In this lesson,
we're going to talk about alternate data streams
and how they can be used for data exfiltration.
Alternate data streams, or ADS,
are a feature of the NTFS file system
that allows more than one data stream
to be associated with a filename.
While they can be used for legitimate purposes,
attackers can exploit them to sneak data out of a network.
Let's break down what ADSs are,
and how they can be used maliciously,
and what you can do to detect
and prevent this type of activity.
First, let's understand what alternate data streams are.
NTFS, which stands for New Technology File System,
is the standard file system for Windows operating systems.
One of its lesser-known features
is it's ability to create alternate data streams.
Essentially, these streams allow additional data
to be hidden within a file
without changing a file's main content or its file size.
This capability was initially designed
to provide compatibility
with Apple's Hierarchical File System, or HFS,
which uses resource forks to store information about files.
Now, how can ADS be used for data exfiltration?
Imagine an attacker who has compromised a system
and wants to hide stolen data.
They can create an alternate data stream
for seemingly innocuous files,
such as a simple text document or image file.
The original file looks unchanged
and the size remains the same,
but it now contains hidden data.
Let's go through a step-by-step example to illustrate this
to give us a better understanding.
The attacker has a filename report.txt
on a compromised system.
They want to hide sensitive information they've collected
like passwords and other credential information.
Using built-in Windows commands,
the attacker can create an alternate data stream
attached to report.txt without altering its appearance.
They might use a command like echo
then we have the sensitive data into report.txt:hiddenStream
to create and add data to the hidden stream.
The original report.txt
still appears as a regular text file
and can be opened normally
showing only its original content.
To exfiltrate this hidden data,
the attacker can then transfer report.txt
to another location,
such as an external drive or remote server.
Since the hidden data stream is invisible
through regular file exploration tools,
it can easily bypass casual inspections.
On the receiving end, the attacker can extract
the hidden data using similar commands,
such as more < report.txt:hiddenStream,
revealing the sensitive information
embedded within the file.
Detecting and preventing ADS-based exfiltration
can be challenging.
Traditional file inspection tools
do not show alternate data streams,
so you need specialized tools and techniques.
The following are some steps you can take.
One thing you can do is use tools designed to detect ADS,
such as Sysinternals' Streams utility.
This tool can scan directories
and reveal any alternate data streams attached to files.
Implementing monitoring solutions
that watch for unusual file manipulation commands
and activities on critical systems
is also another common method.
Next, we need to educate our security teams
about the existence and risk of alternate data streams,
so they can recognize potential signs
of this method being used in our environment.
It's also essential to perform regular audits
of our file systems for any anomalies,
including checking for the presence of ADS
on file systems that shouldn't have them.
Additionally, we should apply strict access controls
and logging to sensitive data
to detect any unauthorized access or manipulation early.
So, remember, alternate data streams can be a powerful tool
for hiding and exfiltrating data
without detection during a penetration test.
By understanding how they work and implementing
appropriate detection and prevention measures
you can protect your systems
from this stealthy form of data theft
and also report to your client
how to prevent this in the future.