AuditUnit 5 · Topic 5.6
Integrity check: which files were altered?
Compare file hashes with a baseline and find what was altered.
New to this? Read the topic first: 5.6 Detecting Attacks on Data and Applications.
Simulation · [5.6.A.3, 5.6.D.1, 5.6.D.3]
Integrity check: which files were altered?
Last month an administrator recorded the SHA-256 hash of each file on a web server (baseline). Today she ran sha256sum again. Hashes are shortened to the first and last 4 characters. No updates were installed in between. Tap every file that was altered. There are 2.
-
Fine. Same hash both times. Hash functions are repeatable, so the file has not changed.
-
Red flag. The hash changed and no update was installed, so the login page was altered: a sign of malicious activity worth investigating.
-
Fine. Unchanged.
-
Fine. Unchanged. A matching hash shows the file was not altered, but it cannot show whether someone read or copied it.
-
Red flag. A changed hash on a file that handles uploads: the file was altered between the two checks.
Go to the topic: 5.6 Detecting Attacks on Data and Applications