1 CHAPTER 5 DIFFING

2 What is Diffing? Practice of comparing two sets of data, before and after a changed has occurred Practice of comparing two sets of data, before and after a changed has occurred Purpose to determine what data to modify in the data file directly to cause the change behind the application’s back Purpose to determine what data to modify in the data file directly to cause the change behind the application’s back The two things could be files, Registry entries, memory contents, packets, s etc The two things could be files, Registry entries, memory contents, packets, s etc Here we’ll limit our discussion on files (including special files such as the Window Registry) Here we’ll limit our discussion on files (including special files such as the Window Registry) Can use this technique to cheat at games, recover passwords, bypass protection mechanism etc Can use this technique to cheat at games, recover passwords, bypass protection mechanism etc

3 Tools File Comparison Tools File Comparison Tools –Determine the differences between two files –FC »Included in DOS (later in Windows) –Diff »Originates on the UNIX platform »Has limited binary comparison capabilities, but useful primarily for text file comparison »Microsoft also includes this utility called Windiff in Windows NT and Windows98 resource kit

4 Tools Hex Editors Hex Editors –Make changes to a binary file –Direct access –Hackman »Free Windows-based »Features including searching, cutting, pasting, a hex calculator, a disassembler etc –[N] Curses Hexedit »Free program »Under GPL (GNU Public License) »Available for all UNIX version, DOS »Features, search, binary calculator (converter) etc

5 Tools Hex Editors Hex Editors –Hex Workshop »Commercial software from Breakpoint Software »$49.90 U.S, windows platform »30 days trial available »Features, arithmetic functions, base converter, calculator, checksum calculator etc

6 Tools File System Monitoring Tools File System Monitoring Tools –Work on a group of files such as partition, drive letter or directory –To determine which file, this tools make the process easier –Hardway »Copy all files then compare with modified files to identify which files have been changed –File attributes »Things like dates, times, size, permissions etc

7 Tools File System Monitoring Tools File System Monitoring Tools –Using the Archive Attribute »The FAT (File Allocation Table) file system include a file attribute called the archive bit »The purpose to determine when a file had been modified since the last backup –Checksums / Hashes »Central problem when viruses, trojans or rootkits modified the files »Use checksums or cryptographic hash algorithm

8 Problems Challenges to edit data files directly Challenges to edit data files directly Checksums / Hashes Checksums / Hashes –Checksum or hash being store with the files –Small value represent a block of data to compare old files and new files, if same proceed if not file corrupt Compression / Encryption Compression / Encryption –All files will show as changed

9 How to Secure Against Diffing No true security against this type of attack No true security against this type of attack Implement by encrypting the files using a variation of a real encryption algorithm Implement by encrypting the files using a variation of a real encryption algorithm Just to make it difficult Just to make it difficult

10 End Of Chapter 5