Covering tracks — Hiding files on Windows/Linux/MacOS

Introduction to hiding files

After gaining access to a system, a hacker commonly needs to cover their tracks in order to avoid detection. Many antiviruses operate by searching through the list of files stored on a computer’s filesystem and comparing them to signatures of known malware variants. If a hacker can conceal the existence of their files from an AV or other security tools, their probability of detection dramatically decreases.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Hiding files

When trying to hide files on a computer, there are a variety of different options. In general, there is a tradeoff between the effectiveness of the hiding techniques and the level of privileges necessary to accomplish them. While some methods may be extremely difficult for a user to detect, they also require elevated privileges on the system. More accessible methods, on the other hand, are much easier to detect.

Different means of hiding files may be specific to different operating systems, but many are generally applicable. Some of the options for hiding files on a system include:

• Hidden files and folders
• Unexpected locations
• Alternate data streams
• Function modification
• Function hooking

In this section, we provide a brief introduction to each of these techniques and an overview of some of their pros and cons.

Hidden files and folders

One of the simplest and most well-known methods of hiding files is using the hidden files attribute. This functionality is built into most operating systems and is intended to ensure that users do not mess with files that they shouldn’t.

On Windows, files can be marked as hidden through the use of attrib.exe or through File Explorer. On Linux, any file whose filename begins with a period is marked as hidden by default.

While this technique is probably the easiest means of hiding files, it’s also the easiest to detect. The technique is well known, and it is easy to set Windows File Explorer or ls on *nix to show even hidden files.

Unexpected locations

Another simple means of hiding files from a user is by placing them in unexpected locations. While the user can easily see these files if they are looking for them, they’re unlikely to do so.

One example of this is placing a malicious file in the Recycle Bin on Windows. Most users ignore the Recycle Bin and may believe that anything there has already been dealt with by an antivirus. However, files located there can still execute and cause damage.

Another example of an unusual location is the System32 folder on Windows. Since this folder contains files vital to the functionality of the operating system, most users won’t look there, let alone terminate or delete a potentially suspicious file that is located there.

Alternate data streams

Alternate data streams (ADS) are a feature of the NTFS file system. They allow additional data or even files to be attached to a file. These data streams are not by default, making them a good place to hide malicious files or executables.

However, ADS can be easily detected if a user or tool knows what they are doing. Windows’ Streams tool is one option for detecting them, and PowerShell has built-in functionality to do so. As a result, ADS are best used for hiding files from casual detection.

Function modification

On both Windows and *nix systems, there are certain applications designed to provide lists of files located on the filesystem. For example, Linux uses the ls command to provide this list.

These applications can be modified to hide the presence of certain files on the system. A modified version of ls could be configured to specifically ignore certain attacker-owned files.

This technique is effective as long as the user does not detect the fact that ls has been modified. Modifications can easily be detected by comparing the hash of the binary to a known-good hash, and many security tools are designed to perform this comparison and generate alerts if a discrepancy is discovered.

Function hooking

For those wanting to hide their files from more than just the casual user, the use of function hooks is a good option. Function hooking is the technique used by rootkits to hide malware on a system.

When an application wants a list of the files stored on a computer, the processes running and so on, it calls a low-level function of the operating system. This function runs, generates the list, and then sends it back to the calling application.

With function hooking, a rootkit intercepts all calls and responses between applications and these low-level functions. This allows the program to ensure that the lists of files provided do not include any files that the rootkit wants to remain hidden.

Function hooking is made possible due to the fact that many of these low-level functions operate in the operating system’s kernel, while applications run in user mode. In Windows, applications call kernel functions through interrupts or model specific registers (MSRs). Both of these can be hooked by a rootkit, ensuring that the rootkit controls all kernel calls.

Alternatively, the System Service Descriptor Table (SSDT) is a table in the kernel containing pointers to all kernel functions. If a rootkit modifies this table to point certain functions to code under its control, the rootkit ensures that it controls any attempts to read lists of files on the operating system.

Regardless of the specific method used, function hooking is one of the most effective means of hiding files on a system. However, it often also requires elevated levels of access, since kernel-level data structures must be modified.

Conclusion: Covering your tracks

Hiding files on a compromised machine is a common step in covering tracks after gaining access. The methods described here each have their pros and cons, but they provide the capability to hide a hacker’s files from anyone from the clueless user to a sophisticated antivirus.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Sources

1. Windows Rootkit Overview, Symantec
2. Hidden Files and Directories, MITRE
3. Introduction to Alternate Data Streams, Malwarebytes Labs