Kurt Seifried Security Advisory 003 (KSSA-003)

Created by Kurt Seifried, [email protected]

http://seifried.org/security/advisories/kssa-003.html, [email protected]

An off site translation into spanish is also available, I have no idea if it is correct or not

http://www.kriptopolis.com/net/article.php?sid=352 - Muchas utilidades para borrado seguro de ficheros en Windows no destruyen adecuadamente los datos en sistemas de ficheros NTFS.

Title:

Multiple windows file wiping utilities do not properly wipe data with NTFS file systems.

Issue date:

Jan 21, 2002

Who should read this advisory:

Anyone using file wiping utilities such as PGP Wipe (from NAI), BCWipe (from Jetico) or East-Tec Eraser (from East-Tec) on a Windows system with an NTFS file system, such as Windows NT, Windows 2000 or Windows XP especially with features such as thumbnail pictures in explorer. This advisory affects virtually every Windows file wiping utility, none of the tested programs were found to be problem free.

Author and contact info:

This advisory is copyright 2002, Kurt Seifried, [email protected], http://seifried.org/

Overview:

In the NTFS file system a facility exists to bind additional data to a file or directory, called an alternate data stream [url1][url2]. These alternate data streams cannot be be removed, unless the parent file or directory is destroyed. Unfortunately most file wiping utilities only deal with the primary data stream and do not wipe the alternate data streams, thus leaving data intact.

Affected software:

It is important to note that every single software package tested failed to erase single or multiple data streams (Eraser 5.3 erased multiple data streams in, however missed alternate data streams when only one was present in a file). Based on this I find it unlikely that any other secure deletion programs implement alternate data stream wiping properly, all secure deletion programs for Windows should be treated as suspect until proven innocent. If you are using secure deletion software please check immediately for files with alternate data streams, and after deleting them you are strongly advised to wipe all free space.

BCWipe version 1.x and 2.x from Jetico - Confirmed in testing and from vendor. http://www.bcwipe.com/

Eraser 5.3 - Confirmed in testing and from vendor. http://www.tolvanen.com/eraser/

SecureClean v3 build-2.0 - Confirmed in testing and from vendor. http://www.accessdata.com/main_deleted_data.htm

East-Tec Eraser 2000 - Confirmed in testing. http://www.east-tec.com/eraser/index.htm

PGP 6.x freeware and commercial, 7.x, freeware and commercial - Confirmed in testing. http://www.pgp.com/, http://www.pgpi.org/

Numerous other packages are suspected to be vulnerable, it is strongly advised to use the workarounds listed below.

Impact:

If data is stored in an alternate data stream attached to a file (such as the thumbnail of an image) or directory when this file or directory is wiped the information contained within the alternate data stream will be left intact on the harddrive. No warning is given to the user at all by Windows or the wiping programs. For example if you use windows file explorer (the default file browser in Windows) and have thumbnails of pictures enabled (the default setting) then the thumbnail of the thumbnail image, once created (i.e. once the directory is viewed in Explorer) will not be deleted until you delete the file and wipe all free space. Alternate data streams also provide an ideal location to keep attack tools, snippets of virus code and so forth for attackers and viruses, in fact some virus scanners do not scan alternate data streams unless specifically configured to do so (often labeled as "scan all files" or similar).

The good news is that floppy disks and most other removable media are not formatted as NTFS, thus it is unlikely that copied files will contain the alternate data streams. As well no all compression programs, such as WinZip copy the alternate data streams, while others such as WinRAR do copy the alternate data streams. While it is unlikely that files with alternate data streams will have made it to other systems with their alternate data streams intact it is possible, and any systems that have had sensitive data copied or moved to them should immediately have their free space wiped in order to ensure alternate data streams containing sensitive information are still present.

Details:

Create a file with an alternate data stream:

echo "this is a text file" > C:\file.txt
echo "this is the alternate data stream lkajhkl2" > C:\file.txt:alternate-data-stream

If you use forensics software to examine the harddrive you will find the string of text "this is the alternate data stream lkajhkl2" present on the drive.

Now using the file wiper of your choice (BCWipe, etc.) choose the file C:\file.txt and wipe it. Use any many passes as you want.

Now examine the drive for the string "this is the alternate data stream lkajhkl2". You should be able to find it. To do this using Linux simply create an image file of the drive and examine it using grep or strings:

dd if=/dev/hdb1 of=windows-disk.img
grep "this is the alternate data stream lkajhkl2" windows-disk.img

or

strings windows-disk.img > windows-disk.strings
grep "this is the alternate data stream lkajhkl2" windows-disk.strings

As you will quickly discover the data is easily found.

Alternate data streams are only available on NTFS file systems, making home users with older systems (Windows95, Windows98, WindowsME) immune to this problem, but newer systems based on WindowsXP are capable of using NTFS, thus potentially exposing customers to risk. NTFS is also available on most corporate systems such as WindowsNT, Windows2000 and WindowsXP.

Another "feature" of alternate data streams is that they cannot be deleted. If you have an alternate data stream attached to a file you cannot delete it, you can write other data to the stream, however you cannot reliably delete it. To overwrite an alternate data stream simply place more data into it, for example:

echo "this will overwrite existing data in the stream" > C:\file.txt:alternate-data-stream

or

type notepad.exe > C:\file.txt:alternate-data-stream ***

Solutions and workarounds:

Several workarounds exist, and several vendors are in the process of updating software so as to fix the problem.

The first workaround is to avoid using alternate data streams to store sensitive information. To check for alternate data streams several free tools exist, one of the best of which is LADS [url3] from Frank Hayne Software (heysoft.de). Simply download lads.zip and unpack it, then run it from your root drives (e.g. C:\, D:\) and it should find and report any and all alternate data streams present. Because alternate data streams cannot be deleted tools to detect them are quite effective, once found you should securely delete the files and proceed to the next workaround, wiping free space, in order to ensure the alternate data streams are deleted.

The second workaround is to immediately use the "wipe free space" feature present in most secure file deletion utilities. Since the parent file or directory that the alternate data streams were attached to have been deleted the data in the alternate data streams is now in "free space" on the harddrive, thus using "wipe free space" will overwrite it. The downside of this workaround of course is that wiping all the free space on a hard disk can take quite some time, especially on a modern disk that may have several tends of gigabytes of free space to wipe. One note on this: wiping free space may not be possible or effective on network shares using NTFS, it is recommended to encrypt truly sensitive data on NTFS network file systems.

A third workaround is to encrypt sensitive data, Windows 2000 offers encrypted file system, or you can use programs such as PGP's PGPDisk [url4] or Jetico's BestCrypt [url5]. It is recommended to use encrypted disk partitions rather then encrypting single files, encrypted disk partitions are much easier to work with, type in a password and you have access, when you are done you do not need to worry about encrypting the file, as the data is kept in an encrypted state on the hard drive. Additionally temporary files stored in the same directory (such as opened word files) will also be kept in an encrypted state, reducing the need for you to wipe free space.

Several vendors have announced new versions in light of this, see below for more information:

BCWipe 1.x and 2.x

"We confirm importance of the problem of wiping alternate data stream in files, created on NTFS disks. We would thank Mr. Seifried for writing us about the problem and are going to solve it in the next version 3 of BCWipe, which is planned to be released at April, 2002."

SecureClean

"We will be covering all those issues in the next release. We plan to be shipping the product in February. The new release will be posted at www.accessdata.com. The current SecureClean does not handle alternate data streams or the thumbnails. That is coming in February."

East-Tec Eraser 2000

"EAST Technologies has acknowledged the possible problem concerning the wiping of the alternate data streams that may appear on NTFS disk drives and it will analyze this problem in the security product that it develops and the way this may compromise the user's personal security and privacy. EAST Technologies will also inform all its users and customers and in case it would be necessary, it will develop a fix."

Eraser 5.3 ***

PGP 6.x and 7.x ***

Additional information:

Check your anti-virus software, several packages do not scan alternate data streams by default, it is recommended you enable scanning of all files and confirm by placing the eicar.com [url6] in an alternate data stream of a file and scanning to test. Backup programs should also be checked, attach an alternate data stream to a file, delete and then restore it, check for the alternate data stream. You can remove an alternate data stream either by copying the parent file onto non NTFS media or backing it up with a program that does not save the alternate data stream, or by using the "rm" utility present in MKS Software's "MKS Toolkit 8.0". An op-ed piece on this problem will be appearing at SearchSecurity [url7] later this week.

References:

[url1] http://www.microsoft.com/technet/treeview/default.asp?url=/TechNet/prodtechnol/winxppro/reskit/prkc_fil_xurt.asp - Multiple data streams

[url2] http://support.microsoft.com/default.aspx?scid=kb;EN-US;q286797 - Windows File Protection and Alternative Data Streams (Q286797)

[url3] http://www.heysoft.de/nt/ep-lads.htm - List alternate data streams.

[url4] http://www.pgp.com/products/desktop-privacy.asp - PGP's Desktop privacy (includes encrypted drive software PGPDisk)

[url5] http://www.jetico.com/index.htm#/products.htm - Jetico's BestCrypt

[url6] http://www.eicar.org/anti_virus_test_file.htm - Eicar.com test file (for testing anti virus software).

[url7] http://searchsecurity.com/ - Op-Ed piece on this to appear later this week.

Other acknowledgements / thanks / greetings / information:

dd, grep and strings

CanSecWest - http://www.cansecwest.com/ - See you there

URL for advisory, signature and keys:

http://seifried.org/security/advisories/kssa-003.html

http://seifried.org/security/advisories/kssa-003.html.asc

http://seifried.org/security/keys/

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

mQGiBDsNcxcRBAD987JAFctBIHhuUNm5tqQgYi/CsFsx1afNI6QyHhbqPxJMF2Vs
D5dymEKSNd8QSAP4GNTk9MwswwxXHuXIYJolp+U2HhD/UhQsp37WiEODMB+NX8Xc
Xe5+BOUEUxaGo/du64tawslmiNw2KJDonKWaUSQBtp5ek1eQ0plTQbJ1DQCg//m4
wrYgtDl4iWdMk/76C4zbc/MD/ibshluW0pnWSDUxf00LrbMd3xAfQDPd9ACruY7z
pXdbdSJctpGMgzjbC0B97uqJINmB2Uu9h62bK+eKb+eIlM+zJEth0r6PCrhr+Kj4
EpQWiiujVU8ijNbHVM9SqT2vcS9i2o2ZCjrf2bQDdI7jt1c88+DdaCvRW79BiN4P
GsyCBADy8uewbArfRQl/erB6XeyVz2KDRvi5mNzM0xEWTtNkEV43pyHxXNtLzuD8
91GCHxsSL9f5JWEpcyiIiUhXNFdM3nZiGE/6/xfnKflDT7bsOdKXHXCvW1yN9aDx
QoRhJhlc3mnZMyLx/xz4M6wXVj8ddOBtwgBmlFtdZjyiDHwNJLQpS3VydCBNLiBT
ZWlmcmllZCAgPHNlaWZyaWVkQHNlaWZyaWVkLm9yZz6JAFQEEBECABQFAjsNcxcF
CRAw7AAECwMCAQIZAQAKCRCtYwtOrVbldApoAJ9ZRUlW8cycj3/XlTVtQNx405GZ
QgCg5zt7jGJ3v7FQguJgQloBGY1MACiJAEYEEBECAAYFAjsNcz8ACgkQ+7U3Ee+D
x4wO6gCgnbSwZFOOiTPoYjLxu446qfvzAAoAni6CROE7jtzqZMdHJbEqDFXcreEn
iQEcBBABAQAGBQI7DXNLAAoJECnUkEFIZQ2xALsH/13KyASmkFvyYCsj4hzD+UOV
DMZ/3Vi8/dXqL2NpSdGbvaASNVRyGG4huJBBSh9ccjXo11IbAfOvICfjbUQmIb3w
O/5mRQCiFIsakuPZWKhne5I9yVjL3ob78c4i2EvqSJ6VPFuqIrEdVCeMNU8DvjDw
k8FkjF5osPoKdk2CndEnrLOXMz04Qyv6DB4O1qcmhEyVc842dqPd/eOnNGUA7qN7
axp4AiZRNRyf4/XbRt+KQzS0tItQy9LcNfQiIr2B0nYo4t+edyQbQSPBiuESYTzm
TZhz0J3zxl4Tkea1GlTBxuJ6ulOFofZtDyAWABncZ9oEWgPADl15a+SCUNGvct+J
AEYEEBECAAYFAjsNdHYACgkQUWd9bj7NcwaN6QCeIYLdy4G3XlFebtHiXSHc/K1/
Iw4AoNrGLQWSHat8rs74/uE8ojtzh79htCFLdXJ0IFNlaWZyaWVkIDxrdXJ0QHNl
aWZyaWVkLm9yZz6JAEYEEBECAAYFAjuUYccACgkQrWMLTq1W5XRAugCfQyMVlXPs
D7lYKvhYg08mv6U7AZcAn0feW5KeOLrmSCWKaHlNUsVHX3opuQINBDsNcxgQCAD2
Qle3CH8IF3KiutapQvMF6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33
TGSGSfgMg71l6RfUodNQ+PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBh
znzJZv8V+bv9kV7HAarTW56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmsz
bDgNRR0PfIizHHxbLY7288kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1
Kv884bEpQBgRjXyEpwpy1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9
iUsiGSa6q6Jew1XpMgs7AAICCAD1mLQv5THh1JfuQEN26KbdRXWtw5tJ2LiXri17
G1BGS4pz7CVgNIhmKxhm9xvTD7Yb0xI2RoA5yre04xG77OQ47k0IjawSHdfr+PBZ
8C7O03QS17vKHthrpKayKENOUqWKOK3jGd2fx50EgKMnt5o+n1szEuhwvmxh1lOp
iV4l4EMc2QykM1W/weTgCmTvBVABfgm0OQoNswdkrKPyyY16Li2IBI9ebqo6Vnz8
NWiZ2Hzta0cKvuGak/mmNkLsZFXQ3oH/J6ubRb9LskqJ4o7SwUaCAHR1sjlq5LS/
JNVjwkG18Q+Jrr4X6NncRK1eCuHm8yD5dbvHPZi0VnltXHwsiQBMBBgRAgAMBQI7
DXMYBQkQMOwAAAoJEK1jC06tVuV0vHwAmwTOfoVT5RJqaluoEvXy7qpRjmzUAKCw
4DM73//OxJSRLTwVO5IVtq/WIQ==
=azr0
-----END PGP PUBLIC KEY BLOCK-----

Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the bulletin is not edited or changed in any way, is attributed to Kurt Seifried [email protected], and provided such reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Kurt Seifried [email protected] is not liable for any misuse of this information by any third party.

Last updated 1/21/2002

Copyright Kurt Seifried 2002