Like many of you, I have been watching the development of memory forensics over the last two years with a sense of awe.  It is amazing how far the field has come since the day Chris Betz, George Garner and Robert-Jan Moral won the 2005 DFRWS forensics challenge.   Of course, similar to other forensic niches, the majority of progress has been made on Windows memory forensics.  There is good reason for this.  Memory can be extremely fickle, with layouts and structures changing on a whim.   As an example, the symbols file for Windows 7 SP1x86 is 330MB, largely due to it needing to support major changes that can occur in every service pack and patch.  The fact that we have free tools such as Volatile Systems Volatility and Mandiant Redline supporting memory images of arbitrary size from (nearly) every modern version of Windows is nothing short of miraculous.

Nowhere is it more obvious how far the memory analysis field has come than looking at the recent innovations in Mac and Linux memory forensics.  Examiners of these less popular platforms have had to sit patiently for years as Windows memory forensics moved from being feasible for OS internals experts to being approachable for the masses.  Against all odds, Linux memory analysis has recently seen rapid innovations.  If support for the various Windows versions came slowly, imagine the complexity posed by the myriad flavors of Linux and the long list of possible kernel versions.  It turns out that the Volatility framework is particularly well suited to tackle this Hydra with its abstraction layers facilitating everything from different image formats to swappable OS profiles to rapid plugin development.

Continue Reading…

Jul 3

A nice introduction to reflective DLL injection.

In case you missed it over on the SANS Computer Forensics blog, we recently updated our memory forensics cheat sheet. Not a lot has changed other than updating a few parameter options, adding Michael Cohen’s WinPmem (live memory analysis with Volatility!), and reflecting a few of the changes in the upcoming 2.3 Volatility release (including body file format in Jamie Levy’s timeliner plugin)

MemoryForensicsCheatSheet

(click for PDF)

Jun 11

The GUI control panel is a long-standing feature of Microsoft Windows, facilitating granular changes to a vast collection of system features.  It can be disabled via Group Policy but is largely available to most user accounts (administrative permissions are required for some changes).  From a forensic perspective, we can audit control panel usage to identify a wide range of user activity:

  • Firewall changes made for unauthorized software (firewall.cpl)
  • User account additions / modifications (nusrmgr.cpl)
  • Turning off System Restore / Volume Shadow Copies (sysdm.cpl)
  • System time changes (timedate.cpl)
  • Interaction with third-party security software applets

While identifying individual system modifications is difficult, at a minimum we can show that a user accessed a specific control panel applet at a specific time.  Context provided by other artifacts may provide further information.  As an example, imagine you were reviewing control panel usage on a system and came across Figure 1.

Brutus Password Cracker

Figure 1: Sample Userassist Output

Context is critical, and, while access to the Windows Security Center might not normally be particularly interesting, the fact that it was accessed immediately following the execution of a known (router) password cracking tool might make all the difference.

Continue Reading…

With the major expansion of forensic curriculum at the SANS Institute, I frequently get questions about what class(es) to take. If you are trying to decide between FOR408 (Windows Forensics) and FOR508 (Advanced Forensics and Incident Response), this is the best comparison I have seen online.

I found the following quote particularly insightful: “508 is not a more advanced version of the 408, it’s a completely different course with completely different objectives.”

PlugX Malware Progression

Amanda Stewart at the FireEye blog dissected the PlugX malware remote access tool (RAT).  Of particular interest is this beautiful graphic showing the attack progression.  With decoys, DLL sideloading, encrypted payloads, process injection, and new payload retrieval, this attack pretty much has it all!

Last year I covered the free Encrypted Disk Detector (EDD) tool and challenged the community to help crowdsource its development [link].   Thank you to all that took part in the experiment.  Magnet Forensics announced today that Encrypted Disk Detector version 2 is available [get it here].

Survey Results

In addition to encouraging additional development of EDD, a side benefit of the project was to get an idea of the most popular disk encryption products being deployed.  Figure 1 provides the survey results, with Checkpoint Full Disk Encryption, Symantec Endpoint Encryption, and Sophos (formerly Utimaco) Safeguard rounding out the top three.   I think many of us could have guessed that big players like Symantec and Sophos would be near the top, but I was surprised to see products like BestCrypt and SecureDoc pull ahead of Credant Technologies (now owned by Dell).

EDD Survey Results

Figure 1: EDD Survey Results

Continue Reading…

Like many great inventions, the idea behind F-Response is so simple and elegant it is hard not to punish yourself for not thinking of it.  Using the iSCSI protocol to provide read-only mounting of remote devices opens up a wealth of options for those of us working in geographically dispersed environments.  I have used it for everything from remote imaging to fast forensic triage to live memory analysis.  F-Response is vendor-neutral and tool independent, essentially opening up a network pipe to remote devices and allowing the freedom of using nearly any tool in your kit.   The product is so good, I really wouldn’t blame them for just sitting back and counting their money.  Luckily, counting money gets boring fast, so instead the folks at F-Response have kept innovating and adding value.  Their latest additions are new “Connector” tools: Database, Cloud, and Email.

Continue Reading…

Packers are most commonly used for compression, code obfuscation, and malware anti-reversing.  While not always malicious, packers are often a clue to look a little deeper into a particular binary.  Ange Albertini did a marvelous job of representing the (known) universe of executable packers in this infographic.

Universe of Executable Packers

[Click to enlarge]

The full PDF file can be found here.