How to hide a file ?

["Kurt Seifried" <bugtraq () seifried org>]

Just a note: Tripwire will pick it up, i.e. if you add an ADS to a file
tripwire will flag it, and if a file has an ADS that is modified or removed
tripwire will also flag it (with MD5sum/etc just like a normal file). The
other good news is if you add an ADS stream to a directory such as WINNT or
system32 it will detect it. Of course any files or dirs not listed in your
policy will escape tripwire, but then that's no big surprise. So my advice:
use ADS on files specifically excluded by tripwire if you want to hide
things.

Actually it gets better. I can't find anyway to remove an ADS from a
directory, move'ing the dir around NTFS doesn't help, the heysoft:

ren important.exe temp.exe
cat temp.exe > important.exe
del temp.exe

won't work so well with a directory, one page quotes:

In addition, streams cannot be deleted - to delete a stream you must delete
its parent. So if someone attaches it to a root drive you are really up the
creek. Please tell me there is someway to rip out an ADS (I suppose you
could zero it by type'ing in a null file and rebuilding your tripwire
database/etc to deal with it, but that's rather ugly).

Kurt Seifried, kurt () seifried org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://www.seifried.org/security/