How to collect memory-only filesystems on Linux systems, (Wed, Oct 29th)
Source SANS ISC Handlers Diary
Description
This threat involves attackers using memory-only filesystems (tmpfs) on Linux systems, such as /dev/shm, to hide malicious tools or stage data exfiltration. Traditional forensic imaging tools cannot capture these volatile filesystems because they lack block device backing. The analyst describes a method to collect both metadata and file contents from these tmpfs mounts by first extracting inode metadata using stat commands and then archiving file contents with tar, preserving forensic integrity. This technique has been tested successfully on numerous Linux and Unix-like systems. The threat highlights the challenge of detecting and collecting evidence from in-memory filesystems that attackers exploit to evade detection. The severity is medium due to the difficulty in forensic collection and potential for attackers to hide artifacts in tmpfs, but exploitation requires system access. European organizations running Linux servers with tmpfs mounts are at risk of stealthy attacks leveraging this technique.