 +0100
 Birth: -

Hexdump

Let’s confirm the `file’ output. According to Wikipedia’s entry on PNGs, a PNG begins with an 8-byte signature: 89 50 4E 47 0D 0A 1A 0A. Let’s use `hexdump’ to confirm this:

root@kali:~# hexdump -C -n8 rack.png 
00000000  89 50 4e 47 0d 0a 1a 0a                           |.PNG....|

Note the arguments provided. -C will print the ASCII data alongside the hexdecimal output, whilst -n8 displays 8 bytes.

Strings

Using `strings’, we are able to locate any ASCII printable strings within a file:

root@kali:~# strings rack.png
IHDR
sRGB
bKGD
	pHYs
tIME
[...]

In this case, there’s little of interest to see, however let’s look at running `strings’ on an executable binary:

root@kali:~# strings /bin/ls
[...]
Try `%s --help' for more information.
Usage: %s [OPTION]... [FILE]...
List information about the FILEs (the current directory by default).
Sort entries alphabetically if none of -cftuvSUX nor --sort is specified.
Mandatory arguments to long options are mandatory for short options too.
  -a, --all                  do not ignore entries starting with .
  -A, --almost-all           do not list implied . and ..
[...]

Interesting.. strings can be used to uncover hidden printable ASCII.

Linked Libraries

Using `ldd’, we can investigate any shared libraries that have been linked in:

root@kali:~# ldd /bin/ls
	linux-gate.so.1 =>  (0xb77a7000)
	libselinux.so.1 => /lib/i386-linux-gnu/libselinux.so.1 (0xb776c000)
	librt.so.1 => /lib/i386-linux-gnu/i686/cmov/librt.so.1 (0xb7763000)
	libacl.so.1 => /lib/i386-linux-gnu/libacl.so.1 (0xb7758000)
	libc.so.6 => /lib/i386-linux-gnu/i686/cmov/libc.so.6 (0xb75f5000)
	libdl.so.2 => /lib/i386-linux-gnu/i686/cmov/libdl.so.2 (0xb75f1000)
	/lib/ld-linux.so.2 (0xb77a8000)
	libpthread.so.0 => /lib/i386-linux-gnu/i686/cmov/libpthread.so.0 (0xb75d8000)
	libattr.so.1 => /lib/i386-linux-gnu/libattr.so.1 (0xb75d2000)

Tracing system calls

Using `strace’ we are able to trace system calls. If running an unknown binary, it is especially important to perform this step within a safe sandboxed environment. `strace’ sends its output to stderr, and so we’ll need to redirect that to stdout before being able to work with it using standard stream utilities such as `grep’. Let’s look at any open calls made when running `/bin/ls':

root@kali:~# strace -f /bin/ls 2>&1|grep "open"
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/i386-linux-gnu/libselinux.so.1", O_RDONLY) = 3
open("/lib/i386-linux-gnu/i686/cmov/librt.so.1", O_RDONLY) = 3
[...]

The listed entries are required libraries being opened

Further research

Further steps in debugging binaries can be achieved through `ltrace’, `gdb’, `objdump’ and `ndisasm’. Some of these tools have a significant learning curve however enable detailed debugging of unknown binaries

Media Purge

Filed under: General Linux,Linux Software — TheLinuxBlog.com at 8:23 pm on Tuesday, September 16, 2014

In order to reduce the amount of crap stuff I have laying around, in addition to making a box of old hardware to donate, I’ve been going through old Linux CD’s. Deciding which ones to pitch was a harder task than I first thought, so I figured I’d take a methodical approach to it. The criteria was this:

Have I:

Used it recently?
Ever used it?

Does it:

Have a download available?
Have a current community?
Contain customized content?
Have a special meaning?

Will:

I ever use it?
Someone else be able to use it?

Since most of these were burned disks, the only reason to keep something would be if it is not available anymore, has a special meaning, or I’ve used it a bunch and it contains customized content. Based on this, I’ve decided to pitch (in no particular order)
(Read on …)

Raspberry Pi – Awesome!

Filed under: General Linux,Linux Hardware — TheLinuxBlog.com at 3:17 pm on Thursday, October 24, 2013

Raspberry Pi

I never jumped on the Pi bandwagon, sure I thought it was cool but when I wanted one, there were supply demands and the want wore off. I recently purchased a Model B revision Two and have to say I’m very impressed. It is an awesome piece of hardware but what really makes the Raspberry Pi great is the community that has been built around them. There are many projects and tutorials based and plenty of hackers working on tweaking and expanding them. Here are a few of my favorite projects, incase you’ve been living under a rock for the past couple of years like me:
(Read on …)

It is almost July!

Filed under: General Linux,The Linux Blog News — TheLinuxBlog.com at 11:54 pm on Tuesday, June 25, 2013

Since I haven’t posted in a while I figured I would, and hopefully start a new trend of writing again. I started a new job last year and had my wife gave birth to our first born in November 2012, since then my time has been somewhat limited, balancing work, life and play. If you take a look at the archives, it is not the first time I’ve taken a multiple break from this Blog.

Well, it’s almost July and you know what that means right? Yep, Google will be shutting down Reader. Their decision never made sense to me since my Feedburner, another Google product statistics show that 90% of my subscriptions are through the Reader service, there are alternatives.

While most people have migrated to other services, those that haven’t should consider doing so, or at least export their feeds to subscribe at a later time.

There are great desktop applications available for most platforms, but I wanted an online reader to sync feeds across multiple machines and read from different locations without having to mark content as read multiple times. The most viable online alternatives to me were Feedly, and TheOldReader.com. The Old Reader won in the end after adding standalone authentication. The interface is familiar as it is pretty much a clone of Google Reader, even the same keyboard shortcuts work.

I hope that when you do find the new feed reader of your choice, you continue to subscribe to TheLinuxBlog, and although it may have been stagnant for a while, I have not abandoned it.

The First Unreal Engine 3 Game Ships for Linux

Filed under: General Linux,Linux Software — TheLinuxBlog.com at 1:23 pm on Friday, January 25, 2013

Guest Post From Davis Miller

Score! a HUGE victory for Linux gaming in 2013! Ryan Gordon confirmed via Twitter that “Dungeon Defenders is an Unreal Engine 3 game on Linux, and it’s the first thing I’ve shipped with SDL 2.0!” The launch of Humble Indie Bundle 7 is a tower defense and action oriented role playing game that was originally designed and released for the standard PC in 2011. Though it began as a development for Unreal Engine 3, it now has a native Linux port.

unreal-engine

The reality of Linux gaming has been in question for years. Interested parties jump in, and then jump out. Plagued by technical and developmental problems, Linux gaming technology has taken nothing more than baby steps over the years. The recent strides leading up to the shipment of a Linux ported games have happened incredibly fast, with no signs of slowing in the near future. (Read on …)

Buy Vs. Build Vs. Cloud

Filed under: General Linux,Linux Software — TheLinuxBlog.com at 12:31 am on Wednesday, January 23, 2013

When a company needs a piece of software there is lots of open source software available that may suit their needs. But what happens when there isn’t?
Lets take a look employee performance evaluation software (like this) for example. To build a full featured business supporting application like this is no easy task. Lets weigh in the options:

Build It
There is always the option to build software, depending on the complexity this option can cost a lot of money. You need to either build from scratch, use a framework or modify an existing open source project. Some corporations have the funds for hardware, a development team, system administrators and support team. Those that dont are pretty much left with the buy or cloud solutions.

Buy it
If building isn’t an option due to cost another is to buy. Software support and hardware are sometimes additional costs buying is a viable option depending on the application. What is often the case for small to medium sized companies, a piece software will not feature what they need, while having 90% of everything else. This can lead to leaving critical business functions out, or even a hodgepodge of multiple versions of software that do the same thing.

Cloud / hosted solitions.
For certain applications “heading to the cloud” can be a smart way to go. Not having in house hardware to inventory and maintain is one benefit, and access from multiple locations is another. With the vendors providing support. One concern is security, although this is the same with tbe build/buy options that is often overlooked.

While off the shelf products may exist there are still expenses where choosing the hosted solution may turn out more cost effective.

10 Amazing Productivity Tools You Can’t Live Without

Filed under: General Linux — TheLinuxBlog.com at 1:30 pm on Tuesday, December 18, 2012

This is a guest post from Ella.

As a small business owner, the Internet has changed the way I collaborate and work with my colleagues, contractors and clients. The business world is becoming more global all the time, and collaboration and communication are more important than ever.

Check out these slick little tools (some familiar, some new) that can help you stay on top of things and make working together across the Web a breeze.

(Read on …)

Top 10 Android Applications for 2012

Filed under: General Linux — TheLinuxBlog.com at 1:00 pm on Wednesday, December 5, 2012

Here is another post from Brianne on her top 10 Android application picks for 2012. Being an Android user myself these aren’t my top 10. Mine, without descriptions are: ConnectBot, androidVNC, Sipdroid, AndSMB, ColorNote, PocketCloud, FreeMP3Droid, ViewRangerGPS, VirtualRecorder and TeslaLED. Feel free to list your top 10 or suggestions in the comments! So without further ado, here’s her take:

Stay organized on the top of your busy lifestyle with these productive Android apps. The apps on this list tend to make your life simple, easy and eliminate time-consuming procedures. Make sure to install them to increase your productivity.

  1. Xbox SmartGlass

Xbox SmartGlass from Microsoft turns your android into an ideal second screen to navigate around the Xbox 360 dashboard and makes your entertainment experience more amazing. You can easily control what you’re watching with simple swipe and tap gestures. Xbox allows you to access the relevant details about a movie, game or TV show. It also lets you to easily move your purchased movies and TV shows between your PC and your Xbox 360. Xbox through its intelligently connected devices make things easier for you.

2. Soundcloud- Version 2.3.0

Soundcloud is the best app for recording interviews or your favorite music on-the-go. It lets you sync all your recordings to the Cloud so that you can share them publicly on Facebook, Twitter and Foursquare or keep them as private. The latest version makes it easy to explore and post likes and comments on sounds right from your smart phone. It helps you to access user profiles and keep track of your followers and followings.

3. Opera Mini – Version 7.5

Opera mini offers the most refined browsing experience for your android phone. It’s rendering speed and efficient controls put it on the top of other browsers. Its streamlined rendering engine helps you load Webpage’s quicker than any other browser. Just as you do with your PC, you can open several pages at a time and switch between them using tabs. Opera Mini helps you save money on your phone bills by compressing data by up to 80%.

4. Cloudon

Cloudon brings Microsoft Office to your Android phone. It allows you to easily format text, change fonts, insert formulas in Excel and present your Power Point slides. It enables you to view and fill out PDFs from your workspace. With a simple tap you can have your files appear in your workplace. Cloudon lets you create copy or move files between folders. All your documents are saved automatically.

5. CamScanner

This app is a must have for android phones. If you’re on the go and need to capture documents such as interesting newspaper articles, whiteboard sketches, tickets, coupons and so on, consider using CamScanner app. This app turns your Android phone into a portable document scanner. It uses the camera at the back of your android to take the snapshots of the documents. The images scanned by CamScanner are already edited. Its in-built tools enhance the appearance of the scanned image. What’s more, you can easily convert the scanned documents to PDFs, especially when you want to share it. You are allowed to tag the scanned documents so that they are easy to locate and manage.

6. TeamViewer- Version 7.0.632

Teamviewer lets you remote control your computer while you are on the go. You can participate in meetings from your android phone, no matter where you are. Thus it helps you from missing out an important discussion. It also offers you the benefit of accessing your home PC to edit or use particular documents while you are away from home. The app helps you provide remote technical support to friends and family when they have problems with their device.

7. TRUECALLER – VERSION 2.92

Truecaller app functions as a global phone directory helping you to locate people worldwide by just entering a name or phone number. It quickly notifies you who the caller is and blocks unwanted calls. The app manages your phone book and keeps you informed of your friend’s latest Facebook pictures.

8. Fandango Movies – Version 4.1.1

This app allows you to easily browse the movies or theaters by selecting them. On selecting a movie, you can access its information like the rating, length, fan reviews, trailers and so on. If you select a theater, you will be informed of its address and phone number. You can book your seat directly from this app and step into the theater just before Showtime.

9. Zillow Real Estate

This is the best app that provides you with a better idea of current values and trends in housing. Zillow’s database helps you browse apartments and homes that are for sale or rent. The new version lets you take snapshots of your favorite homes and sync them to your online account. It keeps you updated when new homes with your criteria hit the market. Enjoy home shopping on the big screen.

10. SwiftKey 3

SwiftKey app makes typing easy and accurate over time. It saves your time and effort by magically predicting the next word before you’ve started to type. You can also personalize this app with your Gmail or Facebook accounts.

About the author: Brianne is a blogger by profession. She loves writing, reading and traveling. She contributes to Raul Antonio Gorrin

 

LINUTOP 2 Review

Filed under: General Linux,Linux Hardware,Linux Software — TheLinuxBlog.com at 11:08 pm on Friday, November 9, 2012

Linutop is a company based out of Paris that specializes in small form factor energy efficient embedded type PC’s. They have  a variety of devices with no moving parts and utilize open source software based on Ubuntu for the platform. They were kind enough to send me a Linutop 2 to review.Linutop 2


(Read on …)

How Android apps are useful to get new blogging ideas

Filed under: General Linux — TheLinuxBlog.com at 9:51 pm on Thursday, October 18, 2012

 

This post is a guest post written by Brianne. She is blogger by profession. These days she is working on online promotion for Go Pilot

It is true that the bloggers will need some applications which will help them to connect with their blogging on the move. So the Android applications come handy in this connection. Moreover, you will keep touch always through these applications with your blog. Since, the Android applications provide the ample advantages to the bloggers. Even, these Android applications will give you an extra fillip for running smoothly your blogging habit. 

(Read on …)

File Cleanup Tools and Tactics

Filed under: General Linux,Linux Software,The Linux Blog News — TheLinuxBlog.com at 10:35 pm on Wednesday, August 8, 2012

Ok, I’ll admit it; I’m a digital hoarder. I’ve had this problem for a while where I can’t seem to delete stuff. Perhaps its files I’ve created, stuff I’ve downloaded, backups, or backups of backups but files seem to accumulate faster than I can keep up with organizing them. Throw this on top of system re-installs and, being the family geek backups of family members and freelance work to be honest, I’m a bit overwhelmed!

Well, it stops today! At least the start of organization that is. I’ve written in the past about spring cleaning tools, recursive md5sum scripts and tools like md5deep but nothing really came of it. It’s time to take action and get stuff organized. Now I’ve admitted it publicly, I’m sort of obligated to get in control of my digital life and so the voyage begins.

Stay tuned for more posts on digital organization techniques and tools!

Next Page »