Hide sensitive files with Alternate Data Streams

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

http://windowssecrets.com/2007/12/06/01-Hide-sensitive-files-with-Alternate-Data-Streams

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

I was curious so I gave it a whirl and the theory sounds a lot more exciting than the end result.

For example I embedded a jpg file into a standard text file. When I then opened the txt file I could see encoding within the file. I then renamed the txt file to jpg and it showed me the image.

I was able to simulate this by just renaming the jpg file with a txt extension, which was a lot quicker.

 

I was about to say something about the ADS since I also read it in the windows secretes article but you beat me to it Mitz. It looks pretty interesting though. I certainly didn't know that existed.

 

ADS has been around for a long while now - its never really got the publicity it deserves. It is incredibly dangerous, allowing rootkits and God knows what else to be installed on a compromised system. Whilst not in and of itself a penetration threat, it is one of the most lethal tools in a hacker's arsenal once they have compromised your network.

John, whilst you might not have been that impressed by it, think about if, say, someone were to hide an executable behind a seemingly harmless text file? Check out this link for an explanation of ADS and just why they are potentially so dangerous.

Zeb

 

I agree, after reading the article on Windows Secretes, I did some more research and I found out exactly what Zeb said in his post.

 

Just an interesting fact - If you use ADS's to hide a 700MB video file in a 5KB text file the text file will still show as 5KB.