Re: Versioning file system

"Erik" == Erik Mouw <mouw@xxxxxxxxxxxx> writes:

Erik> (sorry for the late reply, just got back from holiday)
Erik> On Mon, Jun 18, 2007 at 01:29:56PM -0400, Theodore Tso wrote:
As I mentioned in my Linux.conf.au presentation a year and a half ago,
the main use of Streams in Windows to date has been for system
crackers to hide trojan horse code and rootkits so that system
administrators couldn't find them. :-)

Erik> The only valid use of Streams in Windows I've seen was a virus
Erik> checker that stored a hash of the file in a separate
Erik> stream. Checking a file was a matter of rehashing it and
Erik> comparing against the hash stored in the special hash data
Erik> stream for that particular file.

So what was stopping a virus from infecting a file, re-computing the
hash and pushing the new hash into the stream?

You need to keep the computed hashes on Read-Only media for true
security, once you let the system change them, then you're toast....

John
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: Versioning file system
    ... Erik> The only valid use of Streams in Windows I've seen was a virus ... Erik> comparing against the hash stored in the special hash data ... Erik> stream for that particular file. ...
    (Linux-Kernel)
  • Re: Versioning file system
    ... Erik> checker that stored a hash of the file in a separate ... Erik> stream. ... Erik> comparing against the hash stored in the special hash data ... Erik> stream for that particular file. ...
    (Linux-Kernel)
  • Re: Help with Streams
    ... In particular, it's actually extremely inconvenient to maintain a mapping between the reader and stream positions, and doing so would perform very poorly in any case, because you would have to decode the bytes to characters one at a time. ... You could still buffer the stream data into a byte buffer, but even the overhead of having to call the encoder one character at time would be very noticeable. ... It'd probably be easier to just open the file twice and have my hash routine figure out where it needs to go. ... If it's the latter, then you could actually encode the search string itself into the bytes representing that string, and then scan the stream bytes for a matching sequence of bytes. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: out of memory <04e40e32-58da-4a64-9a34-6d334135ca55@a39g2000pre.googlegroups.com
    ... I got this when i tried to dump a large hash into a file ... Windows machines usually don't ... Windows is rather funny about swap usage: ... really stream or if they need a huge buffer. ...
    (comp.lang.perl.misc)
  • Re: how to generate license keys for software
    ... truncate if you use a hash with larger output length, ... to a fixed 10,000 byte data stream known by both the software and thelicensekey generator. ... the software that takes perhaps 1 second to validate alicensecode. ... One other way to make license key validation slow is to use RSA ...
    (sci.crypt)