Forensics Tripwire Project Report.ppt

Forensics: Tripwire Project Report Conor Harris Parth Jagirdar Zheng Fang What We’ve Done Setup Tripwire yum install tripwire twadmin –m G –S ./site.key twadmin –m G –L ./$HOSTNAME-local.key Configure Policy Remove all “file/dir not exists” warnings Change “scan the individual reports” to “yes” Add rule: check ‘/’ recursively, mode=SEC_CRIT Remove all rules that conflict with the added rule What We’ve Done (Cont.) Initialize twadmin --create-cfgfile –S site.key twcfg.txt twadmin --create-polfile –S site.key twpol.txt delete twcfg.txt and twpol.txt chmod 0600 tw.cfg tw.pol tripwire –init Backup key, cfg, pol, database. Alert Policy File is NOT Secure!!! even if “twpol.txt” is deletedcan be retrieved using “twadmin –print-polfile” without any password. Of course, we’ve got all the others’ policy file. And did a little analysis. Damages Made on All Create /media/canyouseeme Create /lost+found/.history Change modification time of /etc/yp.conf 05:27:09 ? Change file /var/log/maillogchange a localhost to l0calhost and keep the original modification time. +Damage Made on 129.63.16.75 Add cat to /var/lib/tripwire/report/..041402.twr chmod 777 /etc/X11 Installed Kate +Damage Made on 129.63.16.91 Add cat to /var/lib/tripwire/report/..041455.twr chmod 777 /etc/X11 +Damage Made on 129.63.16.93 Change modificatoin time of /var/log/samba/old 05:27:09 Change a session to s3ssion in /var/log/secureand keep the original modification time Change = to - in /etc/xml/catalog Changes Found on Our Machine All files in “/etc/tripwire” are gone rm –f *.* “localhost.localdomain.twd” changed add “forensics” “.bash_profile” changed add “/tmp/ttyconsole” Create shortcut ./cdrom ln -s /usr/bin/ ./cdrom Added a new user called “helpless” useradd helpless Changes Found on Our Machine (Cont.) Installed airsnort.i386 and all of its dependencies yum install airsnort.i386 Changed permissions on etc directory to 757 chmod 757 etc/ Made directory /ro