July 20, 2004

Windows Forensics: Have I been Hacked?

The guys over at Bleeping Computer have written a tutorial that will show you how to determine if your Windows NT, XP, or 2000 box is hacked and how you can go about cleaning up the files they may have left behind.

The tutorial shows you how to detect most hacks, but there are other methods that will be much harder to detect and will require a greater degree of knowledge in detecting them. The author believes that most of the hacks that are done in mass, especially by the script kiddies, will be detectable through these methods.

Its a quite simplicitic approach, but does give a good overview of some of the tools that a forensic analysis of a Windows system should use:

  • Fport - Lists all open ports (Think nstat like)
  • TCPView - Similar to Fport, but graphical, and shows more info such as CLOSED connections (very important post analysis)
  • Process Explorer - A great tool from Sysinternals which shows parent/child relationships with processes
  • PSTools - A set of cmd line tools used to open and kill processes, control servives, change passwords etc
  • Filealyzer - Windows explorer shell extension to your right click on a file

If you ever have to work on a Windows system for any sort of forensic analysis, you really need to learn these tools. This article is a good way to start.

Posted by SilverStr at July 20, 2004 10:30 AM | TrackBack
Comments

Not bad, but like most tutorials on Windows IR, it falls somewhat short of the goals. Sure, using fport is great for finding things that have opened a port, and that's a great start.

One of the things I found confusing about the tutorial is the reference to tools like NTFSDOS. So you can create a bootable disk...fine. But most folks should realize that if you do that, and reboot the system, you're essentially destroying all of the volatile data that you could use to figure out what's going on.

The use of GUI tools is great...most "investigations" today seem to be non-litigious, so finding out what happened and fixing it are the primary goals. My personal preference is command-line tools, with Perl scripts to automate the data collection and correlation phases. For example, I prefer openports over fport, and use multiple process listing tools, then run all that output through a script that will look for disparities...did something show up in the output of openports that's not in the output of tlist or pslist? Sometimes I like to throw in some WMI, as well...

I hope that as we start seeing more of these things (FIRST.org released a guide at http://www.first.org/docs/guides/gr/ofw32/) the quality will improve, and soon reach a level thats comparible to the Linux/*nix stuff.

Posted by: HC at July 21, 2004 04:29 AM