fishy

fishy is a toolkit for filesystem based data hiding techniques, implemented in Python. It collects various common exploitation methods, that make use of existing datastructures on the filesystem layer, for hiding data from conventional file access methods. This toolkit is intended to introduce people to the concept of established anti-forensic methods associated with data hiding.

This document will provide some basic information about fishy. For a more in-depth documentation, you can visit the github wiki or use the documentation within the repository.

Code Authors and Project

fishy is a project initiated by the da/sec research group and several bachelor students of the Hochschule Darmstadt (h_da), University of Applied Sciences.

Student members: Jan Türr, Adrian Kailus, Christian Hecht, Matthias Greune, Deniz Celik, Tim Christen, Dustin Kern, Yannick Mau and Patrick Naili.

da/sec members: Thomas Göbel, Sebastian Gärtner and Lorenz Liebler.

References

[1] Adrian V. Kailus, Christian Hecht, Thomas Göbel und Lorenz Liebler, „fishy – Ein Framework zur Umsetzung von Verstecktechniken in Dateisystemen“, in D-A-CH Security, Gelsenkirchen (Germany), September 2018.
[2] Thomas Göbel and Harald Baier, „fishy – A Framework for Implementing Filesystem-based Data Hiding Techniques“, in Proceedings of the 10th EAI International Conference on Digital Forensics & Cyber Crime (ICDF2C), New Orleans (United States), September 2018.
[3] Thomas Göbel, Jan Türr and Harald Baier, „Revisiting Data Hiding Techniques for Apple File System“, in Proceedings of the 12th International Workshop on Digital Forensics (WSDF) to be held in conjunction with the 14th International Conference on Availability, Reliability and Security (ARES), Canterbury (UK), August 2019.

Attribution

Any publications using the code must cite and reference the conference paper [1] and [2].

Requirements

Build:
- Python version 3.5 or higher
- argparse - command line argument parsing
- construct - parsing FAT filesystems
  - Note: Please install a version earlier than 2.9 (2.8.22 is recommended)
- pytsk3 - parsing NTFS filesystems
- simple-crypt - encryption of metadata using AES-CTR
Testing
- pytest - unit test framework
- mount and dd - unix tools. needed for test image generation
Documentation
- sphinx - generates the documentation
- sphinx-argparse - cli parameter documentation
- graphviz - unix tool. generates graphs, used in the documentation

Installation

# To run unit tests before installing
$ sudo python setup.py test
# Install the program
$ sudo python setup.py install
# Create documentation
$ pip install sphinx sphinx-argparse
$ python setup.py doc

To generate the documentation as pdf:

$ cd doc
$ make latexpdf

You may have to install some extra latex dependencies:

$ sudo apt-get install latexmk
$ sudo apt-get install texlive-formats-extra

Usage and Hiding Techniques

Techniques we found

FAT:
- File Slack [✓]
- Bad Cluster Allocation [✓]
- Allocate More Clusters for a file [✓]
NTFS:
- File Slack [✓]
- MFT Slack [✓]
- Allocate More Clusters for File [✓]
- Bad Cluster Allocation [✓]
- Add data attribute to directories
- Alternate Data Streams
Ext4:
- Superblock Slack [✓]
- reserved GDT blocks [✓]
- File Slack [✓]
- inode:
  - osd2 [✓]
  - obso_faddr [✓]
APFS:
- Superblock Slack [✓]
- Write-Gen-Counter [✓]
- Inode Padding [✓]
- Timestamp Hiding [✓]
- Extended Field Padding [✓]

CLI

The cli interface groups all hiding techniques (and others) into subcommands. Currently available subcommands are:

fattools - Provides some information about a FAT filesystem
metadata - Provides some information about data that is stored in a metadata file
fileslack - Exploitation of File Slack
addcluster - Allocate additional clusters for a file
badcluster - Allocate bad clusters
superblock_slack - Exploitation of Superblock Slack
reserved_gdt_blocks - Exploitation of reserved GDT blocks
osd2 - Exploitation of inode's osd2 field
obso_faddr - Exploitation of inode's obso_faddr field
write_gen - Exploitation of Write-Gen-Counter field found in inodes.
inode_padding - Exploitation of inode padding fields.
timestamp_hiding - Exploitation of nanosecond timestamps.
xfield_padding - Exploitation of dynamically created extended fields.

FATtools

To get information about a FAT filesystem you can use the fattools subcommand:

# Get some meta information about the FAT filesystem
$ fishy -d testfs-fat32.dd fattools -i
FAT Type:                                  FAT32
Sector Size:                               512
Sectors per Cluster:                       8
Sectors per FAT:                           3904
FAT Count:                                 2
Dataregion Start Byte:                     4014080
Free Data Clusters (FS Info):              499075
Recently Allocated Data Cluster (FS Info): 8
Root Directory Cluster:                    2
FAT Mirrored:                              False
Active FAT:                                0
Sector of Bootsector Copy:                 6

# List entries of the file allocation table
$ fishy -d testfs-fat12.dd fattools -f
0 last_cluster
1 last_cluster
2 free_cluster
3 last_cluster
4 5
5 6
6 7
7 last_cluster
[...]

# List files in a directory (use cluster_id from second column to list subdirectories)
$ fishy -d testfs-fat12.dd fattools -l 0
f     3        4        another
f     0        0        areallylongfilenamethatiwanttoreadcorrectly.txt
f     4        8001     long_file.txt
d     8        0        onedirectory
f     10       5        testfile.txt

Metadata

Metadata files will be created while writing information into the filesystem. They are required to restore those information or to wipe them from filesystem. To display information, that are stored in those metadata files, you can use the metadata subcommand.

# Show metadata information from a metadata file
$ fishy metadata -m metadata.json
Version: 2
Module Identifier: fat-file-slack
Stored Files:
  File_ID: 0
  Filename: 0
  Associated File Metadata:
    {'clusters': [[3, 512, 11]]}

File Slack

The fileslack subcommand provides functionality to read, write and clean the file slack of files in a filesystem.