Cybercrime Technologies

Research | Practice

Showing posts with label Linux. Show all posts
Showing posts with label Linux. Show all posts

2017-01-02

2016-12-26

[How to] Installing and updating Linux in Virtualbox

Monday, December 26, 2016 Posted by Unknown , , No comments
Today we are going to install and update a Debian-based operating system in VirtualBox as a guest operating system.

The first video goes through creating a virtual machine in VirtualBox, and installing an operating system from an ISO disk image.



The next video uses apt-get to update the software in the system, as well as ifconfig and ping to check if the network is working.


The final video shows how to install VirtualBox Guest Additions to allow multiple features inside the guest operating system.


2016-10-10

2015-06-29

Clearing USB disk read cache for testing and forensics in Linux

Monday, June 29, 2015 Posted by Unknown , , No comments

When copying data from USB devices in Linux (Debian / Ubuntu), you may have noticed that reading data from the disk the first time takes a while, and reading the second time takes only a few seconds.

For example:

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 2m58.620s
user 0m7.032s
sys 0m1.429s

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 0m3.467s
user 0m3.285s
sys 0m0.181s

Here the first read took 2 minutes 58 seconds, while the second took only 3 seconds.This is because all data on the disk is cached to memory when read the first time. In cases where the disk may change between reads, caching may return results that are not consistent with the current state of the disk (like a hash).

When looking how to disable read cache, I found a lot of information about disabling write cache, but not a lot about disabling read.

To disable write cache (if supported) for the current session that the device is plugged in:

sudo hdparm -W 0 /dev/[device]

But this does not solve our read cache problems. Unfortunately, I could not find a way to completely disable read cache, but we can clear the cache buffer.

First, determine the path to echo with 

which echo

Then we want to tell the kernel to drop caches. To do this, we need to echo a value to /proc/sys/vm/drop_caches.
To free pagecache:
 echo 1 > /proc/sys/vm/drop_caches
To free reclaimable slab objects (includes dentries and inodes):
 echo 2 > /proc/sys/vm/drop_caches
To free slab objects and pagecache:
 echo 3 > /proc/sys/vm/drop_caches

So our echo command to clear all caches should look like:

sudo sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches"

Note: You probably cannot echo directly to drop_caches with sudo - you should be root. The work-around to that is wrap the whole command in sudo. Make sure you are putting the full path to echo on your system.

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 3m18.294s
user 0m6.389s
sys 0m1.390s

joshua@Apollo /media/joshua/ucdntfs $ sudo sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches"

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 3m18.344s
user 0m6.545s
sys 0m1.438s

If you use it a lot, like me, you might want to make an alias:

alias clearusbcache="sudo sh -c '/bin/echo 3 > /proc/sys/vm/drop_caches'"

If you want to clear the cache in the background while running experiments, you can try this script:

#!/bin/bash
while true; do
   /bin/echo 3 > /proc/sys/vm/drop_caches
   sleep 1
done

2015-02-12

John the Ripper shared library error path fix on Linux

Thursday, February 12, 2015 Posted by Unknown , No comments
If you are using John the Ripper with CUDA, and you start to see errors like:
./unshadow: error while loading shared libraries: libcudart.so.6.5: cannot open shared object file: No such file or directory
First, check your paths. An example .bashrc might look like (64bit system):

 export CUDA_HOME=/usr/local/cuda
export LD_LIBRARY_PATH=${CUDA_HOME}/lib64:$LD_LIBRARY_PATH
PATH=${CUDA_HOME}/bin:${PATH}
export PATH

If you are still getting the shared library error, then check /etc/ld.so.conf.
Add the path to your cuda library: /usr/local/cuda/lib64
Then run sudo ldconfig

Now try running unshadow again, and the problem should be fixed.



2014-11-29

Korea Linux Forum 2014: Linux and Law Enforcement

Saturday, November 29, 2014 Posted by Unknown , No comments
On November 11, 2014 Joshua James of CybercrimeTech.com gave a presentation at the Korea Linux Forum on Linux and Law Enforcement: Challenges and Opportunities. Presentation slides can be found at the link.

A bit about the talk can be found below.

Overall, I thought the Korea Linux Forum 2014 was very interested. I'd never been to that kind of conference before, and I think it was not so usual to have a speaker talking about how criminals and Law Enforcement are using Linux / Open Source. I think most engineers were maybe not so interested, but I seemed to get a bit of interest from the legal side. All-in-all, definitely a conference I will try to attend next year.

Linux and Law Enforcement: Challenges and Opportunities

 Abstract
Like all technology, Linux can be used for good or evil. Cybercrime and digital forensic investigators must be able to investigate Linux-based systems that have been attacked, or have been used for criminal purposes. While hackers have adopted Linux for its power and flexibility, Law Enforcement have mixed feelings about Linux and open source projects in general. This talk will discuss how both Law Enforcement and criminals are using Linux, current perceptions of Law Enforcement toward the use of Linux and community-developed software, and legal considerations about the use of open source tools in digital investigations.

Audience
All technologies are vulnerable to criminal abuse. This talk will help the community understand what Law Enforcement are doing about current cybercrime cases, and what role Linux (and the community) play in both supporting and preventing digital crime. It is hoped that if developers, administrators and users are more aware of the challenges Law Enforcement face, then not only can the security of the ecosystem be improved, but also justice when the ecosystem is criminally abused.

Experience Level
Any

Benefits to the Ecosystem
All technologies are vulnerable to criminal abuse. This talk will help the community understand what Law Enforcement are doing about current cybercrime cases, and what role Linux (and the community) play in both supporting and preventing digital crime. It is hoped that if developers, administrators and users are more aware of the perspective of Law Enforcement, then not only can the security of the ecosystem be improved, but also justice when the ecosystem is abused.

2014-10-08

World Forensic Festival, Digital Forensic Masters and the Korea Linux Forum

Wednesday, October 08, 2014 Posted by Unknown , , , No comments

A pretty busy day preparing for the World Forensic Festival next week. If you are going, please be sure to catch me on Thursday and Friday for the Digital Forensics talk and poster sessions. I will be talking about event reconstruction with no-prior information. Just a sort piece of work I touched on in my dissertation.

We also have an open house in SoonChunHyang University tomorrow to introduce potential students
to the Master's in Digital Forensic Investigation. It is a combination degree with the SCH Graduate
School of Forensic Science. The session on digital forensics is short, but should be interesting. If you are in Asan tomorrow after, please let me know.

Finally, we are also getting ready for the Korea Linux Forum where we will talk about Linux in crime and criminal investigation. I've never been to the event before, but it should be interesting to meet developers and users. Hopefully I can give them some insight into how the Law Enforcement community (and criminals) is using their work. There are some interesting parallels between the idea of open source, and requirements by courts. Much of which was talked about by Brian Carrier a while ago in "Open Source Digital Forensic Tools - The Legal Argument".

All together, a pretty interesting few months ahead.

2014-07-31

[How-to] Cracking ZIP and RAR protected files with John the Ripper

Thursday, July 31, 2014 Posted by Unknown , , 10 comments
After seeing how to compile John the Ripper to use all your computer's processors now we can use it for some tasks that may be useful to digital forensic investigators: getting around passwords. Today we will focus on cracking passwords for ZIP and RAR archive files. Luckily, the JtR community has done most of the hard work for us. For this to work you need to have built the community version of John the Ripper since it has extra utilities for ZIP and RAR files.

For this exercise I have created password protected RAR and ZIP files, that each contain two files.

test.rar: RAR archive data, v1d, os: Unix
 
test.zip: Zip archive data, at least v1.0 to extract
The password for the rar file is 'test1234' and the password for the zip file is 'test4321'.

In the 'run' folder of John the Ripper community version (I am using John-1.7.9-jumbo-7), there are two programs called 'zip2john' and 'rar2john'. Run them against their respective file types to extract the password hashes: 
./zip2john ../test.zip > ../zip.hashes
./rar2john ../test.rar > ../rar.hashes
This will give you files that contain the password hashes to be cracked... something like this: 
../test.zip:$pkzip$2*2*1*0*0*1b*a80c*95e4e9547dcfcde4b8b2f05a80aaeb9d15dd76e7526b81803c8bf7*2*0*1b*f*72051312*0*44*0*1b*a808*cbafdd390bf49ea54064ab3ff9f486e6260b9854e37d1ee3a41c54*$/pkzip$
After, that you can run John the Ripper directly on the password hash files:
./john ../zip.hashes
You should get a message like: Loaded 1 password hash (PKZIP [32/64]). By using John with no options it will use its default order of cracking modes. See the examples page for more information on modes.

Notice, in this case we are not using explicit dictionaries. You could potentially speed the cracking process up if you have an idea what the password may be. If you look at your processor usage, if only one is maxed out, then you did not enable OpenMP when building. If you have a multi-processor system, it will greatly speed up the cracking process.

Now sit back and wait for the cracking to finish. On a 64bit quad-core i7 system, without using GPU, and while doing some other CPU-intensive tasks, the password was cracked in 6.5 hours. 
Loaded 1 password hash (PKZIP [32/64])

guesses: 0  time: 0:00:40:29 0.00% (3)  c/s: 2278K  trying: eDTvw - ekTsl
guesses: 0  time: 0:01:25:10 0.00% (3)  c/s: 1248K  trying: ctshm#ni - ctshfon9
guesses: 0  time: 0:02:56:40 0.00% (3)  c/s: 1499K  trying: BR489a - BR48jf
guesses: 0  time: 0:03:56:04 0.00% (3)  c/s: 1703K  trying: fjmis5od - fjmidia0
guesses: 0  time: 0:04:46:09 0.00% (3)  c/s: 1748K  trying: Difg1ek - DifgbpS
guesses: 0  time: 0:05:21:22 0.00% (3)  c/s: 1855K  trying: btkululp - btkulene
guesses: 0  time: 0:06:02:43 0.00% (3)  c/s: 1857K  trying: ghmnymik - ghmnyasd
test4321         (../test.zip)
guesses: 1  time: 0:06:32:34 DONE (Mon Jul 28 17:50:22 2014)  c/s: 1895K  trying: telkuwhy – test43ac
Now if you want to see the cracked passwords give john the following arguments: 
./john ../zip.hashes --show
It should output something like:
../test.zip:test4321 
1 password hash cracked, 0 left
Note: the hash file should have the same type of hashes. For example, we cannot put the rar AND zip hashes in the same file. But this means you could try to crack more than one zip/rar file at a time.

For the rar file it did not take nearly as long since the password was relatively common. If you take a look at john.conf in the run directory, it has a list of the patterns it checks (in order). The pattern 12345 is much more likely than 54321, so it is checked first resulting in a quick crack. 
Loaded 1 password hash (RAR3 SHA-1 AES [32/64]) 

guesses: 0  time: 0:00:00:10 1.38% (1) (ETA: Mon Jul 28 18:23:58 2014)  c/s: 24.86  trying: rar.tsett - ttests 

guesses: 0  time: 0:00:02:12 13.40% (1) (ETA: Mon Jul 28 18:28:19 2014)  c/s: 25.98  trying: Test29 - Test2rar9 

test1234         (test.rar) 

guesses: 1  time: 0:00:17:03 DONE (Mon Jul 28 18:28:56 2014)  c/s: 24.01  trying: test1234 - testrar1234 

Use the "--show" option to display all of the cracked passwords reliably

[How-to] Compiling John the Ripper to use all your processors for password cracking

Thursday, July 31, 2014 Posted by Unknown , , No comments
John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

Today we are going to show you how to compile John the Ripper to use all of your processors (we will talk about compiling for NVIDIA GPUs later).

First you should visit Openwall's site and download the John the Ripper source code. I recommend getting the community-enhanced version since it contains support for many other hashes and ciphers. As of this writing, the current version of the community edition is 1.7.9.

You also need to install a compiler and ssl. On Ubuntu systems, you can just install the build-essential package, and libssl-dev.
sudo apt-get install build-essential libssl-dev

Download and verify the version suitable for your platform. In this example I am compiling on Linux Mint 17 (Ubuntu Trusty).

Extract the tar:
tar -xvf john*.tar.gz

Enter the newly created directory into the “run” directory:
cd john*/src

Important: This step enables parallel-processing in John using OpenMP.
nano Makefile

Remove the # before
OMPFLAGS = -fopenmp
and
OMPFLAGS = -fopenmp -msse2

Now save, and close.

Type “make | more” and choose the type of system that you are using. I am running a 64bit version of Linux, so I will choose linux-x86-64-native. If you have a 32 bit system, make sure to choose x86. If you don't know what to choose then “generic” will probably work for you.

Once you have edited the Makefile, and picked the system to compile for, then build the program:
make clean linux-x86-64-native

On multi-processor systems you can also add -j5 where 5 is the number of processors on your system.
make clean linux-x86-64-native -j5

Once the process is done – if it had no errors – then the binaries will be in the 'run' directory.
cd ../run

You can test it by running ./john --test

Troubleshooting

If there was an error building, try building “generic”. If it works, then you probably chose the wrong build options.

2014-04-19

Ubuntu 14.04 (Trusty Tahr) Long Term Support Released

Saturday, April 19, 2014 Posted by Unknown No comments
Ubuntu 14.04 LTS has been released.
This version includes a number of "under the hood" updates. Some of the most notable are:
Ubuntu Desktop and Ubuntu Server also received a number of updates. See the release notes for full documentation.

If you are interested in upgrading or trying out Ubuntu, you can download the official ISOs using their torrents:


Alternatively, you can head on over to the downloads page to get the latest ISO from one of the Ubuntu mirrors.

Ubuntu 14.04 Turst Tahr Screen Shot of Unity on Startup


This update also means approximately 1 month until Linux Mint 17 is released!