Memory Dump Research Articles

Ransomware Digital Extortion: A Rising New Age Threat

Imagine what would happen if you were stopped from accessing your own files or accessing your own computer system. Now imagine further if to get back the access someone demanded ransom amount from you. Globally increasingly social interactions and financial transactions involve few critical aspects such as digital data, computing device and the internet. This is an area where Ransomware has spread and become a major concern against digital extortion in the form of a new age threat vector to corporates and end users alike. This paper presents the various ways and methods adopted by cyber criminals against Ransomware and present an anti-malware detection system. Background/Objectives: The impact of Ransomware has caused immense damage to end users and corporates alike. Access to authorized data being blocked and being released only after the ransom demand has been mate, is a new age digital extortion has which holds promise as a viable option against the cyber-attacks on user systems, mobiles and handhelds. Methods/Statistical Analysis: The authors reviewed existing Crypto and Locker ransomware, studying their propagation, attack techniques and new emerging threat vectors as file Encryption Ransomware, Screen Lock Ransomware, Windows & Browser Lock, Pop Advertisements and URL Redirection. The authors also designed and tested cloud based malware detection system, performing comparison evaluation with and without the proposed anti-malware solution in form of sandboxes, so even if the environment got compromised, it could be easily decommissioned and rebuilt from a fresh clean virtual snapshots. The system comprised of three virtual environments running services for Malware Behavioral Analysis, Malware Code Analysis and Malware Reporting. Open source and commercial tools were used in each of the three environments. Malware Behavioral environment for analyzing malware for before and after receiving malware payload files and logs from infected user devices. Malware Code Analysis gathered assembly code and memory dumps from memory and performed analysis on malware payload instructions. The Reporting environment analyzed Web URL proactively for malicious sites hosting malware code or payloads and also checked the user system and devices for before and after analysis logs. Findings: When comparing to the standard antivirus scanners that rely on signatures, the proposed malware detection and alerting process has better malware mitigation results and advantages. The Anti-Malware scanning security apart from being a cloud service with the secure scanners operating from cloud platforms display a high level of resilience. Being a Cloud application has the standard cloud feature advantages of being elastic, scalable, pay-as-you-use, user driven cloud model. This model can also help in saving costs by promoting the BYOD concept. Application/Improvements: The Anti-Malware cloud model can be modified to offer specific payload blocking for different customers even as other customers of that very application program are able to access them and even benefit from experience of the infected customers. This model can be scale up dynamically as required.

Lightweight control-flow instrumentation and postmortem analysis in support of debugging

Debugging is difficult and costly. As a programmer looks for a bug, it would be helpful to see a complete trace of events leading to the point of failure. Unfortunately, full tracing is simply too slow to use after deployment, and may even be impractical during testing. We aid post-deployment debugging by giving programmers additional information about program activity shortly before failure. We use latent information in post-failure memory dumps, augmented by low-overhead, tunable run-time tracing. Our results with a realistically-tuned tracing scheme show low enough overhead (0–5 %) to be used in production runs. We demonstrate several potential uses of this enhanced information, including a novel postmortem static slice restriction technique and a reduced view of potentially-executed code. Experimental evaluation shows our approach to be very effective. For example, our analyses shrink stack-sensitive interprocedural static slices by 53–78 % in larger applications.

Forensic analysis of newer TomTom devices

Today many investigations involve TomTom devices due to the wide-spread use of these navigation systems. The process of acquiring a memory dump from the first generation of TomTom devices was relatively easy by utilising the USB-connection and standard forensic tools. Newer devices, however, do not provide this or any other readily available data connection, making the task much more complex. In addition to existing and relatively complex chip-extraction procedures, an easier data acquisition method was developed without the need to de-solder flash memory chips. The presence of new files and the differences in data formats found in these devices meant that new methods of data analysis and decoding also needed to be developed.

가상화 환경에서 임베디드 시스템을 위한 모니터링 프레임워크와 디버깅 시스템

Effective profiling diagnoses the failure of the system and informs risk. If a failure in the target system occurs, it is impossible to diagnose more than one of the exiting tools. In this respect, monitoring of the system based on virtualization is useful. We present in this paper a monitoring framework that uses the characteristics of hardware virtualization to prevent side-effects from a target guest, and uses dynamic binary instrumentation with instruction-level trapping based on hardware virtualization to achieve efficiency and flexibility. We also present examples of some applications that use this framework. The framework provides tracing of guest kernel function, memory dump, and debugging that uses GDB stub with GDB remote protocol. The experimental evaluation of our prototype shows that the monitoring framework incurs at most 2% write memory performance overhead for end users.

Data correlation‐based analysis methods for automatic memory forensic

AbstractMemory forensics is an important technique for protecting network security and fighting against computer crimes. It has developed greatly in the past decade, because memory can provide more reliable information that other evidence sources do not contain. However, nowadays, when investigating network criminal cases, the Gigabyte (GB) and even Terabyte (TB) level memory and many such dumps have made memory analysis a difficult task. And investigators usually have to deal with complex operating system (OS) data structures, which they have little knowledge of. So how to analyze memory evidence automatically so as to find the hidden criminal behavior and reconstruct the scenario in an understandable way has become an important problem. This paper presents an automatic memory analysis methodology based on data correlation. Through analyzing key OS data structures and utilizing a clustering algorithm, this methodology can discover the relationships among processes, files, users, Dynamic‐link library (DLLs), and network connections. By describing these relationships as correlation graphs, our methods can reorganize these independent memory evidences and disclose their meanings in a high semantic level. Experiments have proved that these correlation graphs can help investigators find hidden criminal behavior and reconstruct the criminal scenarios. And as we know, now, little work is in this field. Copyright © 2015 John Wiley & Sons, Ltd.

Monitoring of Integrity of Dynamic Objects of Computing Systems with Use of Metric Standards

In article approach to monitoring of integrity of dynamic objects on their metric standards is offered. Creation of a standard is based on sequential conversion of process from a memory dump to the machine gun of transitions on a state graph with calculation of structural, information and operational metrics. It allows to reveal violations of the functional statuses of object in memory of the computing system. The algorithm of monitoring of integrity of dynamic objects of anti-virus means of Dr.Web is provided.

A mathematical approach to NAND flash-memory descrambling and decoding

New mathematical techniques for analysis of raw dumps of NAND flash memory were developed. These techniques are aimed at detecting, by analysis of the raw NAND flash dump only, the use of LFSR-based scrambling and the use of a binary cyclic code for error-correction. If detected, parameter values for both LFSR and cyclic error-correcting code are determined simultaneously. These can subsequently be applied to expose the content of memory pages in the raw NAND flash dump and prepare these for further processing with media analysis tools. The techniques were tested on raw NAND flash memory dumps of four different devices and in all cases LFSR-based scrambling and binary cyclic error-correcting codes were in use.

Data Extraction on MTK-based Android Mobile Phone Forensics

In conducting criminal investigations it is quite common that forensic examiners need to recover evidentiary data from smartphones used by offenders. However, examiners encountered difficulties in acquiring complete memory dump from MTK Android phones, a popular brand of smartphones, due to a lack of technical knowledge on the phone architecture and that system manuals are not always available. This research will perform tests to capture data from MTK Android phone by applying selected forensic tools and compare their effectiveness by analyzing the extracted results. It is anticipated that a generic extraction tool, once identified, can be used on different brands of smartphones equipped with the same CPU chipset.

Multi-Aspect, Robust, and Memory Exclusive Guest OS Fingerprinting

Precise fingerprinting of an operating system (OS) is critical to many security and forensics applications in the cloud, such as virtual machine (VM) introspection, penetration testing, guest OS administration, kernel dump analysis, and memory forensics. The existing OS fingerprinting techniques primarily inspect network packets or CPU states, and they all fall short in precision and usability. As the physical memory of a VM always exists in all these applications, in this article, we present OS-Sommelier $^+$ , a multi-aspect, memory exclusive approach for precise and robust guest OS fingerprinting in the cloud. It works as follows: given a physical memory dump of a guest OS, OS-Sommelier $^+$ first uses a code hash based approach from kernel code aspect to determine the guest OS version. If code hash approach fails, OS-Sommelier $^+$ then uses a kernel data signature based approach from kernel data aspect to determine the version. We have implemented a prototype system, and tested it with a number of Linux kernels. Our evaluation results show that the code hash approach is faster but can only fingerprint the known kernels, and data signature approach complements the code signature approach and can fingerprint even unknown kernels.

In lieu of swap: Analyzing compressed RAM in Mac OS X and Linux

The forensics community is increasingly embracing the use of memory analysis to enhance traditional storage-based forensics techniques, because memory analysis yields a wealth of information not available on non-volatile storage. Memory analysis involves capture of a system's physical memory so that the live state of a system can be investigated, including executing and terminated processes, application data, network connections, and more. One aspect of memory analysis that remains elusive is investigation of the system's swap file, which is a backing store for the operating system's virtual memory system. Swap files are a potentially interesting source of forensic evidence, but traditionally, most swap file analysis has consisted of string searches and scans for small binary structures, which may in some cases be revelatory, but are also fraught with provenance issues. Unfortunately, more sophisticated swap file analysis is complicated by the difficulty of capturing mutually consistent memory dumps and swap files, the increasing use of swap file encryption, and other issues. Fortunately, compressed RAM facilities, such as those in Mac OS X Mavericks and recent versions of the Linux kernel, attempt to reduce or eliminate swapping to disk through compression. The storage of compressed pages in RAM both increases performance and offers an opportunity to gather digital evidence which in the past would have been swapped out. This paper discusses the difficulty of analyzing swap files in more detail, the compressed RAM facilities in Mac OS X and Linux, and our new tools for analysis of compressed RAM. These tools are integrated into the open-source Volatility framework.

Out of sight, but not out of mind: Traces of nearby devices' wireless transmissions in volatile memory

An IEEE 802.11 wireless device can leave traces of its presence in the volatile memories of nearby wireless devices. While the devices need to be in radio range of each other for this to happen, they do not need to be connected to the same network—or to any network at all. Traces appear in the form of full wire-type frames; a residue of the signals in the ether. We examine types of information that can be extracted from such residual frames and explore the conditions under which traces develop and persist. Their availability is determined by factors in both in the external environment (the types of signals in the ether) and the internal environment (the configuration and particulars of a device's wifi stack). To isolate some of these factors, we have created memory dumps of devices in various environments and configurations. Analysis of the dumps has offered insights into the conditions determining creation and decay of the traces. The results indicate that they will be available in a limited number of real-world scenarios. We conclude with practical advice on triaging and preservation.

Evaluating the privacy of Android mobile applications under forensic analysis

In this paper, we investigate and evaluate through experimental analysis the possibility of recovering authentication credentials of mobile applications from the volatile memory of Android mobile devices. Throughout the carried experiments and analysis, we have, exclusively, used open-source and free forensic tools. Overall, the contribution of this paper is threefold. First, it thoroughly, examines thirteen (13) mobile applications, which represent four common application categories that elaborate sensitive users' data, whether it is possible to recover authentication credentials from the physical memory of mobile devices, following thirty (30) different scenarios. Second, it explores in the considered applications, if we can discover patterns and expressions that indicate the exact position of authentication credentials in a memory dump. Third, it reveals a set of critical observations regarding the privacy of Android mobile applications and devices.

PUF 기반의 보안 USB 인증 및 키 관리 기법

Recently, a storage media is becoming smaller and storage capacity is also becoming larger than before. However, important data was leaked through a small storage media. To solve these serious problem, many security companies manufacture secure USBs with secure function, such as data encryption, user authentication, not copying data, and management system for secure USB, etc. But various attacks, such as extracting flash memory from USBs, password hacking or memory dump, and bypassing fingerprint authentication, have appeared. Therefore, security techniques related to secure USBs have to concern many threats for them. The basic components for a secure USB are secure authentication and data encryption techniques. Though existing secure USBs applied password based user authentication, it is necessary to develop more secure authentication because many threats have appeared. And encryption chipsets are used for data encryption however we also concern key

A study on memory dump analysis based on digital forensic tools

The application of IT in all industrial facilities has led to the use of special-purpose systems in diverse areas. As such, special-purpose systems have increasingly become the target or path of hacking attacks. From a digital forensics viewpoint, these systems can be used to gather evidence from all the relevant digital devices such as whole systems or storage units at the scene of a crime. Notably, In case of special-purpose embedded system, unlike a conventional computing system, is almost always ‘powered on’ like server, the accumulated data can remain in the volatile memory. This paper focuses on analyzing ways of gathering physical memory data for application in an embedded system and of developing a test system to analyze the physical memory for verification.

Study on Live analysis of Windows Physical Memory

Memory forensics and data carving methods are usually used during volatile investigation and is nowadays a big area of interest. Volatile memory dump is used for offline analysis of live data. Live analysis of the running system gives the information of which events are going on. Volatile memory analysis can give the sensitive information such as User Ids, Passwords, Hidden Processes, Root kits, Sockets etc. which are not stored on the physical drive. This Paper represents various approaches and tools used to capture and analyse data from computer memory.

Women Lead in Adopting New Technologies

Women Lead in Adopting New Technologies

A trusted environment construction method for security-sensitive software

This paper presents a trusted-environment construction method based on the underlying hardware. This method aims at protecting the security-sensitive software in the aspects of software loading, running, and storing in the general operating system. It extends the trust chain of the traditional trusted computing technology to reach the target software, ensuring trusted loading. The extended memory management mechanism effectively prevents memory dumping and memory tampering for the high-sensitivity data. The file monitoring mechanism protects files from vicious operation made by attackers. Flexible-expanded storage environment provides the target software with static storing protection. Experimental system verifies that the method is suitable for general operating system and can effectively protect security-sensitive software with low overhead.

An online cross view difference and behavior based kernel rootkit detector

Kernel level rootkits pose a serious threat today as they not only mask the presence of themselves but also mask the malware that comes attached with them. Rootkits achieve such stealthy behavior by manipulating the control flow of system calls by hooks and kernel objects, viz., driver and process list directly. Existing Antiviruses that rely on signature based techniques for detection of malwares are effective only against known rootkits. However, as hackers change coding style of rootkits, Antiviruses fail to detect them and rootkits and their malicious activities are hidden from the view of the administrator. Thus, all data on the compromised system becomes vulnerable to theft and all services running on it can be misused by the remote attacker without even the slightest chance of being discovered. Other rootkit detection techniques such as integrity checking, alternate trusted medium, and memory dumping require frequent offline analysis and fail to unload or block the rootkit. This paper addresses, these challenges and proposes an online cross view difference and behavior based kernel rootkit detector to overcome them. Our proposed solution Kernel Rootkit Trojan Detector (KeRTD) is a host-based and cross view difference-based solution that enables online analysis and aids detection of rootkit immediately. A simple view difference of snapshot of Task manager in user mode and KeRTD Process and Driver List helps the detection of hidden rootkits and other hidden malwares. All rootkits follow a generic pattern of infection such as installing kernel hooks and modification of kernel objects, etc. This very generic behavior of rootkit is exploited in KeRTD to detect and restore the kernel hooks, thus blocking them from further infection. Every file and memory accesses are verified against Access Control List to avoid subversion of KeRTD and operating system kernel. This proposal has been implemented on windows operating system and tested for various methods of attack by kernel rootkits. The results confirm the detection of the kernel rootkits.

On-the-spot digital investigation by means of LDFS: Live Data Forensic System

The ever growing capacity of hard drives poses a severe problem to forensic practitioners who strive to deal with digital investigations in a timely manner. Therefore, the on-the-spot digital investigation paradigm is emerging as a new standard to select only that evidence which is important for the case being investigated. In the light of this issue, we propose an incident response tool which is able to speed up the investigation by finding crime-related evidence in a faster way compared with the traditional state-of-the-art post-mortem analysis tools. The tool we have implemented is called Live Data Forensic System (LDFS). LDFS is an on-the-spot live forensic toolkit, which can be used to collect and analyze relevant data in a timely manner and to perform a triage of a Microsoft Windows-based system. Particularly, LDFS demonstrates the ability of the tool to automatically gather evidence according to general categories, such as live data, Windows Registry, file system metadata, instant messaging services clients, web browser artifacts, memory dump and page file. In addition, unified analysis tools of ELF provide a fast and effective way to obtain a picture of the system at the time the analysis is done. The result of the analysis from different categories can be easily correlated to provide useful clues for the sake of the investigation.

Dependability evaluation of integrated circuits at design time against laser fault injection

ABSTRACTLaser fault injection has been proved to be a useful tool for attacks on integrated circuits. Transistors hit by a pulse of photons causes them to conduct transiently, thereby introducing transient logic errors, such as register value modifications, memory dumping, and so on. Attackers can make use of this abnormal behavior and extract sensitive information that the devices try to protect. This paper demonstrates laser fault injection attacks on very‐large‐scale integration circuits in a semi‐invasive way for the purpose of validating fault tolerant design and performance. Then, the paper presents a simulation methodology to evaluate the dependability of the integrated circuit design against laser fault injection attacks at design time. This simulation methodology involves exhaustively scanning the layout, incorporating the exposed cells into a circuit simulator, and examining the response of the circuit in detail. Experiments conducted on the same test chip spot the same vulnerabilities, thus indicating the validity of the proposed simulation methodology. Copyright © 2011 John Wiley & Sons, Ltd.