1

I need a way of determining whether contents of a folder containing some executable stuff have not been modified in any way a moment before I decide to execute the whatever is in it. Check every time before executing.

The problem is I am very limited in terms of time (the check has to be make nearly instantly, something like 100ms would be too much for this particular case) and a bit in computational power (running the whole thing on just a computer that's got a bunch of other stuff happening on it - internet browsing, music playing, whatever).

Talking about a Linux machine. The size of the folders would be up to 6MB worst case.

My primary idea was to have some kind of checksums-map-storing-file kept somewhere encrypted, and comparing a newly calculated value with the stored one. I do not have a big concern about storing the checksum-file. I do have a concern about using an efficient algorithm that lets me be as sure as possible that the files weren't modified.

Suggestions? Would it be safe enough to, say, only look into the files' metadata? or would checking the contents matter each time as well?

The algorithm I will be using is safe with me - I can kind of be sure that the "intruder" cannot "know" it, so its not my worry.

I feel like steganography could come in handy here, but I just can't figure out a possible useful way for it here.

11
  • Sounds like a job for md5sum. For a 6 MB directory you would rarely see > 100 ms on any decent hardware
    – Jedi
    Jul 9, 2016 at 2:25
  • 1
    Are you worried about the file being modified between your check and executing the file? It would take some good timing, but is possible Jul 9, 2016 at 2:38
  • @NeilSmithline, I actually am not worried about that.
    – niralittle
    Jul 9, 2016 at 2:41
  • @Jedi will do some benchmarking so see how the timing does for my case.
    – niralittle
    Jul 9, 2016 at 2:41
  • On a t2.nano with the default magnetic disk, a 12 MB directory with 115 files takes ~100ms real time to generate and about 90ms real time to check. Measured using time.
    – Jedi
    Jul 9, 2016 at 2:47

2 Answers 2

4

You could simply use md5sum.

First keep a copy of the current checksum:

md5sum /path/to/files/* > /path/to/safedirectory/checksum

Then you can run the following to check for differences:

md5sum /path/to/files/*|diff /path/to/safedirectory/checksum -

An alternative proposed by @Jedi is to use the -c option:

md5sum -c /path/to/safedirectory/checksum
3
  • 1
    @Jedi: It is a pretty nice alternative, so I'll include it in my answer. Jul 9, 2016 at 2:46
  • 1
    @Jedi md5sum -c will not point out new files added in the directory. Jul 9, 2016 at 20:32
  • @AlexStragies good point. -c ensures that the files that you want to validate are tracked and checked. It's neater than a diff, but it boils down to OP's use case.
    – Jedi
    Jul 9, 2016 at 20:34
0

Create a visually recognizable fingerprint based on the shasum, and use it for verification.

$ bishop $(find| LC_ALL=C sort|tar -cf - -T - --no-recursion|shasum|tr -d ' -')
+--[ RandomArt ]--+
| .. ooooo        |
|  Eo . .         |
|  .   .          |
|       .         |
|        S o      |
|         o Oo.   |
|          +.Xo   |
|          .* o*  |
|          o+=Bo. |
+-----------------+

Get bishop here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .