Using Knoppix for Linux System Intrusion Detection

Knoppix is a Debian-based Live Linux distribution that is very suitable for system recovery and intrusion detection because it can boot directly from CD/DVD or USB without needing to be installed on the hard drive, and it does not modify the target system.

Advantages of Using Knoppix for Intrusion Detection

1. No Trace Operation: Does not modify any data on the system being checked
2. Independent Environment: Not affected by any rootkits or malware that may exist on the target system
3. Rich Toolset: Includes many security analysis tools
4. File System Access: Capable of mounting and inspecting various file systems

Steps for Using Knoppix for Intrusion Detection

1. Prepare Knoppix Boot Media

# Download the latest version of Knoppix
wget http://www.knopper.net/knoppix-mirrors/index-en.html
# Create a bootable USB (assuming /dev/sdb is the USB device)
sudo dd if=KNOPPIX_*.iso of=/dev/sdb bs=4M status=progress

2. Boot and Mount the Target System

After booting Knoppix, mount the partition of the suspicious system:

# List available partitions
sudo fdisk -l
# Mount the target partition (assuming /dev/sda1 is the root partition)
sudo mkdir /mnt/target
sudo mount /dev/sda1 /mnt/target
# If you need to access other partitions (like /home)
sudo mount /dev/sda2 /mnt/target/home

3. Basic Intrusion Detection Steps

Check User and Authentication Logs

# View logs of the target system
less /mnt/target/var/log/auth.log
less /mnt/target/var/log/secure
# Check login records
cat /mnt/target/var/log/wtmp | last -f /dev/stdin

Analyze Processes and Network Activity

# Check the process list of the target system (if proc is mounted)
mount -t proc proc /mnt/target/proc
chroot /mnt/target ps aux
# Check network connections
chroot /mnt/target netstat -tulnp

File System Analysis

# Find recently modified files
find /mnt/target -type f -mtime -7 -exec ls -l {} \;
# Check SUID/SGID files
find /mnt/target -perm -4000 -o -perm -2000 -type f -exec ls -l {} \;
# Check hidden files and directories
find /mnt/target -name ".*" -exec ls -ld {} \;

4. Using Pre-installed Tools in Knoppix

Knoppix includes many useful security tools:

• ClamAV: Virus scanning

sudo freshclam
sudo clamscan -r /mnt/target

• rkhunter: Rootkit detection

sudo rkhunter --check --sk

• chkrootkit: Rootkit detection

sudo chkrootkit -r /mnt/target

5. Advanced Analysis Techniques

Memory Analysis (if the system is still running)

# Use LiME to obtain a memory dump
sudo insmod lime.ko "path=/mnt/target/memdump.lime format=lime"
# Then use Volatility to analyze the memory dump

Timeline Analysis

# Create a file system timeline
fls -r -m / /mnt/target > /mnt/target/timeline.body
mactime -b /mnt/target/timeline.body -d > /mnt/target/timeline.csv

Precautions

1. Use read-only mode when mounting the target system to prevent accidental modifications:

sudo mount -o ro /dev/sda1 /mnt/target

1. For encrypted file systems, decrypt before mounting
2. Save analysis results to external media rather than the target system
3. Document all operational steps for future evidence

Knoppix provides a powerful and secure environment to analyze potentially compromised systems without affecting the original evidence. For serious intrusion incidents, it is recommended to contact a professional security team for in-depth investigation.

–END–If you find this useful, please follow, like, and share. If you need technical assistance, feel free to contact us. We look forward to your visit.