Re: How to hide a file ? (From McAfee)

["Kurt Seifried" <bugtraq () seifried org>]

> McAfee Vshield doesn't pick up ADS's by default. You have to enable
scanning
> of all files in your Vshield settings.

Tripwire and some other stuff does by default (yeah!). Handling ADS doesn't
seem to slow things down much (tripwire checks each protected file for
streams by default).

There was a virus that used streams,
http://www.cknow.com/vtutor/vtntfsads.htm

[snip]
> Turning on scan all files causes attempts to access the ADS to give the
same
> access denied error as opening the original.
> This could be useful to sneak in trojans/virii to a vscan'd server from an
> already compromised host, say a users computer with NTFS....?

Yes and no. I believe some vendors now scan ADS's by default, as I mentioned
before tripwire tosses through them and will warn if an ads on a protected
file is created, deleted or the contents changed.

> -Jon


Kurt Seifried, kurt () seifried org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://www.seifried.org/security/