geschonneck.com » Live Response

frozen memory aquisition

Alexander Geschonneck — Fri, 22 Feb 2008 15:33:09 +0000

Cool stuff from Princeton researchers. They published a paper “Cold Boot Attacks on Encryption Keys” and showed that whole disk encryption can be defeated by relatively simple methods. They demonstrated their methods by using them to defeat three disk encryption products: BitLocker, FileVault, which comes with MacOS X; and dm-crypt, which is used with Linux.

Link to the project with sample video

More on Windows Local Kernel-mode Backdoor Techniques

Alexander Geschonneck — Sat, 10 Nov 2007 12:44:43 +0000

On uninformed.org you can find a whitepaper which describes several ways to get your code covertly executed in the Windows kernel.

This paper presents a detailed catalog of techniques that can be used to create local kernel-mode backdoors on Windows. These techniques include function trampolines, descriptor table hooks, model-specific register hooks, page table modifications, as well as others that have not previously been described. The majority of these techniques have been publicly known far in advance of this paper. However, at the time of this writing, there appears to be no detailed single point of reference for many of them. The intention of this paper is to provide a solid understanding on the subject of local kernel-mode backdoors. This understanding is necessary in order to encourage the thoughtful discussion of potential countermeasures and perceived advancements. In the vein of countermeasures, some additional thoughts are given to the common misconception that PatchGuard, in its current design, can be used to prevent kernel-mode rootkits.

via

New Forensics Live Response CD published

Alexander Geschonneck — Thu, 21 Jun 2007 12:49:53 +0000

I’m proud to announce, that my team published yesterday a very cool Live Response CD for Linux and Windows in cooperation with the german journal iX. It contains a brand new Linux Live Response script and a build script for your own static binaries. This Live Response Script contains also an extract option, if you like to organize the memory dump for an easy investigation.

More information about the ForensiX CD

Booting EnCase Images

Alexander Geschonneck — Wed, 02 May 2007 17:48:23 +0000

GetData now bundles their forensics tool MountImage Pro v2 with Virtual Forensic Computing (VFC) from MD5 Ltd. You can now mount a forensic image with Windows and create a VMware virtual machine configuration. Hmm, WTF is the difference between VFC and the freely available LiveView? VFC is able to mount and boot EnCase and SMART images.

Link to GetData

Malware Analysis with PEiD

Alexander Geschonneck — Sat, 11 Nov 2006 14:41:10 +0000

I’d like to comment on PEiD. If you have to analyse an unknown binary and you like to know some details about packers, compilers and crypto features, you should give PEiD a try.

The programmer writes:

PEiD detects most common packers, cryptors and compilers for PE files. It can currently detect more than 600 different signatures in PE files.

PEiD is special in some aspects when compared to other identifiers already out there!

1. It has a superb GUI and the interface is really intuitive and simple.
2. Detection rates are amongst the best given by any other identifier.
3. Special scanning modes for *advanced* detections of modified and unknown files.
4. Shell integration, Command line support, Always on top and Drag’n'Drop capabilities.
5. Multiple file and directory scanning with recursion.
6. Task viewer and controller.
7. Plugin Interface with plugins like Generic OEP Finder and Krypto ANALyzer.
8. Extra scanning techniques used for even better detections.
9. Heuristic Scanning options.
10. New PE details, Imports, Exports and TLS viewers
11. New built in quick disassembler.
12. New built in hex viewer.
13. External signature interface which can be updated by the user.

New Helix version released

Alexander Geschonneck — Thu, 12 Oct 2006 14:09:13 +0000

There is a new Helix (Incident Response & Computer Forensics Live CD based on Knoppix) version released. Version 1.8 has a now Andreas Schuster’s PTFinder included an will no longer change JFS information. You can donwload Helix here.
All new features at a glance:

Linux Side:
- Fixed Helix Mount code for journaled file systems. Helix will NO longer change the journal mount count when you mount a journaled file system.
- Updated md5deep suite to 1.12
- Updated Clamav to 0.88.2
- Updated Sleuthkit to 2.06
- Updated Autopsy to 2.08
- Updated Foremost to 1.3
- Updated Scalpel 1.54 to carve data
- Updated EnCase Linen to 5.05f
- Updated Adepto 2.0 – With AFF support now
- Added endeavour2 file manager
- Added ssdeep 1.0 for fuzy hashing
- Added AFFlib 1.6.31 for image acquisition
- Added NTFS-3G for native NTFS write support
- Added libewf library
- Added ptfinder memory analysis code from Andreas Schuster
- Removed Solaris static binaries from CD
- Replaced evince with xpdf
Windows Side:
- Updated the Helix executable code
- Update code for command shell paths
- Update all Cygwin tools to latest
- Updated all unxutil tools
- Updated Static Binaries (linux)
- Updated MessenPass to v1.08
- Updated Mail PassView to v1.36
- Updated Protected Storage PassView to v1.63
- Updated Network Password Recovery to v1.03
- Updated IECookiesView to v1.70
- Updated IEHistoryView to v1.32
- Updated RegScanner to v1.30
- Updated FTK Imager to 1.5.1
- Updated Forensic Server Project to 1.0
- Updated PsTools Version to 2.34 (Psexec, psinfo, pslist, etc)
- Updated Process Explorer to 10.2
- Added PstPassword v1.00
- Added Access PassView 1.12
- Added PC On/Off Time
- Added Winaudit v2.15
- Added Drive Manager v3.23
- Added ReSysInfo v2.1
- Added Icon to start a NC listener
- Added code to Windows GUI for investigative notes

FSP/FRU File Copy Client released

Alexander Geschonneck — Tue, 03 Oct 2006 13:02:16 +0000

Harlan Carvey just released the FSP/FRU File Copy Client on SourceForge. The FCli is a GUI client that the investigator can use to select files to be copied from the suspect system, over to the FSP server.

Live View released

Alexander Geschonneck — Tue, 29 Aug 2006 12:48:12 +0000

Brian Kaplan from Carnegie Mellon University just released a tool called Live View. With Live View you can convert a raw dd image or physical device to a VMware virtual machine.

More information about Live View here.

Forensic memory dumping issues

Alexander Geschonneck — Tue, 06 Jun 2006 10:44:54 +0000

Arne Vidstrom from ntsecurity.nu wrote an interesting paper about problems with forensic RAM dumps from Windows XP. His summary on this topic is:

“Memory dumping tools that use the PhysicalMemory device in Windows XP can be blocked by allocating memory buffers with special memory types. In older versions of Windows the tools instead could possibly cause cache incoherence with some processor types, or other adverse side effects. The problem can also occur on a system that has not been manipulated at all by any attacker.”

windows memory analysis

Alexander Geschonneck — Thu, 06 Apr 2006 21:09:22 +0000

Andreas Schuster recently published on his blog two interesting articles about process memory reconstruction.
He describes how to extract the memory of a single process from a full memory dump. The other article shows how to reconstruct a program binary of a specific process from a full memory dump.