SlideShare una empresa de Scribd logo

Next Generation Memory Forensics

•
•
Andrew Case
Andrew Case

This document provides an overview of the Volatility memory forensics framework. It discusses the Volatility Foundation, which supports development of the open-source Volatility tool. It highlights new features in Volatility 2.4, including improved support for Windows, Linux, MacOS, and analyzing application artifacts from programs like Chrome, Firefox, and Notepad. It outlines the Volatility roadmap and concludes by discussing the 2014 Volatility Plugin Contest winners, whose new plugins will enhance Volatility's capabilities.

Tecnología
1 de 41
Descargar para leer sin conexión
EMPOWERING INVESTIGATORS THE VOLATILITY FOUNDATION Next Generation Memory Forensics Volatility Developers November 5, 2014
© 2014 The Volatility Foundation Volatility Development Team •  Core Developers: •  Mike Auty (ikelos) •  Andrew Case (attc) •  Brendan Dolan-Gavitt (moyix) •  Michael Hale Ligh (MHL) •  Jamie Levy (gleeda) •  AAron Walters (labarum) •  The Volatility Community (OOV) •  Numerous research collaborators/testing/bugs •  Academia, government, industry •  Mailing lists, blogs, irc (#volatility) •  Moved: https://github.com/volatilityfoundation/volatility •  @volatility 2 Thank You!
© 2014 The Volatility Foundation Volatility Foundation •  Volatility development is supported by an independent foundation •  US 501(c)(3) Nonprofit •  The Volatility Foundation was established: •  to support the development of Volatility •  to promote the use of Volatility and memory analysis in the forensics community •  to protect the intellectual property and the framework's long-term viability •  to advance the state of the art in memory analysis research. •  But….development driven by Volatility community 3
© 2014 The Volatility Foundation Opaque Systems/Enterprise •  Opaque components of information infrastructure •  Can your systems be trusted? (patches, malware)
© 2014 The Volatility Foundation5 Adversaries Challenges •  Adversaries Challenges •  They want to remain undetected (stealthy) •  They want to execute a mission •  They rely on components of the operating system •  Consume system resources •  Memory (stack, heap, pool) •  Objects (thread, process, mutex, driver) •  Modify control flow (execution) of the system •  Hide the allocated resources •  Perform mission
© 2014 The Volatility Foundation What is Memory Forensics? •  Memory forensics is the process of acquiring and analyzing physical memory (RAM) in order to find artifacts and evidence •  Analysis does not depend on OS (trust) •  Unconstrained analysis (entire state of OS/historical) •  Removes the active adversary •  Usually performed in conjunction with disk and network forensics (memory only artifacts) •  Rapid triage/analysis leads (sandbox)
© 2014 The Volatility Foundation Next Generation Analysis 7 Physical Memory Analysis Operating System Analysis Application Analysis Physical Address Space Kernel Address Spaces Application Address Spaces User Address Spaces Swap Context Virtual Memory Analysis (Hardware) Virtual Address Spaces
© 2014 The Volatility Foundation8 Volatility Framework •  Volatile memory artifact extraction utility framework •  Completely open source (GPLv2/Python) •  Cross platform (Python) •  Single, cohesive analysis framework •  Windows, Mac, Linux, Android, … •  Command-line tools/scriptable •  Modular architecture •  Unparalleled features! •  Active Community •  Industry, academics, government, law enforcement
© 2014 The Volatility Foundation9 Volatility 2.4: AMF
© 2014 The Volatility Foundation Volatility 2.4: Highlights •  Released: August 2014 at Black Hat Arsenal •  Address Spaces (3 new AS/17) •  QEMU virtual machine memory samples •  “split” VMware files (vmem, vmss, vmsn) •  Windows BitMap crash dumps (Windows 8/2012) •  Mac OSX (30 new plugins/62) •  Mavericks through 10.9.4 •  Mac string translation •  Adium message (OTR)/Contact records/Notes artifacts •  Apple Keychain encryption keys/clear-text PGP emails •  API hooks in kernel and process memory •  IP and socket filters •  Suspicious process mappings (injected code) •  Hidden kernel extensions (extraction) •  Recovered files cached in memory 10
© 2014 The Volatility Foundation Application Artifacts 11
© 2014 The Volatility Foundation Volatility 2.4: Highlights •  Linux/Android (24 new plugins/66) •  Linux kernels through 3.16 •  Linux string translation •  API hooks (kernel/userland) •  GOT/PLT overwrites •  Hollowed executables •  Suspicious process mappings (injected code) •  Library listing using the loader’s data structures •  Extract process ELF executables and libraries •  Network interfaces in promiscuous mode •  Processes that are using raw sockets •  Hidden kernel modules •  Netfilter hooks •  Cached TrueCrypt passphrases 12
© 2014 The Volatility Foundation Volatility 2.4: Highlights •  Windows (14 new plugins/108) •  Windows 8/2012 support •  TrueCrypt plugins (summary, cached pass, master keys) •  Apihooks (64-bit/JMP FAR) •  hashdump, cachedump, and lsadump (x64/Win8/2012) •  callbacks and timers (64-bit) •  mftparser (ADS, extract MFT resident blocks) •  Single pass executive object scanning •  verinfo plugin (PE version info) •  auditpol plugin (audit policies) •  cmdline plugin (process command line arguments) •  pooltracker plugin (kernel pool tag statistics) •  bigpools plugin (big page pool allocations) •  Notepad plugin (application heap) •  svcscan enumerates service start type 13
© 2014 The Volatility Foundation TrueCrypt 14 Hidden Data Host Disk Passphrase unlocks the header C:UsersMikeDocumentslease.pdf RAM Un-encrypted Encrypted Master keys Cached file(s) Decrypted Cached password
© 2014 The Volatility Foundation Notepad’s Heap 15
© 2014 The Volatility Foundation Volatility 2.4: Resources •  Official Volatility Memory Analysis Cheat Sheet •  Windows, Linux, Mac OS X •  RTFM-style insert for Windows •  http://downloads.volatilityfoundation.org/releases/2.4/CheatSheet_v2.4.pdf •  Volatility demo videos •  Defeating Truecrypt Disk Encryption •  Reverse Engineering Rootkits •  Tracking Mac OS X Activity •  https://www.youtube.com/channel/UC3AsZ6DGlqZIaPkxF6tXgAA 16
© 2014 The Volatility Foundation Volatility Roadmap •  Volatility 2.5 (November 2014) •  Bug fixes •  Unified plugin output format •  Volatility 3.0 (2015) •  “Big Changes”: Refactor/Cleanup/API •  Unicode improvement/Python 3.0 •  *Performance* 17
© 2014 The Volatility Foundation compressor( …" compressor_object (global)"" c_segments"" compressed"pages" c_buffer! c_slots! compressor_pager (per"vm_map_entry"object)"" cpgr_slots! virtual(address(of(page( virtual(address( to(slot(mapping( c_size
 c_offset! Compressed RAM/Swap 18
© 2014 The Volatility Foundation Social Media Artifacts 19
© 2014 The Volatility Foundation Dalvik Inspector 20 http://www.504ensics.com/blog/
© 2014 The Volatility Foundation 2nd Volatility Plugin Contest •  (Inspired by the Hex-Rays IDA plugin contest) •  Create an innovative and useful extension to Volatility and win the contest! •  Facebook doubled the prize money! •  Prizes awarded for top 5 submissions: •  1: $2500, 2: $1250, 3: $750, 4-5: Volatility swag •  Core development team judges •  creativity, usefulness, effort, completeness, submission date, and clarity of documentation. •  12 submissions worldwide (>30 new plugins!) •  Trend: Application analysis/context 21
© 2014 The Volatility Foundation 1st Place: Dave Lasalle •  Dave submitted 14 plugins (“Forensic Suite”) •  Recovering Firefox and Chrome artifacts •  Firefox (3 plugins) •  History, cookies, downloads •  Chrome (6 plugins) •  History, cookies, downloads, visits, search terms •  Java IDX files: Download history of Java archives •  Office TrustRecords : Office files from untrusted src •  Fuzzy hashing to whitelist injected code/API hooks •  ssdeepscan, malfinddeep, apihooksdeep 22
© 2014 The Volatility Foundation Chrome History $ python vol.py –f voltest.dmp chromehistory --output=csv > output.csv
© 2014 The Volatility Foundation IDX Parser $ python vol.py –f voltest.dmp idxparser [*] Section 2 (Download History) found: URL: http://javagameplay.com/offroadrally/inthejar.jar IP: 209.188.88.156 <null>: HTTP/1.1 200 OK content-length: 61699 last-modified: Fri, 10 Oct 2008 20:25:10 GMT content-type: text/plain date: Sat, 30 Aug 2014 19:53:56 GMT server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 deploy-request-content-type: application/x-java-archive
© 2014 The Volatility Foundation apihooksdeep •  Create the whitelist: $ vol.py -f D5XLBY3J-bf977e52_lookIE_pid_860.vmss -- profile=WinXPSP2x86 vaddump -p 860 -b 0x71590000 -D dumps [snip] 860 iexplore.exe 0x71590000 0x71608fff dumps/iexplore.exe. 24296b8.0x71590000-0x71608fff.dmp $ python hash_by_page.py -n AcLayers.DLL -f dumps/iexplore.exe. 24296b8.0x71590000-0x71608fff.dmp ('AcLayers.DLL', '6:idqLvVg3F+X32xbQ7esfGkxNPWgwh9lorlcIfMfEtj/ lkwSM0E/mh6l+tgdwL:eqGSGfP0FWgO9arlcIrUpEec1w'), ('AcLayers.DLL', '96:1SxccXfBWrvZnxbZ3IX26dZC6FsEzSVr6y616GpIHoib8u:uvBWrpxbxGpW Ecr3UTpIHPb8u'), [snip]
© 2014 The Volatility Foundation apihooksdeep •  Now those hooks are not shown: $ vol.py -f D5XLBY3J-bf977e52_lookIE_pid_860.vmss -- profile=WinXPSP2x86 apihooksdeep -p 860 Process: 860 (iexplore.exe) Hook at 0x715b9e59 in page 0x715b9000 is 100% similar to whitelist hook AcLayers.DLL Process: 860 (iexplore.exe) Hook at 0x715ba067 in page 0x715ba000 is 100% similar to whitelist hook AcLayers.DLL
© 2014 The Volatility Foundation 2nd Place: dm_dump •  Submitted by Curtis Carmony •  dm-crypt is used on Linux and Android for FDE •  Keying material in physical memory (RAM) •  dm_dump plugin recovers dm-crypt keys from memory and prints commands that can be copy/ pasted to mount the volumes •  Will be incorporated into core Volatility soon
© 2014 The Volatility Foundation dm_dump $ python vol.py linux_dm_dump --profile=Linux3_11_0-15- generic-i686x86 --dm_profile=3.11.0-15-generic-i686- dm.dwarf –f 3.11.0-15-generic-i686.elf Volatility Foundation Volatility Framework 2.4 sda5_crypt: 0 16269312 crypt aes-xts-plain64 c2ca0a6a52980952016936047ab46fba961397978fbf3219ca39fcfdce3b46e2b6348daa09d093351113288c8258bc6 bd3c3d57afab2d6bc3cac7cfde436939b 0 /dev/sda5 4096 ubuntu--vg-swap_1: 0 1040384 linear /dev/dm-0 15163776 ubuntu--vg-root: 0 15163392 linear /dev/dm-0 384 $ dmsetup create volatility --table “0 16269312 crypt aes- xts-plain64 c2ca0a6a52980952016936047ab46fba961397978fbf3219 ca39fcfdce3b46e2b6348daa09d093351113288c8258bc6 bd3c3d57afab2d6bc3cac7cfde436939b 0 /dev/sda5 4096”
© 2014 The Volatility Foundation 3rd Place: editbox •  Written by Adam Bridge “Bridgey The Geek” •  This plugin extracts text from the edit, combo, and list boxes of GUI applications that run on Windows •  Includes, but is not limited to: •  Notepad window •  Run dialog •  Username and server name fields of Remote Desktop Connection •  Address bar and search bar of Internet Explorer •  Search bar of Windows Media Player •  Username field of Create New Account wizard •  Password of Change Password dialog
© 2014 The Volatility Foundation editbox
© 2014 The Volatility Foundation editbox $ python vol.py --profile=Win7SP1x64 -f WIN7SP1X64-20140929-225403.raw editbox Volatility Foundation Volatility Framework 2.4 ******************************************************* Wnd context : 1WinSta0Default pid : 2244 imageFileName : mstsc.exe wow64 : No atom_class : 6.0.7601.17514!Edit [snip] isPwdControl : No deepthought.h2g2.com ******************************************************* Wnd context : 1WinSta0Default pid : 1748 imageFileName : explorer.exe wow64 : No atom_class : 6.0.7601.17514!Edit [snip] isPwdControl : Yes pwdChar : 0x25cf monkey
© 2014 The Volatility Foundation screenshot + editbox
© 2014 The Volatility Foundation screenshot + editbox
© 2014 The Volatility Foundation Volatility 2014 Plugin Contest •  4th Place: •  Thomas Chopitea: Autoruns – Finding persistence •  5th Place: •  Takahiro Haruyama: OpenIOC Scan •  Submissions: •  Monnappa KA: Gh0stRat Decryption •  Jamaal Speights: MsDecompress •  Cem Gurkok: Mac Rootkit and Bitcoin •  Csaba Barta: Malware Analysis (Baselines) •  Philip Huppert: OpenVPN •  Wyatt Roersma: Hyper-V Tools 34
© 2014 The Volatility Foundation OMFW 2014 •  OMFW first held 2008 •  Highly technical venue for digital investigators •  100% of the proceeds are donated to charity •  What makes OMFW unique: •  Workshop size •  Technical content •  Researchers and developers •  Peer relationships •  Cost •  Lightning talks •  8 Memory forensics presentations 35
© 2014 The Volatility Foundation OMFW Agenda 2014 1300PM The State of Volatility 1330PM Careto: Accomplishing in 7 Minutes What AV Couldn’t Do in 7 yrs 1400PM Restructuring Memory: Extracting Results in a Reusable Way 1430PM Science, Sharing, and Repeatability in Memory Forensics 1500PM Break 1530PM Many Ways to Skin a RAT: Let’s Start with the Tail 1600PM Memory Forensics for IR: Leveraging Volatility to Hunt Adv Actors 1630PM Memory Tracing: Forensic Reverse Engineering 1700PM DAMM: A Tool for Differential Analysis of Malware in Memory 1730PM Closing Comments/Reception 36
© 2014 The Volatility Foundation Volatility Unified Output
© 2014 The Volatility Foundation Careto: Memory vs. AV http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf
© 2014 The Volatility Foundation Memory Tracing
© 2014 The Volatility Foundation Volatility Training/Certification •  Learn from the actual researchers and developers •  Show your support for open source developers •  Courses •  Windows Memory Forensics & Malware Analysis •  Memory Forensics Essentials •  Mac Memory Forensics & Malware Analysis •  Linux Memory Forensics & Malware Analysis •  Certifications •  Memory Forensics Examiner •  Memory Forensics Professional (Win/Mac/Lin) •  Information: www.memoryanalysis.net 40
© 2014 The Volatility Foundation41 Download Volatility 2.4 https://github.com/volatilityfoundation/volatility http://volatility-labs.blogspot.com/ @volatility Join the community!

Recomendados

Memory forensics
Memory forensicsMemory forensics
Memory forensicsSunil Kumar
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory ForensicsAnshul Tayal
 
Linux forensics
Linux forensicsLinux forensics
Linux forensicsSantosh Khadsare
 
Forensics of a Windows System
Forensics of a Windows SystemForensics of a Windows System
Forensics of a Windows SystemConferencias FIST
 
Operating System Forensics
Operating System ForensicsOperating System Forensics
Operating System ForensicsArunJS5
 
Introduction to computer forensic
Introduction to computer forensicIntroduction to computer forensic
Introduction to computer forensicOnline
 
LTEC 2013 - EnCase v7.08.01 presentation
LTEC 2013 - EnCase v7.08.01 presentation LTEC 2013 - EnCase v7.08.01 presentation
LTEC 2013 - EnCase v7.08.01 presentation Damir Delija
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensicssdavis532
 

Recomendados

Memory forensics
Memory forensicsMemory forensics
Memory forensicsSunil Kumar
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory ForensicsAnshul Tayal
 
Linux forensics
Linux forensicsLinux forensics
Linux forensicsSantosh Khadsare
 
Forensics of a Windows System
Forensics of a Windows SystemForensics of a Windows System
Forensics of a Windows SystemConferencias FIST
 
Operating System Forensics
Operating System ForensicsOperating System Forensics
Operating System ForensicsArunJS5
 
Introduction to computer forensic
Introduction to computer forensicIntroduction to computer forensic
Introduction to computer forensicOnline
 
LTEC 2013 - EnCase v7.08.01 presentation
LTEC 2013 - EnCase v7.08.01 presentation LTEC 2013 - EnCase v7.08.01 presentation
LTEC 2013 - EnCase v7.08.01 presentation Damir Delija
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensicssdavis532
 
04 Evidence Collection and Data Seizure - Notes
04 Evidence Collection and Data Seizure - Notes04 Evidence Collection and Data Seizure - Notes
04 Evidence Collection and Data Seizure - NotesKranthi
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory Forensicsn|u - The Open Security Community
 
Malware forensic
Malware forensicMalware forensic
Malware forensicSumeraHangi
 
Computer forensics toolkit
Computer forensics toolkitComputer forensics toolkit
Computer forensics toolkitMilap Oza
 
Accessing Forensic Images
Accessing Forensic ImagesAccessing Forensic Images
Accessing Forensic ImagesCTIN
 
Computer forensics
Computer forensicsComputer forensics
Computer forensicsdeaneal
 
Forensic imaging tools
Forensic imaging tools Forensic imaging tools
Forensic imaging tools Dr. Richard Adams
 
Mobile Forensics
Mobile ForensicsMobile Forensics
Mobile Forensicsprimeteacher32
 
Malware forensics
Malware forensicsMalware forensics
Malware forensicsSameera Amjad
 
Network Forensics
Network ForensicsNetwork Forensics
Network Forensicsprimeteacher32
 
Digital forensic principles and procedure
Digital forensic principles and procedureDigital forensic principles and procedure
Digital forensic principles and procedurenewbie2019
 
Electornic evidence collection
Electornic evidence collectionElectornic evidence collection
Electornic evidence collectionFakrul Alam
 
Current Forensic Tools
Current Forensic Tools Current Forensic Tools
Current Forensic Tools Jyothishmathi Institute of Technology and Science Karimnagar
 
Database forensics
Database forensicsDatabase forensics
Database forensicsDenys A. Flores, PhD
 
Introduction to filesystems and computer forensics
Introduction to filesystems and computer forensicsIntroduction to filesystems and computer forensics
Introduction to filesystems and computer forensicsMayank Chaudhari
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics toolSreekanth Narendran
 
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsMemory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsJared Greenhill
 
Windows Forensic 101
Windows Forensic 101Windows Forensic 101
Windows Forensic 101Digit Oktavianto
 
Anti forensic
Anti forensicAnti forensic
Anti forensicMilap Oza
 
Anti-Forensics: Real world identification, analysis and prevention
Anti-Forensics: Real world identification, analysis and preventionAnti-Forensics: Real world identification, analysis and prevention
Anti-Forensics: Real world identification, analysis and preventionSeccuris Inc.
 
openioc_scan - IOC scanner for memory forensics
openioc_scan - IOC scanner for memory forensicsopenioc_scan - IOC scanner for memory forensics
openioc_scan - IOC scanner for memory forensicsTakahiro Haruyama
 
Malware analysis using volatility
Malware analysis using volatilityMalware analysis using volatility
Malware analysis using volatilityYashashree Gund
 

Más contenido relacionado

La actualidad más candente

04 Evidence Collection and Data Seizure - Notes
04 Evidence Collection and Data Seizure - Notes04 Evidence Collection and Data Seizure - Notes
04 Evidence Collection and Data Seizure - NotesKranthi
 
Malware forensic
Malware forensicMalware forensic
Malware forensicSumeraHangi
 
Computer forensics toolkit
Computer forensics toolkitComputer forensics toolkit
Computer forensics toolkitMilap Oza
 
Accessing Forensic Images
Accessing Forensic ImagesAccessing Forensic Images
Accessing Forensic ImagesCTIN
 
Computer forensics
Computer forensicsComputer forensics
Computer forensicsdeaneal
 
Digital forensic principles and procedure
Digital forensic principles and procedureDigital forensic principles and procedure
Digital forensic principles and procedurenewbie2019
 
Electornic evidence collection
Electornic evidence collectionElectornic evidence collection
Electornic evidence collectionFakrul Alam
 
Introduction to filesystems and computer forensics
Introduction to filesystems and computer forensicsIntroduction to filesystems and computer forensics
Introduction to filesystems and computer forensicsMayank Chaudhari
 
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsMemory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsJared Greenhill
 
Anti forensic
Anti forensicAnti forensic
Anti forensicMilap Oza
 
Anti-Forensics: Real world identification, analysis and prevention
Anti-Forensics: Real world identification, analysis and preventionAnti-Forensics: Real world identification, analysis and prevention
Anti-Forensics: Real world identification, analysis and preventionSeccuris Inc.
 

La actualidad más candente (20)

04 Evidence Collection and Data Seizure - Notes
04 Evidence Collection and Data Seizure - Notes04 Evidence Collection and Data Seizure - Notes
04 Evidence Collection and Data Seizure - Notes
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory Forensics
 
Malware forensic
Malware forensicMalware forensic
Malware forensic
 
Computer forensics toolkit
Computer forensics toolkitComputer forensics toolkit
Computer forensics toolkit
 
Accessing Forensic Images
Accessing Forensic ImagesAccessing Forensic Images
Accessing Forensic Images
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
 
Forensic imaging tools
Forensic imaging tools Forensic imaging tools
Forensic imaging tools
 
Mobile Forensics
Mobile ForensicsMobile Forensics
Mobile Forensics
 
Malware forensics
Malware forensicsMalware forensics
Malware forensics
 
Network Forensics
Network ForensicsNetwork Forensics
Network Forensics
 
Digital forensic principles and procedure
Digital forensic principles and procedureDigital forensic principles and procedure
Digital forensic principles and procedure
 
Electornic evidence collection
Electornic evidence collectionElectornic evidence collection
Electornic evidence collection
 
Current Forensic Tools
Current Forensic Tools Current Forensic Tools
Current Forensic Tools
 
Database forensics
Database forensicsDatabase forensics
Database forensics
 
Introduction to filesystems and computer forensics
Introduction to filesystems and computer forensicsIntroduction to filesystems and computer forensics
Introduction to filesystems and computer forensics
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
 
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsMemory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
 
Windows Forensic 101
Windows Forensic 101Windows Forensic 101
Windows Forensic 101
 
Anti forensic
Anti forensicAnti forensic
Anti forensic
 
Anti-Forensics: Real world identification, analysis and prevention
Anti-Forensics: Real world identification, analysis and preventionAnti-Forensics: Real world identification, analysis and prevention
Anti-Forensics: Real world identification, analysis and prevention
 

Destacado

openioc_scan - IOC scanner for memory forensics
openioc_scan - IOC scanner for memory forensicsopenioc_scan - IOC scanner for memory forensics
openioc_scan - IOC scanner for memory forensicsTakahiro Haruyama
 
Malware analysis using volatility
Malware analysis using volatilityMalware analysis using volatility
Malware analysis using volatilityYashashree Gund
 
SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)
SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)
SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)Security Bootcamp
 
Windows Memory Forensic Analysis using EnCase
Windows Memory Forensic Analysis using EnCaseWindows Memory Forensic Analysis using EnCase
Windows Memory Forensic Analysis using EnCaseTakahiro Haruyama
 
De-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory AnalysisDe-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory AnalysisAndrew Case
 
Investigating Cooridinated Data Exfiltration
Investigating Cooridinated Data ExfiltrationInvestigating Cooridinated Data Exfiltration
Investigating Cooridinated Data ExfiltrationAndrew Case
 
Linux Memory Analysis with Volatility
Linux Memory Analysis with VolatilityLinux Memory Analysis with Volatility
Linux Memory Analysis with VolatilityAndrew Case
 
One-Byte Modification for Breaking Memory Forensic Analysis
One-Byte Modification for Breaking Memory Forensic AnalysisOne-Byte Modification for Breaking Memory Forensic Analysis
One-Byte Modification for Breaking Memory Forensic AnalysisTakahiro Haruyama
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory ForensicsAdvanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory Forensicssecurityxploded
 
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis TechniquesAdvanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniquessecurityxploded
 
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 securityxploded
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of MalwaresAdvanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwaressecurityxploded
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2securityxploded
 
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)HITCON GIRLS
 
HITCON CTF 2016導覽
HITCON CTF 2016導覽HITCON CTF 2016導覽
HITCON CTF 2016導覽HITCON GIRLS
 
HITCON GIRLS 成大講座 惡意程式分析（Turkey）
HITCON GIRLS 成大講座 惡意程式分析（Turkey）HITCON GIRLS 成大講座 惡意程式分析（Turkey）
HITCON GIRLS 成大講座 惡意程式分析（Turkey）HITCON GIRLS
 

Destacado (20)

openioc_scan - IOC scanner for memory forensics
openioc_scan - IOC scanner for memory forensicsopenioc_scan - IOC scanner for memory forensics
openioc_scan - IOC scanner for memory forensics
 
Malware analysis using volatility
Malware analysis using volatilityMalware analysis using volatility
Malware analysis using volatility
 
SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)
SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)
SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory Forensics
 
Windows Memory Forensic Analysis using EnCase
Windows Memory Forensic Analysis using EnCaseWindows Memory Forensic Analysis using EnCase
Windows Memory Forensic Analysis using EnCase
 
De-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory AnalysisDe-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory Analysis
 
Investigating Cooridinated Data Exfiltration
Investigating Cooridinated Data ExfiltrationInvestigating Cooridinated Data Exfiltration
Investigating Cooridinated Data Exfiltration
 
Linux Memory Analysis with Volatility
Linux Memory Analysis with VolatilityLinux Memory Analysis with Volatility
Linux Memory Analysis with Volatility
 
One-Byte Modification for Breaking Memory Forensic Analysis
One-Byte Modification for Breaking Memory Forensic AnalysisOne-Byte Modification for Breaking Memory Forensic Analysis
One-Byte Modification for Breaking Memory Forensic Analysis
 
Windows forensic
Windows forensicWindows forensic
Windows forensic
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory ForensicsAdvanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
 
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis TechniquesAdvanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
 
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1 Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of MalwaresAdvanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
 
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)
 
HITCON CTF 2016導覽
HITCON CTF 2016導覽HITCON CTF 2016導覽
HITCON CTF 2016導覽
 
HITCON GIRLS Malware Analysis
HITCON GIRLS Malware AnalysisHITCON GIRLS Malware Analysis
HITCON GIRLS Malware Analysis
 
CTF 經驗分享
CTF 經驗分享CTF 經驗分享
CTF 經驗分享
 
HITCON GIRLS 成大講座 惡意程式分析（Turkey）
HITCON GIRLS 成大講座 惡意程式分析（Turkey）HITCON GIRLS 成大講座 惡意程式分析（Turkey）
HITCON GIRLS 成大講座 惡意程式分析（Turkey）
 

Similar a Next Generation Memory Forensics

OpenTelemetry 101 FTW
OpenTelemetry 101 FTWOpenTelemetry 101 FTW
OpenTelemetry 101 FTWNGINX, Inc.
 
DevOps Unleashed: Strategies that Speed Deployments
DevOps Unleashed: Strategies that Speed DeploymentsDevOps Unleashed: Strategies that Speed Deployments
DevOps Unleashed: Strategies that Speed DeploymentsForgeRock
 
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...The Linux Foundation
 
Html5 Application Security
Html5 Application SecurityHtml5 Application Security
Html5 Application Securitychuckbt
 
FIWARE Wednesday Webinars - How to Debug IoT Agents
FIWARE Wednesday Webinars - How to Debug IoT AgentsFIWARE Wednesday Webinars - How to Debug IoT Agents
FIWARE Wednesday Webinars - How to Debug IoT AgentsFIWARE
 
Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1tactqa
 
Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1tactqa
 
BSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysBSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysJoff Thyer
 
Metasploitation part-1 (murtuja)
Metasploitation part-1 (murtuja)Metasploitation part-1 (murtuja)
Metasploitation part-1 (murtuja)ClubHack
 
Zephyr Introduction - Nordic Webinar - Sept. 24.pdf
Zephyr Introduction - Nordic Webinar - Sept. 24.pdfZephyr Introduction - Nordic Webinar - Sept. 24.pdf
Zephyr Introduction - Nordic Webinar - Sept. 24.pdfAswathRangaraj1
 
Make the Shift from Manual to Automation with Open Source
Make the Shift from Manual to Automation with Open SourceMake the Shift from Manual to Automation with Open Source
Make the Shift from Manual to Automation with Open SourcePerfecto by Perforce
 
"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014
"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014
"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014Piyush Kumar
 
100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdfMAHESHUMANATHGOPALAK
 
SOC-BlueTEam.pdf
SOC-BlueTEam.pdfSOC-BlueTEam.pdf
SOC-BlueTEam.pdfBeratAkit
 
100 Security Operation Center Tools EMERSON EDUARDO RODRIGUES
100 Security Operation Center Tools EMERSON EDUARDO RODRIGUES100 Security Operation Center Tools EMERSON EDUARDO RODRIGUES
100 Security Operation Center Tools EMERSON EDUARDO RODRIGUESEMERSON EDUARDO RODRIGUES
 

Similar a Next Generation Memory Forensics (20)

OpenTelemetry 101 FTW
OpenTelemetry 101 FTWOpenTelemetry 101 FTW
OpenTelemetry 101 FTW
 
StarlingX - A Platform for the Distributed Edge | Ildiko Vancsa
StarlingX - A Platform for the Distributed Edge | Ildiko VancsaStarlingX - A Platform for the Distributed Edge | Ildiko Vancsa
StarlingX - A Platform for the Distributed Edge | Ildiko Vancsa
 
DevOps Unleashed: Strategies that Speed Deployments
DevOps Unleashed: Strategies that Speed DeploymentsDevOps Unleashed: Strategies that Speed Deployments
DevOps Unleashed: Strategies that Speed Deployments
 
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
 
Html5 Application Security
Html5 Application SecurityHtml5 Application Security
Html5 Application Security
 
FIWARE Wednesday Webinars - How to Debug IoT Agents
FIWARE Wednesday Webinars - How to Debug IoT AgentsFIWARE Wednesday Webinars - How to Debug IoT Agents
FIWARE Wednesday Webinars - How to Debug IoT Agents
 
Phonegap 2.x
Phonegap 2.xPhonegap 2.x
Phonegap 2.x
 
Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1
 
Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1Microsoft power point automation-opensourcetestingtools_matrix-1
Microsoft power point automation-opensourcetestingtools_matrix-1
 
BSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysBSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad Guys
 
How to debug IoT Agents
How to debug IoT AgentsHow to debug IoT Agents
How to debug IoT Agents
 
Metasploitation part-1 (murtuja)
Metasploitation part-1 (murtuja)Metasploitation part-1 (murtuja)
Metasploitation part-1 (murtuja)
 
Zephyr Introduction - Nordic Webinar - Sept. 24.pdf
Zephyr Introduction - Nordic Webinar - Sept. 24.pdfZephyr Introduction - Nordic Webinar - Sept. 24.pdf
Zephyr Introduction - Nordic Webinar - Sept. 24.pdf
 
Make the Shift from Manual to Automation with Open Source
Make the Shift from Manual to Automation with Open SourceMake the Shift from Manual to Automation with Open Source
Make the Shift from Manual to Automation with Open Source
 
Powering up on power shell avengercon - 2018
Powering up on power shell avengercon - 2018Powering up on power shell avengercon - 2018
Powering up on power shell avengercon - 2018
 
"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014
"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014
"In love with Open Source : Past, Present and Future" : Keynote OSDConf 2014
 
100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf
 
SOC-BlueTEam.pdf
SOC-BlueTEam.pdfSOC-BlueTEam.pdf
SOC-BlueTEam.pdf
 
100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf100 Security Operation Center Tools.pdf
100 Security Operation Center Tools.pdf
 
100 Security Operation Center Tools EMERSON EDUARDO RODRIGUES
100 Security Operation Center Tools EMERSON EDUARDO RODRIGUES100 Security Operation Center Tools EMERSON EDUARDO RODRIGUES
100 Security Operation Center Tools EMERSON EDUARDO RODRIGUES
 

Más de Andrew Case

Proactive Measures to Defeat Insider Threat
Proactive Measures to Defeat Insider ThreatProactive Measures to Defeat Insider Threat
Proactive Measures to Defeat Insider ThreatAndrew Case
 
Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Andrew Case
 
OMFW 2012: Analyzing Linux Kernel Rootkits with Volatlity
OMFW 2012: Analyzing Linux Kernel Rootkits with VolatlityOMFW 2012: Analyzing Linux Kernel Rootkits with Volatlity
OMFW 2012: Analyzing Linux Kernel Rootkits with VolatlityAndrew Case
 
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...Andrew Case
 
Hunting Mac Malware with Memory Forensics
Hunting Mac Malware with Memory ForensicsHunting Mac Malware with Memory Forensics
Hunting Mac Malware with Memory ForensicsAndrew Case
 
My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)Andrew Case
 
Mac Memory Analysis with Volatility
Mac Memory Analysis with VolatilityMac Memory Analysis with Volatility
Mac Memory Analysis with VolatilityAndrew Case
 
Workshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with VolatilityWorkshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with VolatilityAndrew Case
 
Memory Analysis of the Dalvik (Android) Virtual Machine
Memory Analysis of the Dalvik (Android) Virtual MachineMemory Analysis of the Dalvik (Android) Virtual Machine
Memory Analysis of the Dalvik (Android) Virtual MachineAndrew Case
 

Más de Andrew Case (9)

Proactive Measures to Defeat Insider Threat
Proactive Measures to Defeat Insider ThreatProactive Measures to Defeat Insider Threat
Proactive Measures to Defeat Insider Threat
 
Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)
 
OMFW 2012: Analyzing Linux Kernel Rootkits with Volatlity
OMFW 2012: Analyzing Linux Kernel Rootkits with VolatlityOMFW 2012: Analyzing Linux Kernel Rootkits with Volatlity
OMFW 2012: Analyzing Linux Kernel Rootkits with Volatlity
 
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced ...
 
Hunting Mac Malware with Memory Forensics
Hunting Mac Malware with Memory ForensicsHunting Mac Malware with Memory Forensics
Hunting Mac Malware with Memory Forensics
 
My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)
 
Mac Memory Analysis with Volatility
Mac Memory Analysis with VolatilityMac Memory Analysis with Volatility
Mac Memory Analysis with Volatility
 
Workshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with VolatilityWorkshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with Volatility
 
Memory Analysis of the Dalvik (Android) Virtual Machine
Memory Analysis of the Dalvik (Android) Virtual MachineMemory Analysis of the Dalvik (Android) Virtual Machine
Memory Analysis of the Dalvik (Android) Virtual Machine
 

Último

Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxhariprasad279825
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clashcharlottematthew16
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr LapshynFwdays
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyAlfredo García Lavilla
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
The Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdfThe Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdfSeasiaInfotech2
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embeddingZilliz
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piececharlottematthew16
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLScyllaDB
 
Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfRankYa
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Manik S Magar
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays
 

Último (20)

Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptx
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clash
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easy
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
The Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdfThe Future of Software Development - Devin AI Innovative Approach.pdf
The Future of Software Development - Devin AI Innovative Approach.pdf
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embedding
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piece
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQL
 
Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdf
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko
 

Next Generation Memory Forensics

  • 1. EMPOWERING INVESTIGATORS THE VOLATILITY FOUNDATION Next Generation Memory Forensics Volatility Developers November 5, 2014
  • 2. © 2014 The Volatility Foundation Volatility Development Team •  Core Developers: •  Mike Auty (ikelos) •  Andrew Case (attc) •  Brendan Dolan-Gavitt (moyix) •  Michael Hale Ligh (MHL) •  Jamie Levy (gleeda) •  AAron Walters (labarum) •  The Volatility Community (OOV) •  Numerous research collaborators/testing/bugs •  Academia, government, industry •  Mailing lists, blogs, irc (#volatility) •  Moved: https://github.com/volatilityfoundation/volatility •  @volatility 2 Thank You!
  • 3. © 2014 The Volatility Foundation Volatility Foundation •  Volatility development is supported by an independent foundation •  US 501(c)(3) Nonprofit •  The Volatility Foundation was established: •  to support the development of Volatility •  to promote the use of Volatility and memory analysis in the forensics community •  to protect the intellectual property and the framework's long-term viability •  to advance the state of the art in memory analysis research. •  But….development driven by Volatility community 3
  • 4. © 2014 The Volatility Foundation Opaque Systems/Enterprise •  Opaque components of information infrastructure •  Can your systems be trusted? (patches, malware)
  • 5. © 2014 The Volatility Foundation5 Adversaries Challenges •  Adversaries Challenges •  They want to remain undetected (stealthy) •  They want to execute a mission •  They rely on components of the operating system •  Consume system resources •  Memory (stack, heap, pool) •  Objects (thread, process, mutex, driver) •  Modify control flow (execution) of the system •  Hide the allocated resources •  Perform mission
  • 6. © 2014 The Volatility Foundation What is Memory Forensics? •  Memory forensics is the process of acquiring and analyzing physical memory (RAM) in order to find artifacts and evidence •  Analysis does not depend on OS (trust) •  Unconstrained analysis (entire state of OS/historical) •  Removes the active adversary •  Usually performed in conjunction with disk and network forensics (memory only artifacts) •  Rapid triage/analysis leads (sandbox)
  • 7. © 2014 The Volatility Foundation Next Generation Analysis 7 Physical Memory Analysis Operating System Analysis Application Analysis Physical Address Space Kernel Address Spaces Application Address Spaces User Address Spaces Swap Context Virtual Memory Analysis (Hardware) Virtual Address Spaces
  • 8. © 2014 The Volatility Foundation8 Volatility Framework •  Volatile memory artifact extraction utility framework •  Completely open source (GPLv2/Python) •  Cross platform (Python) •  Single, cohesive analysis framework •  Windows, Mac, Linux, Android, … •  Command-line tools/scriptable •  Modular architecture •  Unparalleled features! •  Active Community •  Industry, academics, government, law enforcement
  • 9. © 2014 The Volatility Foundation9 Volatility 2.4: AMF
  • 10. © 2014 The Volatility Foundation Volatility 2.4: Highlights •  Released: August 2014 at Black Hat Arsenal •  Address Spaces (3 new AS/17) •  QEMU virtual machine memory samples •  “split” VMware files (vmem, vmss, vmsn) •  Windows BitMap crash dumps (Windows 8/2012) •  Mac OSX (30 new plugins/62) •  Mavericks through 10.9.4 •  Mac string translation •  Adium message (OTR)/Contact records/Notes artifacts •  Apple Keychain encryption keys/clear-text PGP emails •  API hooks in kernel and process memory •  IP and socket filters •  Suspicious process mappings (injected code) •  Hidden kernel extensions (extraction) •  Recovered files cached in memory 10
  • 11. © 2014 The Volatility Foundation Application Artifacts 11
  • 12. © 2014 The Volatility Foundation Volatility 2.4: Highlights •  Linux/Android (24 new plugins/66) •  Linux kernels through 3.16 •  Linux string translation •  API hooks (kernel/userland) •  GOT/PLT overwrites •  Hollowed executables •  Suspicious process mappings (injected code) •  Library listing using the loader’s data structures •  Extract process ELF executables and libraries •  Network interfaces in promiscuous mode •  Processes that are using raw sockets •  Hidden kernel modules •  Netfilter hooks •  Cached TrueCrypt passphrases 12
  • 13. © 2014 The Volatility Foundation Volatility 2.4: Highlights •  Windows (14 new plugins/108) •  Windows 8/2012 support •  TrueCrypt plugins (summary, cached pass, master keys) •  Apihooks (64-bit/JMP FAR) •  hashdump, cachedump, and lsadump (x64/Win8/2012) •  callbacks and timers (64-bit) •  mftparser (ADS, extract MFT resident blocks) •  Single pass executive object scanning •  verinfo plugin (PE version info) •  auditpol plugin (audit policies) •  cmdline plugin (process command line arguments) •  pooltracker plugin (kernel pool tag statistics) •  bigpools plugin (big page pool allocations) •  Notepad plugin (application heap) •  svcscan enumerates service start type 13
  • 14. © 2014 The Volatility Foundation TrueCrypt 14 Hidden Data Host Disk Passphrase unlocks the header C:UsersMikeDocumentslease.pdf RAM Un-encrypted Encrypted Master keys Cached file(s) Decrypted Cached password
  • 15. © 2014 The Volatility Foundation Notepad’s Heap 15
  • 16. © 2014 The Volatility Foundation Volatility 2.4: Resources •  Official Volatility Memory Analysis Cheat Sheet •  Windows, Linux, Mac OS X •  RTFM-style insert for Windows •  http://downloads.volatilityfoundation.org/releases/2.4/CheatSheet_v2.4.pdf •  Volatility demo videos •  Defeating Truecrypt Disk Encryption •  Reverse Engineering Rootkits •  Tracking Mac OS X Activity •  https://www.youtube.com/channel/UC3AsZ6DGlqZIaPkxF6tXgAA 16
  • 17. © 2014 The Volatility Foundation Volatility Roadmap •  Volatility 2.5 (November 2014) •  Bug fixes •  Unified plugin output format •  Volatility 3.0 (2015) •  “Big Changes”: Refactor/Cleanup/API •  Unicode improvement/Python 3.0 •  *Performance* 17
  • 18. © 2014 The Volatility Foundation compressor( …" compressor_object (global)"" c_segments"" compressed"pages" c_buffer! c_slots! compressor_pager (per"vm_map_entry"object)"" cpgr_slots! virtual(address(of(page( virtual(address( to(slot(mapping( c_size
 c_offset! Compressed RAM/Swap 18
  • 19. © 2014 The Volatility Foundation Social Media Artifacts 19
  • 20. © 2014 The Volatility Foundation Dalvik Inspector 20 http://www.504ensics.com/blog/
  • 21. © 2014 The Volatility Foundation 2nd Volatility Plugin Contest •  (Inspired by the Hex-Rays IDA plugin contest) •  Create an innovative and useful extension to Volatility and win the contest! •  Facebook doubled the prize money! •  Prizes awarded for top 5 submissions: •  1: $2500, 2: $1250, 3: $750, 4-5: Volatility swag •  Core development team judges •  creativity, usefulness, effort, completeness, submission date, and clarity of documentation. •  12 submissions worldwide (>30 new plugins!) •  Trend: Application analysis/context 21
  • 22. © 2014 The Volatility Foundation 1st Place: Dave Lasalle •  Dave submitted 14 plugins (“Forensic Suite”) •  Recovering Firefox and Chrome artifacts •  Firefox (3 plugins) •  History, cookies, downloads •  Chrome (6 plugins) •  History, cookies, downloads, visits, search terms •  Java IDX files: Download history of Java archives •  Office TrustRecords : Office files from untrusted src •  Fuzzy hashing to whitelist injected code/API hooks •  ssdeepscan, malfinddeep, apihooksdeep 22
  • 23. © 2014 The Volatility Foundation Chrome History $ python vol.py –f voltest.dmp chromehistory --output=csv > output.csv
  • 24. © 2014 The Volatility Foundation IDX Parser $ python vol.py –f voltest.dmp idxparser [*] Section 2 (Download History) found: URL: http://javagameplay.com/offroadrally/inthejar.jar IP: 209.188.88.156 <null>: HTTP/1.1 200 OK content-length: 61699 last-modified: Fri, 10 Oct 2008 20:25:10 GMT content-type: text/plain date: Sat, 30 Aug 2014 19:53:56 GMT server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 deploy-request-content-type: application/x-java-archive
  • 25. © 2014 The Volatility Foundation apihooksdeep •  Create the whitelist: $ vol.py -f D5XLBY3J-bf977e52_lookIE_pid_860.vmss -- profile=WinXPSP2x86 vaddump -p 860 -b 0x71590000 -D dumps [snip] 860 iexplore.exe 0x71590000 0x71608fff dumps/iexplore.exe. 24296b8.0x71590000-0x71608fff.dmp $ python hash_by_page.py -n AcLayers.DLL -f dumps/iexplore.exe. 24296b8.0x71590000-0x71608fff.dmp ('AcLayers.DLL', '6:idqLvVg3F+X32xbQ7esfGkxNPWgwh9lorlcIfMfEtj/ lkwSM0E/mh6l+tgdwL:eqGSGfP0FWgO9arlcIrUpEec1w'), ('AcLayers.DLL', '96:1SxccXfBWrvZnxbZ3IX26dZC6FsEzSVr6y616GpIHoib8u:uvBWrpxbxGpW Ecr3UTpIHPb8u'), [snip]
  • 26. © 2014 The Volatility Foundation apihooksdeep •  Now those hooks are not shown: $ vol.py -f D5XLBY3J-bf977e52_lookIE_pid_860.vmss -- profile=WinXPSP2x86 apihooksdeep -p 860 Process: 860 (iexplore.exe) Hook at 0x715b9e59 in page 0x715b9000 is 100% similar to whitelist hook AcLayers.DLL Process: 860 (iexplore.exe) Hook at 0x715ba067 in page 0x715ba000 is 100% similar to whitelist hook AcLayers.DLL
  • 27. © 2014 The Volatility Foundation 2nd Place: dm_dump •  Submitted by Curtis Carmony •  dm-crypt is used on Linux and Android for FDE •  Keying material in physical memory (RAM) •  dm_dump plugin recovers dm-crypt keys from memory and prints commands that can be copy/ pasted to mount the volumes •  Will be incorporated into core Volatility soon
  • 28. © 2014 The Volatility Foundation dm_dump $ python vol.py linux_dm_dump --profile=Linux3_11_0-15- generic-i686x86 --dm_profile=3.11.0-15-generic-i686- dm.dwarf –f 3.11.0-15-generic-i686.elf Volatility Foundation Volatility Framework 2.4 sda5_crypt: 0 16269312 crypt aes-xts-plain64 c2ca0a6a52980952016936047ab46fba961397978fbf3219ca39fcfdce3b46e2b6348daa09d093351113288c8258bc6 bd3c3d57afab2d6bc3cac7cfde436939b 0 /dev/sda5 4096 ubuntu--vg-swap_1: 0 1040384 linear /dev/dm-0 15163776 ubuntu--vg-root: 0 15163392 linear /dev/dm-0 384 $ dmsetup create volatility --table “0 16269312 crypt aes- xts-plain64 c2ca0a6a52980952016936047ab46fba961397978fbf3219 ca39fcfdce3b46e2b6348daa09d093351113288c8258bc6 bd3c3d57afab2d6bc3cac7cfde436939b 0 /dev/sda5 4096”
  • 29. © 2014 The Volatility Foundation 3rd Place: editbox •  Written by Adam Bridge “Bridgey The Geek” •  This plugin extracts text from the edit, combo, and list boxes of GUI applications that run on Windows •  Includes, but is not limited to: •  Notepad window •  Run dialog •  Username and server name fields of Remote Desktop Connection •  Address bar and search bar of Internet Explorer •  Search bar of Windows Media Player •  Username field of Create New Account wizard •  Password of Change Password dialog
  • 30. © 2014 The Volatility Foundation editbox
  • 31. © 2014 The Volatility Foundation editbox $ python vol.py --profile=Win7SP1x64 -f WIN7SP1X64-20140929-225403.raw editbox Volatility Foundation Volatility Framework 2.4 ******************************************************* Wnd context : 1WinSta0Default pid : 2244 imageFileName : mstsc.exe wow64 : No atom_class : 6.0.7601.17514!Edit [snip] isPwdControl : No deepthought.h2g2.com ******************************************************* Wnd context : 1WinSta0Default pid : 1748 imageFileName : explorer.exe wow64 : No atom_class : 6.0.7601.17514!Edit [snip] isPwdControl : Yes pwdChar : 0x25cf monkey
  • 32. © 2014 The Volatility Foundation screenshot + editbox
  • 33. © 2014 The Volatility Foundation screenshot + editbox
  • 34. © 2014 The Volatility Foundation Volatility 2014 Plugin Contest •  4th Place: •  Thomas Chopitea: Autoruns – Finding persistence •  5th Place: •  Takahiro Haruyama: OpenIOC Scan •  Submissions: •  Monnappa KA: Gh0stRat Decryption •  Jamaal Speights: MsDecompress •  Cem Gurkok: Mac Rootkit and Bitcoin •  Csaba Barta: Malware Analysis (Baselines) •  Philip Huppert: OpenVPN •  Wyatt Roersma: Hyper-V Tools 34
  • 35. © 2014 The Volatility Foundation OMFW 2014 •  OMFW first held 2008 •  Highly technical venue for digital investigators •  100% of the proceeds are donated to charity •  What makes OMFW unique: •  Workshop size •  Technical content •  Researchers and developers •  Peer relationships •  Cost •  Lightning talks •  8 Memory forensics presentations 35
  • 36. © 2014 The Volatility Foundation OMFW Agenda 2014 1300PM The State of Volatility 1330PM Careto: Accomplishing in 7 Minutes What AV Couldn’t Do in 7 yrs 1400PM Restructuring Memory: Extracting Results in a Reusable Way 1430PM Science, Sharing, and Repeatability in Memory Forensics 1500PM Break 1530PM Many Ways to Skin a RAT: Let’s Start with the Tail 1600PM Memory Forensics for IR: Leveraging Volatility to Hunt Adv Actors 1630PM Memory Tracing: Forensic Reverse Engineering 1700PM DAMM: A Tool for Differential Analysis of Malware in Memory 1730PM Closing Comments/Reception 36
  • 37. © 2014 The Volatility Foundation Volatility Unified Output
  • 38. © 2014 The Volatility Foundation Careto: Memory vs. AV http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf
  • 39. © 2014 The Volatility Foundation Memory Tracing
  • 40. © 2014 The Volatility Foundation Volatility Training/Certification •  Learn from the actual researchers and developers •  Show your support for open source developers •  Courses •  Windows Memory Forensics & Malware Analysis •  Memory Forensics Essentials •  Mac Memory Forensics & Malware Analysis •  Linux Memory Forensics & Malware Analysis •  Certifications •  Memory Forensics Examiner •  Memory Forensics Professional (Win/Mac/Lin) •  Information: www.memoryanalysis.net 40
  • 41. © 2014 The Volatility Foundation41 Download Volatility 2.4 https://github.com/volatilityfoundation/volatility http://volatility-labs.blogspot.com/ @volatility Join the community!