Goal:
Create Mac Terminal Script to Hash a USB Drives Contents an Compare Original with future hashes to detect unwanted changes made by Malware.
The Story Behind:
I decided I really needed a hashing script for my ZoomText USB Drive. ZoomText is a Accessibility Technology drive that allowas you to move a portable version of the installer with you where ever you go. Its actually pitifully implemented. Because it doesn’t use any U3 techniques (but as a security guy I’d still probably have reservations if it did). So in short its just a USB with an installer.. an a few log and settings files. For DRM and licensing reasons you have to have the key plugged into the system to run the program; even though it installs locally. I haven’t quite figured out the dependence on the USB stick yet; I’m assuming its using a hard-coded serial that the USB Bus scans that the drive has (Kind of a hardware MAC). The REAL problem is the drive has NO write protection, hence as an IT Tech I can go around fixing computers with my Low Vision tool but it could pick up all sorts of malware along the way. So I was trying to use SandBoxie to isolate a USB channel on my XP box and then use a free CNET MD5 hashing program. (Called MD5 Summer, which ain’t bad). But I couldn’t get over the fact I was plugging in a drive that might be infected… into an XP Box. I haven’t had a chance to do a lot of IT forensic research to see the best way to do that but SandBoxie had a bunch of features an I wasn’t entirely sure I had it configured right. Solution I thought… Use my new Mac.. So here is a script I made below to help. I figure if there’s a virus that jumps to my drive it won’t be a Mac one since I’m on PC’s. Haven’t quite figured out how to auto-close Mac Scripts but if you have any suggestions I’m game. (twitter @certdoctor ) As an additional thought I’ve considered a portable container from TrueCrypt along with a U3 style Truecyrpt.exe on the drive… I’d write protect the volume.. Of coarse if I didn’t use the whole drive (whole disk) a virus could always jump on with the truecrypt.exe in the standard NTFS space… So its a mixed bag. Really I’d be dealing with the same issues needing to hash.
Note: “No Name” is the name of my USB Device… You’ll need to look in you volumes folder to find the name of your own. You’ll also need to change the user folder from “certdoctor” to your username folder. I’m also a newbie to Mac/BASH style scripting so pardon the long form.. An feel free to make any suggestions.
The Script:
#!/bin/bash
CLEAR
cd /
cd /volumes
cd “no name”
md5 *.* >/users/certdoctor/documents/usb_md5_current.txt
cd /users/certdoctor/documents/
CLEAR
diff usb_md5.txt usb_md5_current.txt
read -p “—-PAUSE—-”
Recent Comments