ToolWar | Information Security (InfoSec) Tools: Rootkit

Detekt :: Malware Detection Tool against Government Surveillance

<div class="separator" style="clear: both; text-align: justify;">
<img alt="detekt" border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhev1ECdbJcOGLhQL5rphVoj1Ux8wBh3wGbWoySuzKDc4CdDPi5_A0kU4YBambTUqKZPghRdvmePb2aFihp_n_8vHEbCjhc9MbMcXYyPKs6gK7h0tUCeqyuiR8ONVh-AS7WUIAu_Kv_yhaD/s1600/detekt-1d.png" title="Detekt" width="640" /></div>
<div style="text-align: justify;">
<b>Detekt</b> is a <b>free tool</b> that scans your <b>Windows computer for traces of 
known surveillance spyware</b> used to target and monitor human rights 
defenders and journalists around the world. It is important to underline that if <b>Detekt </b>does not find trace of 
spyware on a computer, it does not necessarily mean that none is 
present. Some spyware will likely be updated in response to the release 
of <b>Detekt </b>in order to avoid detection. In addition, there may be 
existing versions of spyware, from these or other providers, which are 
not detected by this tool.</div>
<div style="text-align: justify;">
In recent years we have witnessed a huge growth in the adoption and 
trade in communication surveillance technologies. Such spyware provides 
the ability to read personal emails, listen-in skype conversations or 
even remotely turn on a computers camera and microphone without its 
owner knowing about it.</div>
<div style="text-align: justify;">
Some of this software is widely available on the 
Internet, while some more sophisticated alternatives are made and sold 
by private companies based in industrialized countries to state law 
enforcement and intelligence agencies in countries across the world.</div>
<div style="text-align: justify;">
There is little to no regulation currently in place to 
safeguard against these technologies being sold or used by repressive 
governments or others who are likely to use them for serious human 
rights violations and abuses.</div>
<div style="text-align: justify;">
<strong>How widely do governments use surveillance technology?</strong></div>
<div style="text-align: justify;">
Governments
 are increasingly using surveillance technology, and targeted 
surveillance in particular, to monitor the legitimate activities of 
human rights activists and journalists. <span>Powerful software 
developed by companies allows governments and intelligence agencies to 
read personal emails, listen-in on Skype conversations or even remotely 
turn on a computers camera and microphone without its owner knowing 
about it.</span></div>
<div style="text-align: justify;">
<span>In many cases, the information they gather 
through those means is used to detain, imprison and even torture 
activists into confessing to crimes. It's impossible,
 however, to give an accurate estimate of how many people are affected 
by this surveillance spyware. This is because the companies that build 
and sell such software market themselves on their ability to hide it 
from users. Recent research has shown that known spyware has been found present in dozens of countries, covering all regions of the world. <b>Detekt</b>
 is the first public tool that will assist activists, journalists and 
civil society groups to scan their computers for spyware.</span></div>
<h3 style="text-align: justify;">
<span>Download:  </span></h3>
<div style="text-align: justify;">
<b><span>Windows:: </span></b><span><a href="https://github.com/botherder/detekt/releases/download/v1.2/detekt.exe" target="_blank">Detekt v1.2</a> (.exe)</span></div>
<div style="text-align: justify;">
<span><b>Source Code:: </b>https://github.com/botherder/detekt/archive/v1.2.zip<b> </b></span></div>
<div style="text-align: justify;">
<span><b>Official Website::</b> https://resistsurveillance.org/</span></div>

Detekt :: Malware Detection Tool against Government Surveillance

Detekt is a free tool that scans your Windows computer for traces of known surveillance spyware used to target and monitor human righ...

Second Look (Linux Memory Forensics) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both;">
 <img border="0" height="124" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj3s-HN2dZGFNYEv4wk6IGLmblttBSVAhyiADK6Tcg_sE6ucHyhB_M1xINBz418Iy8K5vLizCBYB253oHqRxFsyyY8VZykHyveoJ2XteU5fG4hbI2gGuQ-r6z4iNVCrNR0thbZCaMasHa_/s1600/secondlook.jpg" width="640" /></div>
The Incident Response edition of <b>Second Look®: Linux Memory Forensics</b> is designed for use by investigators who need quick, easy, and effective <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory acquisition</a> and analysis capabilities. Second Look® is a product of Raytheon Pikewerks Corporation. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Acquisition"> Memory Acquisition::</span></h3>
<div style="text-align: justify;">
<b>Second Look®</b> preserves the volatile system state, capturing evidence  and information that does not exist on disk and may otherwise be lost as  an investigation proceeds.  A <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command-line</a> script allows for  acquisition of <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> from running systems without introducing any  additional software.  A memory access driver is provided for use on  systems without a native interface to physical memory. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Analysis"> Memory Analysis ::</span></h3>
<div style="text-align: justify;">
<b>Second Look® </b>interprets live system memory or captured memory images,  detecting and <a href="http://www.toolwar.com/search/label/Reverse" target="_blank">reverse engineering</a> malware, including stealthy kernel <a href="http://www.toolwar.com/search/label/Rootkit" target="_blank"> rootkits</a> and backdoors.  A kernel integrity verification approach is  utilized to compare the Linux kernel in memory with a reference kernel.   Pikewerks provides thousands of reference kernels derived from original  distribution kernel packages, and a script for creating reference  kernels for other systems, such as those running custom kernels. </div>
<div style="text-align: justify;">
<b>Second Look®</b> also applies an integrity verification approach for  the analysis of each process in memory.  This enables it to detect  unauthorized applications as well as stealthy user-level <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a>. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Supported_Systems"> Supported Systems ::</span></h3>
<div style="text-align: justify;">
Second Look® is regularly updated to support analysis of the latest  kernels and the most commonly used <a href="http://www.toolwar.com/search/label/Distribution" target="_blank">Linux distributions</a>.  The following  are its capabilities as of April 2012: </div>
<ul style="text-align: justify;">
<li> Supported target kernels: 2.6.x, 3.x up to 3.2 </li>
<li> Supported target architectures: x86 32- and 64-bit </li>
<li> Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-12.04, and more! </li>
</ul>
<h3 style="text-align: justify;">
Product features (Second Look Incident Response Edition) ::</h3>
<ul style="text-align: justify;">
<li>Memory acquisition and analysis for all 32- and 64-bit x86
(i386/i486/i586/i686, amd64/x86_64) Linux systems running 2.6- and 3-series
kernels. This includes:
<ul>
<li>Amazon Linux 2010.11 through 2014.03, and higher;</li>
<li>Debian 4 through 7, and higher;</li>
<li>Fedora 2 through 20, and higher;</li>
<li>Red Hat Enterprise Linux (RHEL) and CentOS 4.x, 5.x, 6.x, and higher;</li>
<li>Ubuntu 4.10 through 14.04, and higher;</li>
<li>and other distributions.</li>
</ul>
</li>
<li>Analysis via command line interface (CLI) or graphical user interface
(GUI) applications which run on Ubuntu 12.04 (32- or 64-bit) or RHEL/CentOS 6.x
(64-bit).</li>
<li>Automatic kernel version identification — just select a memory image
and go.</li>
<li>Supported memory image formats:
<ul>
<li>raw physical memory images ("mem" format — as produced by
secondlook-memdump, Inception, and other
tools);</li>
<li>SLM memory images ("slm" format — a high-performance compressed
memory image format used by Second Look Enterprise Security Edition);</li>
<li>LiME memory images ("lime", "padded", or LiME "raw" formats — "lime"
and LiME "raw" formats require conversion with secondlook-lime2mem or
secondlook-limeraw2mem, respectively ‐ LiME "padded" is the equivalent of
a raw physical memory image);</li>
<li>VMware virtual machine snapshots ("vmem", "vmsn", or "vmss" formats —
"vmsn" and "vmss" formats, as well as "vmem" files from VMs with >4GB RAM,
require conversion with VMware's vmss2core
and secondlook-core2mem);</li>
<li>VirtualBox snapshots ("vbc" format — via conversion with
secondlook-vbc2mem); and</li>
<li>KVM Libvirt-QEMU-Save or QEMU-savevm snapshots ("lqs" or "qsv" formats
— via conversion with lqs2mem, originally
secondlook-lqs2mem, now an open source project).</li>
</ul>
</li>
<li>Support for analysis of memory images from systems running either
distribution stock kernels or custom kernels.</li>
<li>Support for analysis of memory images from
Amazon EC2 instances (under both pv and hvm virtualization types).</li>
<li>Access to a repository of over 9000 ZRKs (Zipped Reference Kernels)
providing the metadata and baseline for analysis and verification of CentOS,
Debian, Fedora, RHEL, and Ubuntu stock kernels.</li>
<li>An easy-to-use tool for creation of ZRKs for other distributions or for
custom kernels.</li>
<li>Second Look ZRKs
can also be used as Volatility profiles.</li>
<li>Integrity verification of the kernel and processes in memory.</li>
<li>Access to a pagehash database containing hashes of the executable code
pages of the ELF executables and shared libraries from over 2 million
software packages from the Amazon, CentOS, Debian, Fedora, RHEL, and Ubuntu
distributions.</li>
<li>An easy-to-use tool for the addition of pagehashes supporting verification
of custom or third-party software.</li>
<li>Detection of kernel rootkits, backdoors, and other kernel-mode malware
(known and unknown varieties).</li>
<li>Detection of shared library rootkits, keyloggers, spyware, injected
libraries, injected threads, and other user-mode malware (known and unknown
varieties).</li>
<li>Detection of unknown or unauthorized processes.</li>
<li>Recovery of device mapper crypto keys
for LUKS, TrueCrypt, and other full disk encryption schemes.</li>
<li>Extraction of system state from captured memory images, including loaded
kernel modules, running processes, memory mappings, open files, active network
connections, and more.  Output is available in the GUI, in plain text from the
CLI, and in JSON format for ingestion by other programs.</li>
<li>Offline usage is supported via a subscription to our ZRK and pagehash reference data
feeds.</li>
</ul>
<h3 style="text-align: justify;">
More Reasons to Choose Second Look</h3>
<div style="text-align: justify;">

Beyond the unique and powerful Linux Incident Response feature set listed
above, what sets Second Look apart is the team behind it and the quality
of the software they deliver.

</div>
<ul style="text-align: justify;">
<li>The Second Look Team provides professional support via phone and
email, with on-site consulting services available.  You get direct access to
experts in Linux system internals and security.</li>
<li>Customer feedback often quickly leads to new features.</li>
<li>Second Look ships with comprehensive documentation, including a
User Guide with explanations of the techniques most commonly used by
attackers to maintain stealthy persistence on Linux systems.</li>
<li>Second Look is regression tested against a large suite of sample
memory images to ensure maximum quality and compatibility.</li>
<li>If you like the visibility that Second Look gives you during
investigations, you can upgrade to the Enterprise Security edition to monitor
your systems on an ongoing basis.</li>
</ul>
<ul style="text-align: justify;">
</ul>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/wt326aXmDMA?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b>$1495 (USD) | <a href="http://secondlookforensics.com/contact/" target="_blank">Contact Here</a> for Purchase</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://secondlookforensics.com/">http://secondlookforensics.com/</a></div>

Second Look (Linux Memory Forensics) :: Tools

The Incident Response edition of Second Look®: Linux Memory Forensics is designed for use by investigators who need quick, easy, and e...

Rootkit Hunter (Rootkit Scanner) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<b><img alt="rootkit hunter logo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmAKcX4SzdyaNdf4DapqpG3d1wMIQl85Bf0MAAPmJDtEku0X-3BPe_s9_ozZkwyHMyJrfIXdORod7eI9TGZejFbegPFldu185F6m872hTfpFEgo8CPqIQPMyFm9ltA2FzzD6V9PhSLSoVP/s1600/Rkhunter.jpg" title="rootkit hunter logo" /></b></div>
<b>Rootkit Hunter</b> is <a href="http://www.toolwar.com/search/label/Scanner" target="_blank">scanning tool</a> to ensure you for about 99.9%* you're clean of nasty <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a>. This tool <i>scans for <a href="http://www.toolwar.com/search/label/Rootkit" target="_blank">rootkits</a>, backdoors and local exploits</i> by running tests like:<br />
<br />
    - MD5 <a href="http://www.toolwar.com/search/label/Hash" target="_blank">hash</a> compare<br />
    - Look for default files used by rootkits<br />
    - Wrong file permissions for binaries<br />
    - Look for suspected strings in LKM and KLD modules<br />
    - Look for hidden files<br />
    - Optional scan within plaintext and binary files<br />
<br />
<b>Rootkit Hunter</b> is released as GPL licensed project and free for everyone to use.* No, not really 99.9%.. It's just another security layer<br />
<br />
<b>System requirements:</b><br />
    - Compatible operating system (see 'Supported operating systems')<br />
    - Bourne Again Shell (BASH)<br />
<br />
<b>Supported operating systems ::</b><br />
- Most <a href="http://www.toolwar.com/search/label/Distribution" target="_blank">Linux distributions</a><br />
- Most *BSD distributions</div>
<div style="text-align: justify;">
<h3>
Tutorial ::</h3>
<b>Scanning Techniques :: </b><a href="http://www.rootkit.nl/articles/rootkit_scanning_techniques.html" target="_blank">Click Here</a><br />
<b>Documentations :: </b><a href="http://www.rootkit.nl/files/rootkit_documentation.html" target="_blank">Click Here</a><br />
<b>Video Tutorial ::</b>  <br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/5ngeBpeRros?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
</div>
<div style="text-align: justify;">
<h3>
Download ::</h3>
</div>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://sourceforge.net/projects/rkhunter/files/latest/download" target="_blank">RootKit Hunter v1.4.0</a> (.tar.gz)<b>
</b></div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.rootkit.nl/projects/rootkit_hunter.html">http://www.rootkit.nl/projects/rootkit_hunter.html</a></div>

Rootkit Hunter (Rootkit Scanner) :: Tools

Rootkit Hunter is scanning tool to ensure you for about 99.9%* you're clean of nasty tools . This tool scans for rootkits , backdoo...

OSSEC HIDS (Open Source Host-based Intrusion Detection System) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<img alt="OSSEC HIDS LOGO" border="0" height="135" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5hqb2K8125dyd1VvPYPXuZGkoUB_MMaOaCvQ8UJmkGc_rzg5_pSN4LbyC0sos5v0fje1PInJ7NZFN-1S4vXZFrZPIrnVz7yOztzaN_KdB1vc-kdITq6ho2Ru9-as6vYtx2oggoWLc8Sgl/s320/ossec.jpg" title="OSSEC HIDS LOGO" width="320" /></div>
<div style="text-align: justify;">
<b>OSSEC HIDS</b> is an <i>Open Source Host-based Intrusion Detection System </i>that  performs log analysis, file integrity checking, policy monitoring,  rootkit detection, real-time alerting and active response.  </div>
<div style="text-align: justify;">
It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows.  </div>
<div style="text-align: justify;">
Check out <b>OSSEC</b> features and how it works for more information about how OSSEC can help you solve your host-based security problems. </div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/lUMs1uqwRX0?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: center;">
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Download Here :: </b><a href="http://www.ossec.net/files/ossec-agent-win32-2.7.exe" title="v2.7 Agent for Windows">ossec-agent-win32-2.7.exe</a> (For Windows)</div>
<div style="text-align: justify;">
                                     <a href="http://www.ossec.net/files/ossec-hids-2.7.1-beta-1.tar.gz">ossec-hids-2.7.1-beta-1.tar.gz</a> (For Linux/BSD)</div>
<div style="text-align: justify;">
<b>Official Website :: </b>http://www.ossec.net/</div>
<div style="text-align: justify;">
</div>
</div>

OSSEC HIDS (Open Source Host-based Intrusion Detection System) :: Tools

OSSEC HIDS is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitor...

Sysinternals :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Sysinternals :: ToolWar" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSq-Sfe-nZvRnH2NtPdWJwzFfm6Iu-WCRgc89bUJhTVOQ4asiAdUwDyhca19ne6f7BgXuUM3Mt1BY76NDQb3dkjcVjbTeBDhfxPGOpF8Bl5cNZvgft7-zQQRedVQtdphM_FYCTA6sUEb3i/s200/Folder-Tools-icon.png" title="Sysinternals :: ToolWar" width="200" /></div>
<div style="text-align: justify;">
<b>Sysinternals</b> is very useful utility by Microsoft. The <b>Sysinternals</b> web site was created in 1996 by   <b>Mark Russinovich</b> and <b>Bryce Cogswell</b> to host their advanced system  utilities and technical information. Whether you’re an IT Pro or a  developer, you’ll find Sysinternals utilities to help you manage,  troubleshoot and diagnose your Windows systems and applications. </div>
<div style="text-align: justify;">
Sysinternals provides many small windows utilities that are quite  useful for low-level windows hacking. Some are free of cost and/or  include source code, while others are proprietary. Survey respondents  were most enamored with: </div>
<ul style="text-align: justify;">
<li><b>ProcessExplorer</b> for keeping an eye on the files and directories open by any process (like lsof on UNIX). </li>
<li><b>PsTools</b> for managing (executing, suspending, killing, detailing) local and remote processes. </li>
<li><b>Autoruns</b> for discovering what executables are set to run during system boot up or login. </li>
<li><b>RootkitRevealer</b><b> </b>for detecting registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. </li>
<li><b>TCPView</b>, for viewing TCP and UDP traffic endpoints used by each process (like Netstat on UNIX). </li>
</ul>
<div style="text-align: justify;">
Many of the <b>Sysinternals</b> tools originally came with source code and there were even Linux versions. Microsoft acquired Sysinternals  in July 2006, promising that “Customers will be able to continue  building on Sysinternals' advanced utilities, technical information and  source code”. Less than four months later, Microsoft removed most of that source code.</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/Wuy_Pm3KaV8?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: left;">
<b>Download Here :: </b><a href="http://download.sysinternals.com/files/SysinternalsSuite.zip" target="_blank">Microsoft Sysinternals Suite</a><b> </b> </div>
<div style="text-align: left;">
<b>Source :: </b>http://www.microsoft.com</div>
</div>

Sysinternals :: Tools

Sysinternals is very useful utility by Microsoft. The Sysinternals web site was created in 1996 by Mark Russinovich and Bryce Cogsw...

Subscribe to: Posts ( Atom )