1

I need a way of determining whether contents of a folder containing some executable stuff have not been modified in any way a moment before I decide to execute the whatever is in it. Check every time before executing.

The problem is I am very limited in terms of time (the check has to be make nearly instantly, something like 100ms would be too much for this particular case) and a bit in computational power (running the whole thing on just a computer that's got a bunch of other stuff happening on it - internet browsing, music playing, whatever).

Talking about a Linux machine. The size of the folders would be up to 6MB worst case.

My primary idea was to have some kind of checksums-map-storing-file kept somewhere encrypted, and comparing a newly calculated value with the stored one. I do not have a big concern about storing the checksum-file. I do have a concern about using an efficient algorithm that lets me be as sure as possible that the files weren't modified.

Suggestions? Would it be safe enough to, say, only look into the files' metadata? or would checking the contents matter each time as well?

The algorithm I will be using is safe with me - I can kind of be sure that the "intruder" cannot "know" it, so its not my worry.

I feel like steganography could come in handy here, but I just can't figure out a possible useful way for it here.

  • Sounds like a job for md5sum. For a 6 MB directory you would rarely see > 100 ms on any decent hardware – Jedi Jul 9 '16 at 2:25
  • 1
    Are you worried about the file being modified between your check and executing the file? It would take some good timing, but is possible – Neil Smithline Jul 9 '16 at 2:38
  • @NeilSmithline, I actually am not worried about that. – niralittle Jul 9 '16 at 2:41
  • @Jedi will do some benchmarking so see how the timing does for my case. – niralittle Jul 9 '16 at 2:41
  • On a t2.nano with the default magnetic disk, a 12 MB directory with 115 files takes ~100ms real time to generate and about 90ms real time to check. Measured using time. – Jedi Jul 9 '16 at 2:47
4

You could simply use md5sum.

First keep a copy of the current checksum:

md5sum /path/to/files/* > /path/to/safedirectory/checksum

Then you can run the following to check for differences:

md5sum /path/to/files/*|diff /path/to/safedirectory/checksum -

An alternative proposed by @Jedi is to use the -c option:

md5sum -c /path/to/safedirectory/checksum
  • 1
    @Jedi: It is a pretty nice alternative, so I'll include it in my answer. – Julie Pelletier Jul 9 '16 at 2:46
  • 1
    @Jedi md5sum -c will not point out new files added in the directory. – Alex Stragies Jul 9 '16 at 20:32
  • @AlexStragies good point. -c ensures that the files that you want to validate are tracked and checked. It's neater than a diff, but it boils down to OP's use case. – Jedi Jul 9 '16 at 20:34
0

Create a visually recognizable fingerprint based on the shasum, and use it for verification.

$ bishop $(find| LC_ALL=C sort|tar -cf - -T - --no-recursion|shasum|tr -d ' -')
+--[ RandomArt ]--+
| .. ooooo        |
|  Eo . .         |
|  .   .          |
|       .         |
|        S o      |
|         o Oo.   |
|          +.Xo   |
|          .* o*  |
|          o+=Bo. |
+-----------------+

Get bishop here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.