Hello and welcome to the Friday, July 18, 2025 edition of the Sands Internet Stormsiders Stormcast.

My name is Johannes Ulrich, recording today from Washington, D.C.

And this episode is brought you by the Sands.edu graduate certificate program in Purple Team Operations.

Well, after spending maybe a little bit too much time with alternate data streams,

Xavier decided to look at the Linux side of this particular problem and figure out how

something similar can be done in Linux.

Of course, Linux does not have alternate data streams, but it has something a little bit similar,

extended attributes.

Extended attributes can be used for things like Mark of the Web, just like in Windows

with alternate data streams.

It can also be used to, for example, in code PO6 Akels, which is one of the probably more common uses of X adder or extended attributes.

Xavier implemented a little script that can be used to take some data, then Base 64 encoded,

and split it up across different files and appended as extended attributes.

He also wrote a script to then retrieve the data again,

so that's pretty much all you need to then hide data in extended attributes.

Extended attributes can also be just search for,

and that's another thing that Xavier wrote,

a little script to find files with extended attributes.

I basically list the name of these extended attributes,

as well as the content,

to allow you to double check if, well, these are normal,

like, for example, POSIX or if there may be some malware hiding data in this particular

...