Digital Investigation and Trojan Defense.Pdf

Digital Investigation and the Trojan Defense, Revisited Golden G. Richard III Professor of Computer Science and University Research Professor Director, Greater New Orleans Center for Information Assurance (GNOCIA) University of New Orleans GIAC-certified Digital Forensics Investigator Founder, Arcane Alloy, LLC [email protected] / [email protected] / @nolaforensix <a href="/goto?url=http://www.cs.uno.edu/~golden" target="_blank">http://www.cs.uno.edu/~golden </a>2Who? Professor of Computer Science and University Research Professor, Director, Greater New Orleans Center for Information Assurance (GNOCIA), University of New Orleans <a href="/goto?url=http://www.cs.uno.edu/~golden" target="_blank">http://www.cs.uno.edu/~golden </a>Digital forensics, OS internals, reverse engineering, offensive computing, pushing students to the brink of destruction, et al. Founder, Arcane Alloy, LLC. <a href="/goto?url=http://www.arcanealloy.com" target="_blank">http://www.arcanealloy.com </a>Digital forensics, reverse engineering, malware analysis, security research, tool development, training. Co-Founder, Partner / Photographer, High ISO Music, LLC. <a href="/goto?url=http://www.highisomusic.com" target="_blank">http://www.highisomusic.com </a>Music. Rock stars. Earplugs. Copyright 2015 by Golden G. Richard III (@nolaforensix) 3Digital Forensics “Tools and techniques to recover, preserve, and examine digital evidence stored on or transmitted by digital devices.” Computers, PDAs, cellular phones, videogame consoles, digital cameras, copy machines, printers, digital voice recorders… 4What That Really Means • Data. “You only think it’s gone.” • Sensitive data tenaciously clings to life. • The vast majority of users—and lots of technical people, too— have no idea what’s really stored on their digital devices… • …and no ability to properly “clean up” even if they do suspect what’s there Copyright 2015 by Golden G. Richard III (@nolaforensix) 5Where’s the Evidence? Files and Deleted Files Filesystem metadata Application metadata Windows registry Print spool files Hibernation files <ul style="display: flex;"><li style="flex:1">Temp files </li><li style="flex:1">Log files </li></ul>Browser caches Network traces <ul style="display: flex;"><li style="flex:1">Slack space </li><li style="flex:1">Swap files </li></ul>RAM: OS and app data Volatile Evidence structures Copyright 2015 by Golden G. Richard III (@nolaforensix) How awesome are we? 7File Carving one cluster one sector <ul style="display: flex;"><li style="flex:1">unrelated disk blocks </li><li style="flex:1">interesting file </li></ul>header, e.g., 0x474946e8e761 (GIF) footer, e.g., 0x003B (GIF) “milestones” or “anti-milestones” Copyright 2015 by Golden G. Richard III (@nolaforensix) 8Awesomeness Progression: File Carving Can carve Chaos: files, but not very well More accurate <ul style="display: flex;"><li style="flex:1">Faster </li><li style="flex:1">can't </li></ul>Yay! carve files Tools appear, but have issues File type aware carving, et al Fragmentation, damned spinning disks! Manual hex editor stuff Multithreading, better design Images: <a href="/goto?url=https://easiersaidblogdotcom.files.wordpress.com/2013/02/hot_dogger.jpg" target="_blank">https://easiersaidblogdotcom.files.wordpress.com/2013/02/hot_dogger.jpg </a><a href="/goto?url=http://cdn.bigbangfish.com/555/Cow/Cow-6.jpg" target="_blank">http://cdn.bigbangfish.com/555/Cow/Cow-6.jpg</a>, <a href="/goto?url=http://f.tqn.com/y/bbq/1/W/U/i/Big_green_egg_large.jpg" target="_blank">http://f.tqn.com/y/bbq/1/W/U/i/Big_green_egg_large.jpg </a><a href="/goto?url=http://i5.walmartimages.com/dfw/dce07b8c-bb22/k2-_95ea6c25-e9aa-418e-a3a2-8e48e62a9d2e.v1.jpg" target="_blank">http://i5.walmartimages.com/dfw/dce07b8c-bb22/k2-_95ea6c25-e9aa-418e-a3a2-8e48e62a9d2e.v1.jpg </a>Copyright 2015 by Golden G. Richard III (@nolaforensix) 9Memory Analysis • physical memory dumping tool • VM memory snapshot • VM introspection Capture RAM from live system • strings • carving • Volatility Analyze Memory Dump • VM introspection Expose interesting volatile evidence Copyright 2015 by Golden G. Richard III (@nolaforensix) 10 Memory Analysis: Evidence e.g., discover and analyze unauthorized programs Processes (dead / alive) e.g., detect keystroke loggers, hidden processes Open files e.g., find backdoors, connections to contraband sites Network connections Volatile registry contents Volatile application data portions of Windows registry that are never stored on disk e.g., plaintext for encrypted material, chat messages, email fragments, volatile web browser history volatile contents of clipboard Clipboard data Copyright 2015 by Golden G. Richard III (@nolaforensix) 11 Awesomeness Progression: Memory Forensics Pioneering efforts show great promise More, more, more Chaos: run strings? Beyond Windows ?? More attention to malware, filling in the gaps, GPU stuff, etc. pt_finder et al awesome but limited …Manual, run strings, little context Mac, Linux, BSD functionality Images: <a href="/goto?url=https://s-media-cache-ak0.pinimg.com/736x/75/5a/37/755a37727586c57a19d42caa650d242e.jpg" target="_blank">https://s-media-cache-ak0.pinimg.com/736x/75/5a/37/755a37727586c57a19d42caa650d242e.jpg</a>,, <a href="/goto?url=http://img.photobucket.com/albums/v136/Hell2Pay77/SS-trucks.jpg" target="_blank">http://img.photobucket.com/albums/v136/Hell2Pay77/SS-trucks.jpg </a><a href="/goto?url=http://skateandannoy.com/wp-content/uploads/2007/12/sportsbars.jpg" target="_blank">http://skateandannoy.com/wp-content/uploads/2007/12/sportsbars.jpg</a>, <a href="/goto?url=http://gainesvillescene.com/wp-content/uploads/2013/03/dog-longboard.jpg" target="_blank">http://gainesvillescene.com/wp-content/uploads/2013/03/dog-longboard.jpg </a>Copyright 2015 by Golden G. Richard III (@nolaforensix) 12 Memory Analysis: 2004 $ grep –i murder /dev/mem I loved Sally, but I murdered her in the park on… Murder Murderer! Blood is on your shoulders! Murderous You murdered my hamster! Murdered Copyright 2015 by Golden G. Richard III (@nolaforensix) 13 Detecting Hidden Resource Utilization • Adversary: Direct Kernel Object Manipulation (DKOM) • Strategy: Deep analysis and cross-correlation of data kernel data structures to reveal hidden resource utilization PID = 2260 Doubly-linked process list in Windows kernel Processes continue to run because Windows C:\> fu –ph 2260 scheduler handles threads, not processes PID = 2260 Copyright 2015 by Golden G. Richard III (@nolaforensix) 14 Copyright 2015 by Golden G. Richard III (@nolaforensix) 15 FU on PID 2260 DKOM Hidden Process Detection in Volatility Copyright 2015 by Golden G. Richard III (@nolaforensix) So we're awesome, right? 17 Unfortunately What evidence is present and what can be recovered? How hard is it to recover? Technical Difficulty Increasing What “evidence” Did malware play a role? was actually “recovered”? Copyright 2015 by Golden G. Richard III (@nolaforensix) 18 Unfortunately, Part 2 What evidence is present and what can be recovered? How hard is it to recover? Misinformation Abounds What “evidence” Did malware play a role? was actually “recovered”? Copyright 2015 by Golden G. Richard III (@nolaforensix) 19 Digital Forensics Settle Intellectual Property Disputes Investigate Employee Misconduct Uncover Fraud Discover Insider Threats Investigate Child Exploitation Prosecute Thieves, Kidnappers, Murderers Copyright 2015 by Golden G. Richard III (@nolaforensix) 20 Digital Forensics Settle Intellectual Property Disputes Investigate Employee Misconduct Uncover Fraud malware Discover Insider Threats Investigate Child Exploitation Prosecute Thieves, Kidnappers, Murderers Copyright 2015 by Golden G. Richard III (@nolaforensix)

Digital Investigation and Trojan Defense.Pdf

Details

Download

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

Support