One area that I really didn't dive too deep into in the last skill was Linux file and security and that's why we're here.
I wanted to dedicate an entire skill to it because there are many different things that we don't know or maybe do know about file security inside of Linux that plays right into our hands as pen testers and other malicious actors that exist out there in the world wide web of sports.
One thing that we need to understand is that when we're taking a look at an operating system, a lot of these file permissions and different attributes are set by default within the operating system themselves.
So as we continue to go out through this course, I challenge you to also take a look at this through the eyes of a security administrator or a CISO if you would be.
And the reason for this is because as we continue to take a look at some of these vulnerabilities that exist inside of Linux and other programs and operating systems through our course,
how would you as an administrator or security administrator deal with some of these loopholes, backdoors and other flaws that we have found along the way?
As a pen tester, I want you to keep this in mind because how you would fix it as a defensive personnel or a security administrator is how you would attack it as a pen tester, just the exact opposite.
And it's going to play into, along with the file and security that we go through in this skill, some of the evasion measures that we start to wrap up the course with.
And before we get too deep into this skill, one thing that I really want to touch on is that there are files that are considered sensitive and basically you can't do without them in the operating system itself that obviously pen testers and hackers alike would go after.
It doesn't necessarily mean that they're sensitive in nature. They just pertain to the operating system or the kernel and it's something that we can link on to or attack that we can actually gain access to the system.
One thing that I really wanted to hit on is the sensitivity of a file. And that's not always gauged by the importance of the file to the operating system more so than it's gauged based on the information that is pertained in the file and how much of an importance it plays to the actual information owner.
For example, if we have a file that is, let's say, kernel.exe and it plays into the Linux operating system, yes, that's important. And if you attack it as a pen tester or hacker and we go into the actual operating system, yes, that's bad for the actual system owner because we can get in there and do all sorts of things and find all sorts of stuff.
But we turn tables around and find a file on the desktop called passwords or employee information, something along those lines, and we start going in and finding PII, personally identifiable information.
Now, the importance to the actual system itself is minimal because that file is not needed for the operating system or any of the programs itself to run.
But the information contained in that file is of sensitive nature. So as we continue throughout this skill, please keep that in the back of your mind because as a pen tester, we're usually in the mindset of going into an organization and attacking the actual systems and networks and messing with the users and having all sorts of fun.
But it's the information that we're actually there to protect the most. And it also falls in that AAA model and also brain fart CIA triad confidentiality, integrity and availability because those files that contain that PII or sensitive information can do more damage and irreparable harm to the organization or to an individual user than just simply destroying an operating system.
If you destroy the operating system or the actual system itself and disable complete access to the information, yes, the user is hindered, but the user is also in a safe spot, too, because if they can't access the information and we can't access the information as the attacker, then theoretically we've done them a favor by making the information more secure in a roundabout way.
But it's the actual sensitivity of the data within some of these files that we attack. Now, as a side here, the digital forensics person in me wants to also mention that if we run across something illegal, it is our obligation to not only notify law enforcement, but to make sure that the organization that we're pen testing knows as well.
Law enforcement first, organization second, because if it's a crime or you suspect it to be a crime, it needs to be reported. And I may be hitting on a couple of things that are all over the place here and there in pertaining to our course, but it will play throughout the rest of the skill as you apply some of the things that we've discussed here for the remainder of this one.
So without further ado, let's get to it.