LWN.net Logo

suspicious-looking random files

suspicious-looking random files

Posted Jul 21, 2012 13:46 UTC (Sat) by nix (subscriber, #2304)
In reply to: suspicious-looking random files by giraffedata
Parent article: Security quotes of the week

If you really wanted an evil approach to hiding confidential data, build up a Gentoo or other source-based system, then encrypt your data and conceal it in plausible-sounding ELF sections in chosen binaries (sections that could perfectly well be there otherwise, are often quite large, but have little impact if filled with arbitrary junk: .debug_types in a file that actually has its debugging information in DWARF 3, something like that). (If you want to be really evil, take a legitimate ELF section and perturb it, using alternate representations of DIEs and instruction choices and the like to steganographically encode your data.)

Note that the binaries still work because the addition of a non-loaded section won't affect them at all. Hash checking for modified binaries to find the hacked ones won't work because the distro is source-based and everyone has different hashes anyway. Looking at the binaries to find suspiciously random info won't work because binaries have lots of random info in them anyway (this would be doubly true if DWARF debugging sections were gzipped, but they're not, oh well). The only way anyone would find info stashed in a random-but-plausible ELF section like this is to know what e.g. a legitimate .debug_types section looks like, dump all of them and find the ones that don't look right -- and nobody's going to do that who doesn't already know what they'll find. And even that will be fooled by the steg-encoding approach.


(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds