nerdexam
GIAC

GCIH · Question #201

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database…

The correct answer is C. Wiping the contents of the hard disk with zeros. The command uses 'dd' to overwrite the raw hard disk device with random data and then zeros in a loop, effectively destroying all data on the disk. This is a common anti-forensics technique used to eliminate evidence after a breach.

Web Application Attacks & Post-Exploitation

Question

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer. After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting. for (( i = 0;i<11;i++ )); do dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done Which of the following actions does Adam want to perform by the above command?

Options

  • AInfecting the hard disk with polymorphic virus strings.
  • BDeleting all log files present on the system.
  • CWiping the contents of the hard disk with zeros.
  • DMaking a bit stream copy of the entire hard disk for later download.

How the community answered

(32 responses)
  • A
    6% (2)
  • B
    13% (4)
  • C
    78% (25)
  • D
    3% (1)

Why each option

The command uses 'dd' to overwrite the raw hard disk device with random data and then zeros in a loop, effectively destroying all data on the disk. This is a common anti-forensics technique used to eliminate evidence after a breach.

AInfecting the hard disk with polymorphic virus strings.

The 'dd' command performs raw block-level data copying and overwriting and has no capability to inject or spread polymorphic virus code into disk sectors.

BDeleting all log files present on the system.

Deleting log files would involve targeted commands like 'rm -rf /var/log/*' on specific file paths, not writing to the raw block device /dev/hda.

CWiping the contents of the hard disk with zeros.Correct

The 'dd if=/dev/zero of=/dev/hda' portion writes zeros across every sector of the hard disk device, and the preceding 'dd if=/dev/random of=/dev/hda' pass first overwrites with random data. Together in a loop across 11 iterations, they perform a multi-pass wipe of the entire disk, destroying all filesystem data, log files, and forensic evidence of the intrusion.

DMaking a bit stream copy of the entire hard disk for later download.

A bit stream copy would read FROM /dev/hda and write the output to another destination; this command writes TO /dev/hda, destroying data rather than copying it.

Concept tested: Anti-forensics disk wiping using Linux dd command

Source: https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final

Topics

#anti-forensics#disk wiping#bash scripting#covering tracks

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice