full-disclosure - Break-in discovery and forensics tools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: yannicksan at free.fr (yannick san)
Subject: Break-in discovery and forensics tools

Could it be usefull to have a mini UNIX or a mini Linus (like minix or
something like that) on the CD ?
It could permit access to the compromised system without taking the hard
drive off and installing it as a slave in another computer, and more of all
it could permit us to access to the system without using the original boot.
...well it's better to have the original CD for booting but on some machine,
due to the level of security policy applied, we don't have a CD-R
avalaible...
What do you think about that ?

Yannick
Information Security Engineer

> I've been tasked with putting together a CD of tools that can be used
> for analysis of hacked machines.  These would be both tools that can
> determine if a program is trojaned or a file has been altered as well as
> tools that could be used to save forensics data for possible
> prosecution.
>
> Other than Dan and Wietse's TCT, what tools do you think should be
> included?
>
> I envision this CD as having several directories, each one being for a
> particular platform (Windows, RedHat, Solaris, HP-UX, etc.).  In those
> directories would be versions of TCT compiled for that platform and
> utilities such as ls, ps, file, ifconfig, strings, etc.  Possibly also a
> file with MD5 checksums for OS files that are commonly altered.
>
> If you were starting from a blank slate, what would you think are the
> must have tools for this CD?  How would you set it up?
>
> Paul Schmehl (pauls@...allas.edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> AVIEN Founding Member
> http://www.utdallas.edu/~pauls/