Hidden Files

In Unix, "hidden" files are ones with a leading dot, e.g. ".ssh". These don't show up in a normal directory listing (ls), but do with the "all" option (ls -a). Usually, these are used to hide things like login scripts and control files to prevent one's home directory appearing cluttered, but may be used by intruders to hide files.

Normal Unix commands such as find and ls may be used to locate such files, e.g.

find /usr -name '.*' -type d -print

to find "hidden" files and directories. find may also be used to search by modification time, e.g.

find /bin -ctime -365 -print

will find anything changed in the last year, similarly for /sbin /usr/kvm /usr/local/bin etc.

In Win95, hidden files are also possible; BackOrifice uses this technique to hide, using a blank icon and blank prefix, ".exe" does not show up in a icon-based directory.

suid programs

suid root programs are an especial concern, since they execute with root privilege. If such a program can be fooled into executing an arbitrary command, perhaps by a buffer-overrun exploit, it can be used to create new user IDs or open network holes. On some systems (gnu) find may be used to locate these programs, e.g.

find /bin -perm +6000 -print

or perhaps

find /bin -perm +6000 -exec ls -lg {} \;

On systems where find does not support the perm option, ls may be used, e.g.

ls -latg /usr/bin/* /sbin/* /usr/sbin/* /usr/local/bin/* | grep '^...s'

The point here is to find system files that appear to have been modified since the system was installed, or unauthorized programs, such as an suid shell (which executes a user's every command with root privilege).

Precautions

Non-system disk volumes should be mounted nosuid. This is a special concern for Linux users who may have obsolete live systems mounted on CD-ROM.

Data disks may be mounted noexec. This means that files in these directories cannot be executed.

Linux users may use the ext2fs utility chattr to make system directories or files "immutable", or create append-only logfiles. An intruder would first have to gain root, then change the filesystem attributes, before creating a file.

Up to Security Page

A.Daviel