nerdexam
GIAC

GCFA · Question #1

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database f

The correct answer is C. Wiping the contents of the hard disk with zeros.. The bash loop alternately overwrites the entire hard disk with random data and then zeros, effectively destroying all data on the drive before the attacker disconnects.

Section 5: Security

Question

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer. After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting. for (( i = 0;i<11;i++ )); do dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done Which of the following actions does Adam want to perform by the above command?

Options

  • AMaking a bit stream copy of the entire hard disk for later download.
  • BDeleting all log files present on the system.
  • CWiping the contents of the hard disk with zeros.
  • DInfecting the hard disk with polymorphic virus strings.

How the community answered

(30 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    83% (25)
  • D
    10% (3)

Why each option

The bash loop alternately overwrites the entire hard disk with random data and then zeros, effectively destroying all data on the drive before the attacker disconnects.

AMaking a bit stream copy of the entire hard disk for later download.

A bit-stream copy would read FROM the disk as input (dd if=/dev/hda of=<destination>), not write to it as output.

BDeleting all log files present on the system.

The command targets the raw block device /dev/hda, not any specific file path or log directory, so log files are not selectively deleted.

CWiping the contents of the hard disk with zeros.Correct

The command uses 'dd if=/dev/zero of=/dev/hda' inside the loop to write zeros directly to the raw block device /dev/hda, overwriting every sector. It also writes random data first via /dev/random, making recovery harder. Together these constitute a multi-pass disk wipe intended to destroy forensic evidence.

DInfecting the hard disk with polymorphic virus strings.

Writing zeros or random bytes to disk sectors does not constitute virus injection; no executable payload is being placed on the disk.

Concept tested: Destructive disk wiping using dd command

Source: https://man7.org/linux/man-pages/man1/dd.1.html

Topics

#disk wiping#dd command#anti-forensics#Linux shell

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice