Mounts
Analyzing Mounted File Systems in Incident Response (Linux Systems)
In Linux systems, mounted file systems are essential for accessing external drives, network shares, and removable media. However, they can also serve as attack vectors during incidents, especially in ransomware attacks or malware propagation. Here's how to effectively analyze mounted file systems during an incident response.
Why Mounted File System Analysis is Crucial
Attackers exploit file systems for various malicious purposes:
Ransomware Attacks: Encrypt data on shared or mounted storage.
Malware Propagation: Spread malware across network shares and external drives.
Data Exfiltration: Steal sensitive data stored on mounted devices.
Persistence: Store malicious files in obscure mounts to evade detection.
Steps for Analyzing Mounted File Systems
1. Identify Active Mounts
Command: mount
Lists all currently mounted file systems along with their mount points.
Output Example:
Command: findmnt
Displays mounted file systems in a tree-like structure, making it easier to trace mount points and dependencies.
Command: df -aTh
Shows disk usage and type of file systems in a human-readable format.
Key Information:
File System Type: e.g., ext4, nfs, smbfs.
Mount Point: e.g.,
/mnt/shared.Disk Usage: Helps detect unusual or critical storage consumption.
Command: cat /proc/mounts
Reads the real-time list of mounted file systems from the kernel.
2. Investigate Logs for Mount Events
Though mounting and unmounting events aren't always explicitly logged, they may leave traces in system logs.
Command: dmesg
Search for mount-related events in kernel messages.
Example Output:
Command: grep Logs for Related Events
Key Logs:
Unauthorized mounts: Look for mounts not configured by administrators.
Network file systems: Identify mounts from suspicious external servers.
3. Evaluate Mounted File Systems
Focus on Critical Mount Points:
/mnt and /media: Temporary storage or external drives.
NFS/SMB Shares: Mounted over the network.
/dev and /proc: Special file systems that could hide malicious activity.
Look for Unusual or Unauthorized Mounts:
Unexpected Remote Shares: Mounted from unknown or unauthorized IPs.
Non-Standard Paths: Files or directories mounted in unusual locations.
Hidden Volumes: Mounted with obscure names to avoid detection.
4. Analyze Disk Usage
Command: du
Shows disk usage within a specific directory.
Command: lsblk
Displays detailed information about block devices and their mount points.
Post-Incident Actions
1. Unmount Suspicious File Systems
If unauthorized or malicious mounts are identified, unmount them immediately:
2. Isolate Compromised Systems
Quarantine affected systems or shares to prevent further spread of malware or encryption by ransomware.
3. Restore from Backups
If data has been compromised, such as in a ransomware attack, restore the affected file systems from clean, verified backups.
Hardening and Prevention
1. Restrict Mount Permissions
Use the
noexecoption for mounts to prevent execution of binaries.Limit mounting permissions to trusted users only.
Example:
2. Implement Network Share Security
Limit access to network shares using IP whitelisting.
Monitor and log all access to shared mounts.
3. Enable File System Monitoring
Use tools like Auditd to monitor file system activities, including mount operations:
4. Use Read-Only Mounts for Non-Essential Data
Prevent attackers from writing malicious files to critical shares:
Key Commands
Command | Purpose |
| List currently mounted file systems. |
| Display mounts in a tree structure. |
| Show disk usage and file system types. |
| Real-time view of mounted file systems. |
`dmesg | grep mount` |
| Unmount a suspicious or unauthorized file system. |
| Monitor mounted directories for changes. |
Key Points
Mounted file systems are critical to the functionality and storage capabilities of Linux systems, but they also pose security risks during an attack. By methodically analyzing mounted file systems, incident responders can identify malicious activity, secure compromised environments, and prevent further exploitation. Proactive measures such as limiting permissions, monitoring file system activity, and using secure mounts significantly enhance a system's resilience against attacks.
Last updated