计算机取证技术在linux的实战实例资源-CSDN文库

需积分: 46 73 浏览量 2008-10-20 22:52:32 上传评论 1 收藏 633KB PDF 举报

### 计算机取证技术在Linux中的实战实例：内存中明文密码的探索与恢复 #### 引言随着信息安全领域的不断发展，计算机取证技术成为保护数据安全的重要手段之一。尤其在Linux操作系统环境下，如何有效利用计算机取证技术进行数据保护及调查分析显得尤为重要。本文将深入探讨Linux内存中存储的明文密码问题，并介绍一种基于签名的方法来恢复这些密码。 #### Linux内存中的明文密码现象 Linux作为一款广泛使用的开源操作系统，在企业和个人用户中都有着极高的普及率。然而，一项研究发现，Linux系统的内存中可能会保留大量明文密码信息，包括登录、SSH、Truecrypt（加密软件）、电子邮件、即时消息(IM)以及root密码等。这些密码在运行的应用程序中被保存为明文形式，并在内存中长期存在，为系统安全带来了潜在威胁。 #### 冷启动攻击与内存数据残留 2008年，由普林斯顿大学的Ed Felten领导的研究团队发现了一个令人惊讶的现象：动态随机存取存储器(DRAM)并非如人们普遍认为的那样，在断电后立即丢失所有数据。研究显示，即使在常温下且移除主板的情况下，DRAM仍能在断电后的几秒到几分钟内保留其内容。这一发现引发了对冷启动攻击的关注——即通过短暂的物理接触即可从计算机内存中恢复敏感数据的技术。 #### 明文密码的来源与风险 - **来源**：Linux系统中的明文密码主要来源于应用程序的不当设计或配置。例如，当用户输入密码时，某些应用可能会将其以明文形式存储在内存中。 - **风险**：这些明文密码的存在极大地增加了系统的脆弱性，一旦被未经授权的第三方获取，可能会导致严重的安全事件，比如账户被窃取、数据泄露等。 #### 明文密码的恢复方法为了应对这一挑战，研究人员提出了一种基于签名的方法来恢复内存中的明文密码。这种方法首先识别出特定应用的签名模式，然后通过扫描内存中的数据块来查找这些签名，从而定位并提取明文密码。该方法的具体步骤如下： 1. **确定目标应用**：首先明确希望从中恢复明文密码的应用程序。 2. **分析应用行为**：通过逆向工程或其他手段分析该应用处理密码的方式，寻找可能存在的签名特征。 3. **开发恢复工具**：基于前两步的结果，开发专门的工具或脚本来扫描和解析内存中的数据。 4. **执行恢复操作**：使用开发的工具扫描内存，根据已知的签名特征定位明文密码，并尝试提取。 #### 结论与建议尽管Linux操作系统因其开源特性而在安全性方面拥有诸多优势，但明文密码在内存中的留存仍然是一个不容忽视的安全隐患。面对冷启动攻击等新兴威胁，采取有效的防范措施变得尤为关键。企业和个人用户应当加强对系统安全的重视，定期更新软件补丁，采用更加安全的密码管理方式，并限制物理访问权限，以减少潜在的安全风险。此外，对于开发者而言，优化应用程序的设计，避免将敏感信息以明文形式保存在内存中，是提高整体安全性的根本途径。

资源推荐

资源详情

资源评论

Cleartext Passwords in Linux Memory

Sherri Davidoﬀ

alien@mit.edu

July 26, 2008

Abstract

Upon examination, the memory of a popular Linux distribution contained many cleartext

passwords, including login, SSH, Truecrypt, email, IM and root passwords. These passwords

are retained by running applications and stored as plain text in memory for extended periods

of time. The author investigated the source of these passwords and presents a proof-of-concept

method for recovering passwords from memory. Recently, cold boot researchers demonstrated

that memory is not as volatile as commonly expected, and that data from memory can be

recovered with physical access to systems in a very short period of time. This has open ed up

a new class of attacks in physical IT security, and signiﬁcantly raised the risk associated with

cleartext passwords in memory.

1 Introduction

Memory contains a concentrated wealth of information, such as usernames , passwords, encryption

keys, and personal data. This information can be used by attackers to gain access to related

systems, or by forensic investigators to unlock encrypted ﬁles and partitions. The author of this

paper examined the contents of Linux memory, identiﬁed clea rtext passwords, investigated their

source, and determined a proof-of-concept signature-based method for recovering them.

The Linux test system consistently left cleartext passwords in memory, including the login, SSH,

email, IM, Truecrypt and root passwords. While cleartext passwords in memory have been a

known, relatively low security risk for many years, the issue has taken on new importance in

light o f the recent research o n cold boot data remnance in memory. In February 20 08, a team

led by Ed Felten of Princeton University discovered that DRAM is not a s volatile as commonly

exp ected. Felten’s team studied the lifetime of data in DRAM, and demonstrated that, “[c]ontrary

to po pular assumption, DRAMs used in most modern computers retain their contents for seconds

to minutes after power is lo st, even at room tempera tur e and even if removed from a motherboard.”

Felten’s team leveraged this discovery to retrive encryption keys from memory. In their paper, they

commented that “[r]esidual da ta can be recovered using simple, nondestructive techniques that

require only momentary physical access to the machine.”

In other words, in little more than the time it takes to reboot a system, attacke rs can dump

a system’s memory. Memory can be dumped onto a USB key or other device, such as the iPod

dumper demonstrated by William Paul and Jacob Appelbaum at the 2008 Cansec West conference.

It can also be dumped over the network. When memory conta ins cleartext passwords, the attacker

can retrieve these and use them to gain access to encrypted data, email accounts, servers and other

networked systems. Cold boot attacks signiﬁcantly increas e the risk posed by cleartext passwords

and other sensitive data in memory.

To demonstrate tha t cleartext password recovery is achie vable, the author of this paper identiﬁed

bytes which consistently surrounded the cleartext Truecrypt password in memory and used these as

a signature to retrieve unknown Truecrypt passwords from memory on another L inux system. This

was accomplished using the Memsniﬀ memory s e arching tools, which were originally developed and

released by Sherri Davidoﬀ and Tom Liston at the 2008 Cansec West confer e nce .

Felten, Ed et al. “Lest We Remember: Col d Boot Attacks on Encryption Keys.” February, 2008

Davidoﬀ and Liston, “Cold Boot Forensics Workshop,” Cansec West 2008,

The author hopes that this paper will provide forensic investigators with a more s peciﬁc under-

standing of what information is commonly available for recovery, and help the L inux development

community under stand and appropriately reduce the presence of cleartext passwords in memory.

Future work will include extending this cleartext password analysis to Windows and Mac operat-

ing systems, and identifying other signatures and methods for automatically extracting cleartext

passwords from memory.

2 Methodology

Testing was conducted on a default installation of Ubuntu 7.10 (2.6.22) with no swap partition. The

Coroner’s Toolkit, memdump, emacs and build-essentials were also installed. The physical system

was a Thinkpad T43 with 2G of physical memory. Two tools were used to capture memory: pcat

(from The Co roner’s Toolkit), and dd. Pcat was used to copy the memory of a speciﬁc process,

whereas dd was used to create an image of memory, including areas not associated with a speciﬁc

process.

During each iteration of the test, the researcher logged into the system and manually launched the

following programs: Terminal, su, Thunderbird, Pidgin, GPG, Truecrypt, SSH (in that order). The

programs were deliberately not conﬁgure d to stor e pass words. Ea ch password was typed manually

every time.

After all programs had been launched, process memory was captured live using pcat, and redi-

rected to an external USB drive. The testing time was not held constant, and ranged from ﬁve to

forty-ﬁve minutes. The applications were active when the sna pshots were ta ken. There were a total

of twenty-ﬁve tests. Please see Appendix A for the detailed testing procedure.

The author also conducted separate exp e riments in which dd was used to imag e physical memory,

instead of capturing process memory using pca t. However, on the Linux system examined, access

to ZONE HIGHMEM through /dev/mem is restricted, limiting the images to the lower 896M of

physical memory (approx imately half of the physical memor y in use on the test system). Nonethe-

less, the results of ZONE

NORMAL memory analysis were instructive and have been included in

this report. After the data was collected, the author wrote scripts which searched the memory

snapshots for the known usernames and passwords. Based on these results, interesting sections of

memory were manually examined using a hex editor.

Data Number of occurrences Process name

Encrypted login password 3 /usr/sbin/gdm

Email password 1 /usr/lib/thunderbird/thunderbird-bin

IM password 2 pidgin

GPG pass word 0

GPG decrypted text 1 gnome-terminal

Truecrypt password 1 truecrypt

SSH password 1 Found in dd image ; not speciﬁc process memory

Root password 2 Found in dd image ; not speciﬁc process memory

Encrypted root pass word

3 su

Summary of results.

3 Findings

This section includes detailed information regarding each of the passwords which were tested.

When consis tent location information or other patterns were observed, they have been reported.

http://sourceforge.net/projects/memsniﬀ/

剩余12页未读，继续阅读

评论收藏

内容反馈

icunow

粉丝: 0
资源: 2

计算机取证技术在linux的实战实例

最新资源