Digital forensics and malware Digital forensics According to - PowerPoint PPT Presentation

Sep 10, 2022 •481 likes •630 views

Digital forensics and malware Digital forensics According to Wikipedia, you could be looking for: attribution, alibis and statements, intent, evaluation of source, document authentication File carving ( e.g. , bifragment gap carving)

Digital forensics and malware
Digital forensics ● According to Wikipedia, you could be looking for: attribution, alibis and statements, intent, evaluation of source, document authentication ● File carving ( e.g. , bifragment gap carving) – Electron microscopes ● Memory forensics (Volatility) ● Network forensics (PCAPs, NetFlow records, NIDS logs) ● Database forensics ● Timestamps in document or log file analysis ● Steganography ● Digital forensic processes ● Benford's law
File carving Alessio Sbarbaro User_talk:Yoggysot - Own work
Memory forensics
Steganography From https://www.tech2hack.com/steganography-hide-data-in-audio-video-image-files/
Forensics tools ● File carvers – E.g. , Scalpel and foremost ● Log parsers ● Parsers/viewers for different kinds of files – SQLite, EXIF, etc. ● Linux commands that might be useful: – file, exif, sqlite3, losetup, mount, dd, ssdeep, grep, strings
Malware ● Cryptovirology by Young and Yung ● The Art of Computer Virus Research and Defense by Szor – Common theme since the turn of the millennium: stay in memory and don't go out to disk ● Elk Cloner in 1981 (Skrenta) ● “Virus” coined by Cohen in 1983 (“Information only has meaning in that it is subject to interpretation”) – https://web.eecs.umich.edu/~aprakash/eecs588/handouts/cohen-viruses.html ● “Worm” came from John Brunner's The Shockwave Rider in 1975 – Creeper in 1971 for TENEX systems – ANIMAL in 1975 – Morris Worm in 1988 – Code Red in 2001
Interesting types of malware ● Macroviruses – “On error resume next” ● Botnets – Command and Control (C&C), from IRC and hierarchical to fastflux and beyond ● Targeted threats and “RATs” – E.g., Tibetan exile community, Syria/Egypt, Mexico – Google “Citizen Lab” or watch “Black Code”
Malware analysis ● Static vs. dynamic ● IDA Pro, Ollydbg, etc. ● Cuckoo Sandbox ● Decompilation ● Armoring, packing, etc.
Stuxnet ● Attacked Iranian nuclear program ● Multiple ways of spreading ● Attempt to limit spread ● Not as buggy as malware typically is
Anomaly detection ● A Sense of Self for Unix Processes (Forrest et al. in 1996)
Resources ● Practical Malware Analysis by Honig and Sikorski ● http://www.forensicswiki.org/wiki/Tools
Conferences you should check out ● IEEE Symposium on Security and Privacy (Oakland) ● USENIX Security Symposium – Also check out the workshops like FOCI and WOOT ● ACM Conference on Computer and Communications Security (CCS) ● Network and Distributed System Security Symposium (NDSS) ● Privacy-Enhancing Technologies Symposium (PETS) – Also PoPETS ● Also RAID for intrusion detection, DFRWS for forensics, CSF for policy and theory, Eurocrypt and Crypto, Blackhat, DEFCON, phrack, 2600 magazine, WPES and WEIS

Recommend

Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE

A RIZONA S TATE U NIVERSITY Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE U NIVERSITY Common Types of Attacks Phishing Malware SQLi XSS MITM DoS Brute-force &

858 views • 55 slides

About this presentation : Learning : What is Digital Forensics ? Political : Digital

An introduction to digital forensics About this presentation : Learning : What is Digital Forensics ? Political : Digital Forensics and Open Sources licensing Tool time : Digital Forensics Framework Presented by Solal Jacob core dev.

444 views • 30 slides

Digital Forensics for SSC Solvers Daniel Kouril EGI CSIRT Digital Forensics Methods to

Digital Forensics for SSC Solvers Daniel Kouril EGI CSIRT Digital Forensics Methods to collect and analyze (digital) evidence Three basic phases Data collection, Analysis, Reporting Triage Various sources of information

307 views • 20 slides

FuncTracker Discovering Shared Code (to aid malware forensics) Presenter: Charles LeDoux

FuncTracker Discovering Shared Code (to aid malware forensics) Presenter: Charles LeDoux University of Louisiana at Lafayette Shifting Focus of Malware Research New focus is on forensics tasks Old question: What? New questions:

523 views • 19 slides

CSN08101 Digital Forensics Lecture 1A: Introduction to Forensics Lecture 1A: Introduction to

CSN08101 Digital Forensics Lecture 1A: Introduction to Forensics Lecture 1A: Introduction to Forensics Module Leader: Dr Gordon Russell Lecturers: Robert Ludwiniak Digital Forensics You will learn in this module: The principals of

1.09k views • 34 slides

Preventive Digital Forensics: Creating Preventive Digital Forensics Systems to Proactively

FloCon 2015 Conference January 15, 2015 Portland, Oregon Preventive Digital Forensics: Creating Preventive Digital Forensics Systems to Proactively Resolve Computer Security Incidents in Organizations JESUS RAMIREZ PICHARDO (PMP, GCFA,

333 views • 30 slides

Stealth Secrets of the Malware Ninjas By Nick Harbour Overview Intro Background Info

Stealth Secrets of the Malware Ninjas By Nick Harbour Overview Intro Background Info Malware Forensics and Incident Response Anti-Forensics Executables Stealth Techniques Live System Anti-Forensics Process

907 views • 76 slides

Teaching digital forensics in a large class Teaching forensics at of students UL FRI

Teaching digital forensics in a large class of students Teaching digital forensics in a large class Teaching forensics at of students UL FRI Generating customized disk images Gaper Fele-or University of Ljubljana, Faculty of

446 views • 23 slides

Introduction Why is the Study of Digital Forensics Relevant? What is Digital/Computer

Introduction to Digital Forensics Introduction Why is the Study of Digital Forensics Relevant? What is Digital/Computer Forensics? What do you Need for a Careers in Computer Digital Forensics? Educational Background

509 views • 29 slides

Fast and Generic Malware Triage Using openioc_scan Volatility Plugin TAKAHIRO HARUYAMA

Fast and Generic Malware Triage Using openioc_scan Volatility Plugin TAKAHIRO HARUYAMA (@CCI_FORENSICS) INTERNET INITIATIVE JAPAN INC. Digital Forensics Research Conference Europe 2015 Who am I? 2 Forensic Investigator & Malware

796 views • 27 slides

Digital Forensics Unraveling Incidents one byte at a time Digital Forensics Characteristics of

Digital Forensics Unraveling Incidents one byte at a time Digital Forensics Characteristics of Digital Evidence: Admissible evidence must be related to the fact being proved Authentic evidence must be real and related to the

1.13k views • 68 slides

Digital Forensics: A Cybersecurity Approach Hector Rivera Basiru Mohammed Michael Marin Robert

Digital Forensics: A Cybersecurity Approach Hector Rivera Basiru Mohammed Michael Marin Robert Malegiannakis Ricardo Justiniano Introduction - What is Digital Forensics? Digital forensics defined - The process of recovering and interpreting

478 views • 30 slides

Image Forensics of High Dynamic Range Imaging 10th International Workshop on Digital-Forensics

Image Forensics of High Dynamic Range Imaging 10th International Workshop on Digital-Forensics & Watermarking P. J. Bateman, A. T. S. Ho, and J. A. Briffa This research is sponsored by an EPSRC/Charteris CASE Award Image Forensics

703 views • 38 slides

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic 20/10/2011 r.ludwiniak@napier.ac.uk Lecture Objectives 1. History and definition of Digital Forensics 2. Context for an investigation 3. An overview of

1.04k views • 65 slides

Malware Detection in Memory Forensics: Current Issues and Challenges Ricardo J. Rodrguez

Malware Detection in Memory Forensics: Current Issues and Challenges Ricardo J. Rodrguez All wrongs reversed under CC-BY-NC-SA license rjrodriguez@unizar.es @RicardoJRdez www.ricardojrodriguez.es Dept. of Computer Science and

540 views • 40 slides

Challenges in Digital Forensic Research R.I. Ferguson ian.ferguson@abertay.ac.uk 2 minute

Challenges in Digital Forensic Research R.I. Ferguson ian.ferguson@abertay.ac.uk 2 minute intro to Digital Forensics Some challenges scale cloud the encryption boundary anti-forensics Digital Forensics in 2 mins

415 views • 7 slides

Massive Threading: Using GPUs to Increase the Performance of Digital Forensics Tools Lodovico

Massive Threading: Using GPUs to Increase the Performance of Digital Forensics Tools Lodovico Marziale, Golden G. Richard III, Vassil Roussev Me: Professor of Computer Science Co-founder, Digital Forensics Solutions golden@cs.uno.edu

489 views • 28 slides

HACKING PARIS 2014 EXTREME FORENSICS RELOADES 2Q /2014 Alvaro Alexander Soto Digital Forensics

HACKING PARIS 2014 EXTREME FORENSICS RELOADES 2Q /2014 Alvaro Alexander Soto Digital Forensics Lab Director HTCIA/ICFP/ACM/IEEE/ACIS/ISSA asoto@asoto.com INTENDED AUDIENCE Forensic lab directors / analysts - Law enforcement - Researchers -

568 views • 36 slides

Andrew Case Who Am I? Security Analyst at Digital Forensics Solutions Also perform wide

Linux Memory Analysis Workshop Session 1 Andrew Case Who Am I? Security Analyst at Digital Forensics Solutions Also perform wide ranging forensics investigations Volatility Developer Former Blackhat, SOURCE, and DFRWS speaker

1.64k views • 162 slides

Electronic Discovery Electronic Discovery & Digital Forensics & Digital Forensics

San Francisco Chapter San Francisco Chapter Electronic Discovery Electronic Discovery & Digital Forensics & Digital Forensics Robert Schperberg New New Federal Rule of Civil Procedures Federal Rule of Civil Procedures Also

654 views • 63 slides

Trends in Mobile Device Forensics Jonathan Rajewski, MS, CCE, CFE, CISSP, ENCE, TJFC Director -

8/29/2016 Trends in Mobile Device Forensics Jonathan Rajewski, MS, CCE, CFE, CISSP, ENCE, TJFC Director - Senator Leahy Center for Digital Investigation @jtrajewski Associate Professor - Digital Forensics | Cyber Security

344 views • 18 slides

Cloud Forensics ASEAN CSA Summit 2015 Bangkok, Thailand 11 12 June 2015 Dr Kim-Kwang Raymond

Cloud Forensics ASEAN CSA Summit 2015 Bangkok, Thailand 11 12 June 2015 Dr Kim-Kwang Raymond Choo The role of digital forensics in incident handling Sources of digital evidence: Any computing devices capable of storing electronic

527 views • 16 slides

Combating Malware in the age of APT SANS Digital Forensic and Incident Response Summit July 2010

Combating Malware in the age of APT SANS Digital Forensic and Incident Response Summit July 2010 Jason Garman CTO, Kyrus Technology New directions for malware Malicious code used in APT attacks are usually: Not sexy the

409 views • 24 slides

CERTs and Digital Forensics: The Need for Security Collaborations Among Regions Dr. Soranun

CERTs and Digital Forensics: The Need for Security Collaborations Among Regions Dr. Soranun Jiwasurat Division Director, Office of Security, ETDA 1 ThaiCERT: A Quick Glance A government funded unit, established in 2000 The first and

654 views • 22 slides