CastleCops® ADS question

Need help? Click here to register for free! Absolutely zero advertisements on this site!

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Forum FAQ

Usergroups

Profile

Select FavForums

ADS question
Goto page 1, 2 Next

All -> FavForums -> Rootkit Revelations

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

nosirrah

Security Expert
Special Response Team

Joined: Apr 19, 2006
Posts: 6301
Location: USA

Posted: Sat Jul 15, 2006 1:31 pm Post subject: ADS question

As many of you know I started fighting rootkits and the like a while back by removing drives and scanning them as slave drives to cripple the rootkit . I know that ADS are now often accompanying rootkits . What would be the best NON-antimalware methods for destroying ADS ? I heard renaming the system32 folder and naming it back could destroy one of them . From what I have read it sounds like ADS are kind of like a file that has been deleted . It is still there but NTFS isn't keeping track of it so it can be overwritten . Would cut and paste also copy the ADS or would (because it is not being kept track of) just be ignored ? What about defrag ?

AbuIbrahim

Security Expert
Special Response Team

Joined: Jan 18, 2006
Posts: 1930

Posted: Sat Jul 15, 2006 2:42 pm Post subject:

Here is an article on ADS that you will find very useful: http://www.bleepingcomputer.com/tutorials/tutorial25.html _________________ Microsoft MVP - Consumer Security 2008 An Invitation to Think - York University

wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd

Posted: Sat Jul 15, 2006 4:22 pm Post subject:

you might want to run this see what it finds ADSSPY Download Link _________________ Brycetechs new tut dvd http://tinyurl.com/2u7rpk The Pixel Palladium Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008

Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Posted: Sat Jul 15, 2006 6:57 pm Post subject:

So I take it ADS is a mechanism that can create rootkit-like files? I tried creating a few files as per Lawrence's tutorial but get "The filename, directory name, or volume label syntax is incorrect." Can I assume that ADS is not activated on my system?

plunx

Lieutenant

Joined: Nov 01, 2005
Posts: 194
Location: Sweden

Posted: Sat Jul 15, 2006 7:21 pm Post subject:

Ikeb wrote:

So I take it ADS is a mechanism that can create rootkit-like files? I tried creating a few files as per Lawrence's tutorial but get "The filename, directory name, or volume label syntax is incorrect." Can I assume that ADS is not activated on my system?

Hi Ikeb

As I understands it ADS is always active within NTFS volumes.

Example from F-Secure:
http://www.f-secure.com/v-descs/mailbot_az.shtml

Question:
As F-Secure remarks a file can support ADS or not and how is that
done....

EDIT It was "file system" within F-Secures description and that must be NTFS or not.

Symantecs description:
http://www.sarc.com/avcenter/venc/data/backdoor.rustock.a.html

The "gentlemens" at R--tkit.com also has some more about it.

regards
plunx

AbuIbrahim

Security Expert
Special Response Team

Joined: Jan 18, 2006
Posts: 1930

Posted: Sat Jul 15, 2006 7:30 pm Post subject:

It worked fine with me. You probably misstyped something. Is your root drive formatted with NTFS file system? _________________ Microsoft MVP - Consumer Security 2008 An Invitation to Think - York University

Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Posted: Sun Jul 16, 2006 4:52 am Post subject:

Ah! Not the root but I tried it on an NTFS-formatted volume and indeed ADS is active. Does this mean it's best not to format NTFS volumes?

plunx

Lieutenant

Joined: Nov 01, 2005
Posts: 194
Location: Sweden

Posted: Sun Jul 16, 2006 9:13 am Post subject:

Ikeb wrote:

Ah! Not the root but I tried it on an NTFS-formatted volume and indeed ADS is active. Does this mean it's best *not* to format NTFS volumes?

Hi Ikeb

If a "normal" user (also "educated" about risks) with "normal" surf/mail habits and a protected patched PC compare risks I would say that everyone should choose NTFS despite of ADS.

http://www.theeldergeek.com/ntfs_or_fat32_file_system.htm

If we also checks F-Secures PE386 description the bad guys uses alternative tacticts with or without ADS.

Quote:

When the rootkit driver is executed, it creates a copy of itself to an Alternate Data Stream - %SystemRoot%\system32:[random_number]. However, since the code does not seed the pseudorandom-number generator (code bug), the alternate data stream is always created as:

* %SystemRoot%\System32:18467

If the file system does not support Alternate Data Streams, the driver is installed to:

* %SystemRoot%\System32\Drivers\pe386.sys

Nevertheless it�s strange that ADS cannot be disabled........ ??

http://www.windowsecurity.com/articles/Alternate_Data_Streams.html

MS Basic:
http://support.microsoft.com/kb/105763

regards
plunx

wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd

Posted: Sun Jul 16, 2006 3:53 pm Post subject:

if you disable ads than you won,t be able to see mac computers. possibly Linux as well. since most servers are Linux unix based this may or may not be a problem, as packets are sent and received . but it would mean computers on a lan may or may not be able to see shared doc folders etc. but it would be nice if some security app could disable this. there may be a reason other than whats publicly release about ads and what they do that we are not being told. _________________ Brycetechs new tut dvd http://tinyurl.com/2u7rpk The Pixel Palladium Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008

plunx

Lieutenant

Joined: Nov 01, 2005
Posts: 194
Location: Sweden

Posted: Sun Jul 16, 2006 10:21 pm Post subject:

Hi Well, the challenge must be that also MS using ADS within XP SP2... One example https://www.kb.cert.org/vuls/id/743974 "Windows XP SP2 normally stores the zone information about downloaded files in an NTFS Alternate Data Stream. This is known as a Persistent Zone Identifier. " http://msdn.microsoft.com/workshop/security/szone/reference/objects/PersistentZoneIdentifier.asp Also another example with Kaskersky labs suite... http://www.viruslist.com/en/weblog?discuss=177727537 How good is Merinjs ADS stream tool ? ADS Spy http://www.merijn.org/downloads.html regards plunx

wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd

Posted: Mon Jul 17, 2006 12:18 am Post subject:

Quote:

How good is Merinjs ADS stream tool ? ADS Spy
http://www.merijn.org/downloads.html

it comes up completly clean on this computer witch could mean its clean.
it could mean its not seeing or reporting all ads
could mean a rootkit is hideing them....

_________________
Brycetechs new tut dvd http://tinyurl.com/2u7rpk
The Pixel Palladium
Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008

negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Posted: Mon Jul 17, 2006 1:05 am Post subject:

I used ADS Spy to remove ADS which were left from an incomplete CWS infection removal. Kaspersky AV identfified a few of the files, and that was the first indication of their presence. When I used Merjin's ADS Spy, it identified many additional ADS infected files and removed all of them. So I would give it a thumbs up. In the case of a rootkit driver hidden in the ADS of the system32 folder such as PE386, the driver must be unloaded first before attempting ADS removal of the driver file. _________________ Negster22 - MS MVP - Consumer Security 2006-2008

wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd

Posted: Mon Jul 17, 2006 3:06 am Post subject:

thx negster!!! _________________ Brycetechs new tut dvd http://tinyurl.com/2u7rpk The Pixel Palladium Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008

plunx

Lieutenant

Joined: Nov 01, 2005
Posts: 194
Location: Sweden

Posted: Mon Jul 17, 2006 6:07 am Post subject:

Hi

Thanks wawadave and negster !

I nearly understands this challenge now..... Wink

I also noted this within Kaspersky Labs discussion:

Quote:

3. The Indexing Service adds ADSs containing thumbnails of images.
Given that code can be run from within ADSs, it's relatively easy to rewrite the "zoneID" ADS to include malicious code. Yes, forensic analysis applications like ProDiscover and EnCase will "see" these ADS, but it's up to the analyst to know that something is wrong if the "zoneID" ADS is larger than 28 or so bytes.
NTFS ADSs are not inherently dangerous, but they can be used in a malicious manner. You're right that "special tools" are required to view ADSs, as Microsoft has yet to add ADS support to Windows Explorer.
H. Carvey
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com

http://www.techpathways.com/

http://www.guidancesoftware.com/

After reading about this I cannot really understand the meaning of alternate data streams............ the reason to be compatible with Macintosh seems to be a little strange. IMHO

Question

regards
plunx

wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd

Posted: Mon Jul 17, 2006 6:27 am Post subject:

i think software companies and ms add data to them to id files. if you d/l with ie i,ll bet the time date and ip of where is hidden useing this. i,ll bet many windows files have many things hidden by these and i know windows its self has many rootkit like functions. but beyound my skills to prove or disprove. are there any apps that let you read the ads info? _________________ Brycetechs new tut dvd http://tinyurl.com/2u7rpk The Pixel Palladium Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008

	All -> FavForums -> Rootkit Revelations	All times are GMT Goto page 1, 2 Next
Page 1 of 2

You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 221ppm 0.302s (0.053s) Making cybercriminals unhappy since 2002*