Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

All, I have been googling around for different guides on what files to monitor that people would edit for malicious intent. In my readings so far, i have found the common files people edit. so far i have found:

  1. /etc/hosts
  2. ufw config files
  3. iptables config files
  4. /bin/login

what other files do you guys monitor actively and why?

Thanks in advance! -tsnm

share|improve this question
1  
Just edit, or also modify? Binaries are commonly overwritten as a means of a backdoor and persistent access. –  schroeder Jun 10 '13 at 17:42
    
modifying the contents would be the better term. overwriting a file would set off another alert i have created to match MD5 on binaries. –  toosweetnitemare Jun 10 '13 at 17:54
    
MD5 hash data should include file size as MD5 is vulnerablt to length extension attacks (en.wikipedia.org/wiki/Length_extension_attack) –  this.josh Jun 11 '13 at 7:17
    
@this.josh: Or, you know, he could just use a better hash function. –  thejh Jun 11 '13 at 9:21
    
i gather md5 and sha1 for each file on the system on clean install and then after the initial configuration that we freeze just so we can have an audit trail. my main concern is narrowing down what files i should monitor from everything to critical files. –  toosweetnitemare Jun 11 '13 at 13:42

1 Answer 1

up vote 4 down vote accepted

Your best bet is to install a HIPS (Host Intrusion Prevention Application) such as Samhain or AIDE. There are far too many files to monitor and an attacker can (and usually will) try to modify whatever they can. Not to mention there are plenty of people who play/tinker with Linux/BSD/OSX viruses, exploits, and proofs of concepts

EDITED FOR AN EXPLANATION AS TO WHAT TO MONITOR AND WHY

Every system differs, one can follow guidelines, baselines, but at the end of the day, the importance of what to monitor as at the discretion of the systems administrator, the data custodian, and a range of other people, or just one person. On any system I have been an administrator on, it is my function to maintain that system. I prefer to know as much as I can about the entire system.

When I install Host Based Intrusion Prevention, I choose to monitor everything EXCEPT log files. Logfiles change, therefore they'd generate many false positives. As an attacker/pentester, I am aware that many professionals who've followed best practices and guidelines, tend to focus on what they perceive (based on risk) as important. This will usually (and mostly ONLY) include directories where binaries are installed. Under Linux/BSD/Solaris:

/bin/
/sbin/
/usr/sbin/
/usr/bin/
/usr/local/bin/
/usr/local/sbin/
/opt/bin/
/opt/sbin/
/etc/

These are not the only places to store files, to hide programs, etc. For example, knowing these are the "usual suspects" being monitored, I have no time as an attacker shoving something into /usr/lib, /usr/share, /tmp, and so forth. These files are not going to be detected because no application is watching what is occurring.

The time and space to monitor these files/directories is minimal. I would rather be safe than sorry. There may be false positives initially, but this is where you can ween out what are legitimate alerts, and what aren't, building from there.

share|improve this answer
    
thank you. We have one of these HiPS systems installed right now. but we have a small amount of managed systems that i want to add custom monitoring too. –  toosweetnitemare Jun 10 '13 at 19:52
    
Then have a look at AlienVault. It might fit your needs communities.alienvault.com/download.html –  munkeyoto Jun 10 '13 at 20:34
    
thanks munkeyoto. I have that installed already as well :) this question is strictly about files that we would not want to be altered after the initial configuration. I can monitor them with a snare file monitor and send logs to alienvault, but that doesnt help me narrow down what files i should monitor. –  toosweetnitemare Jun 11 '13 at 13:40
    
The answer to that question is: "Its better to be safe than sorry." I would monitor all, outside of log files (which change often). The space required to do so is minimal. I referenced the proof of concept to give you a sense as to WHY you wanted to monitor everything. The fact that something is on a system renders it important, why chance it. –  munkeyoto Jun 11 '13 at 14:22
    
Wonderful writeup! thank you very much for taking the time to elaborate on why you are looking at certain files. –  toosweetnitemare Jun 11 '13 at 14:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.