Using Hashing to Improve Volatile Memory Forensic Analysis
|
|
|
- Millicent Carroll
- 6 years ago
- Views:
Transcription
1 Using Hashing to Improve Volatile Memory Forensic Analysis American Academy of Forensic Sciences Annual Meeting February 21, 2008 AAron Walters Blake Matheny, LLC Center for Education and Research in Information Assurance and Security Doug White National Institute of Standards and Technology (NIST)
2 Disclaimer Trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology, nor does it imply that the products are necessarily the best available for the purpose. Statement of Disclosure This research is funded in part by the National Institute of Standards and Technology.
3 Digital Crime Scene Information systems Commission of crimes Contain evidence related to crimes Subject of crimes Complex crime scene (Carrier,2003) Not just a piece of evidence or substance Composed many types of evidence Thorough analysis Reconstruct crime scene 3
4 Consistent Picture 4
5 Runtime State Order of Volatility (RFC 3227) Data life expectancy Volatile state/active objects Ceases to exist when power is removed Valuable data (context) Volatile media trusted (pswds, keys, malware) Goals (Carrier, 2003): Minimize obtrusiveness Minimize trust Understand effects 5
6 Volatile Memory Analysis Entire contents of physical memory (RAM) Direct analysis of raw bit image Artifact persistance (Chow,2005) Advantages: Analysis does not depend on OS (trust) Reduce and simplify obtrusiveness (acquisition) Removes the active adversary (freeze state) Verifiable (3 rd Party: data and tools) Unconstrained analysis (raw data) Few trusted open resources (standard references) 6
7 Analysis Types Application Analysis Application Address Space Virtual Memory Analysis User Address Space Kernel Address Space Physical Memory Analysis Physical Address Space Swap 7
8 Current State of VMA Current analysis methods based on ad-hoc inference analyze less than 4% of volatile storage! 8
9 Relying on what we know Physical crime scene (Carrier,2003) Laws of Nature Familiarity and experience with physical world Digital environment Hardware and software Cryptographic hashes Mathematical transformation (data hash value) Uniquely identify known data Detect data modifications/corruptions 9
10 Hash Databases 10 File system analysis Databases of cryptographic file hashes Imported by forensic applications Origin and authenticity verifiable? National Software Reference Library (NIST) Archive of known and traceable software Reference Data Set (RDS) Over 13 Million signatures Can we leverage the NSRL to support VMA? Generate a standard reference data set? ~ 5 Million executables
11 Portable Executable (PE) Windows executable file format EXE, DLL, SYS Loaded into memory Laws of Software Defines set of allowable code Expected control flow graph (CFG) Find known aspects of executables in memory Reduce volume of data What is running (patches)? Evaluate runtime integrity (Petroni, 2004) Derive chain of trust (transitive) 11
12 Windows Loader Memory management Memory mapped (as needed) Section alignment/attributes Disk vs. memory Import Address Table (IAT) Library locations determined at runtime Overwrites IAT entries with actual addresses Base Relocations Addresses based on preferred load address List of locations that need to be modified Bits on disk Bits in memory 12
13 Disk vs. Memory reloc edata idata text Header Header Header Disk Memory Extract 13
14 Generating Hash Data Set Immutable sections of known executables Account for merged sections Imports, etc. Memory align sections Pages of memory Per page relocation templates Normalize relocations Hash on page boundaries! 14
15 Example Hash Information ( 0x1000* 0x1000*.text* 96f3b3ae3d51f09b08c1e da371b* fc26c a28aa6ad6e4ae1b4* [(21, 4), (55, 4), (76, 4), (95, 4), (147, 4), (189, 4), (240, 4), (340, 4), (462, 4), (532, 4), (546, 4), (573, 4), (581, 4), (626, 4), (644, 4), (678, 4), (696, 4), (767, 4), (815, 4), (824, 4), (893, 4), (916, 4), (973, 4), (1028, 4), (1110, 4), (1135, 4), (1147, 4), (1198, 4), (1236, 4), (1248, 4), (1289, 4), (1507, 4), (1547, 4), (1682, 4), (1692, 4), (1700, 4), (1706, 4), (1759, 4), (1784, 4), (1796, 4), (1801, 4), (1895, 4), (1940, 4), (2029, 4), (2081, 4), (2094, 4), (2100, 4), (2112, 4), (2125, 4), (2131, 4), (2209, 4), (2254, 4), (2295, 4), (2362, 4), (2379, 4), (2408, 4), (2444, 4), (2477, 4), (2555, 4), (2652, 4), (2693, 4), (2707, 4), (2735, 4), (2792, 4), (2825, 4), (2976, 4), (3027, 4), (3045, 4), (3081, 4), (3105, 4), (3194, 4), (3315, 4), (3353, 4), (3380, 4), (3398, 4), (3404, 4), (3450, 4), (3512, 4), (3556, 4), (3563, 4), (3577, 4), (3598, 4), (3610, 4), (3661, 4), (3672, 4), (3764, 4), (3856, 4), (3893, 4), (3908, 4), (3923, 4), (3940, 4), (3956, 4), (4003, 4), (4041, 4), (4068, 4), (4078, 4)] ) 15
16 Finding Known Memory Hash Templates O(M*N) M X? Physical Address Space N 16
17 Experimental Results Lab: Virtual machine introspection (Garfinkel,2003) Windows XP Professional with Service Pack 2 MSDN: :42:00 (UTC) 256 MB RAM 4,303 PE (99.1% RDS 2.19) Real: Sampled workstation Windows XP Professional with Service Pack 2 2 GB RAM 25,450 PE (52.3% RDS 2.19) Uptime: 7 days 1 hr 27 min (used: 1Y7M) 17
18 Virtual Machine Hash results 256 MB image 25% Known Zero Other
19 Real Machine Hash results 2 GB image >5% Known Zero Other
20 Malware A/V is becoming less effective (Bailey, 2007) ~6 months 66% detected Memory resident malware/modifications Unexpected control flow changes (rootkits) Anti-forensics/DLL Injection Verify in-memory code sections (Petroni,SVV,GMER) History vs. file system vs. trusted hash database Anchors of trust Deriving trust in other data structures (transitive) Stack/Heap/etc (Walters,2006;Petroni,2007) 20
21 eeye BootRootKit Undetected by majority of rootkit detectors 18 of 19 failed to detect! (Released: July 2005) Hooks ethfilterdprindicatereceivepacket Overwrites instructions with relative JMP Remote kernel backdoor! Trusted database of known hashes ndis.sys: PAGENDSE:0x b ec 83 ec e9 18 d5 fd ff 0xf9896b23 (05) e9 18d5fdff JMP 0xf
22 Deriving Trust Win2000 XP Vista Linux 22
23 Conclusion Volatile state is a critical component of the digital crime scene Build standard reference set (mimic loader) New public resource for VM analysts! Find known memory Detect malicious modifications Derive trust from a potentially compromised system Towards complete analysis... 23
24 THANK YOU! & 24
Intro to Memory Forensics with Volatility
Intro to Memory Forensics with Volatility Intro to Memory Forensics Welcome!! Let's make a great workshop! Chicolinux (a.k.a. Miguel Guirao) Intro to Memory Forensics Your computer will betray you! What
OS Security IV: Virtualization and Trusted Computing
1 OS Security IV: Virtualization and Trusted Computing Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab2 More questions? 3 Virtual machine monitor +-----------+----------------+-------------+
Memory Analysis. CSF: Forensics Cyber-Security. Part II. Basic Techniques and Tools for Digital Forensics. Fall 2018 Nuno Santos
Memory Analysis Part II. Basic Techniques and Tools for Digital Forensics CSF: Forensics Cyber-Security Fall 2018 Nuno Santos Previous classes Files, steganography, watermarking Source of digital evidence
Notes: Describe the architecture of your product. Please provide also which Database technology is used for case management and evidence management.
EF-1. All protocols used between the different components in the distributed architecture (management server, agents, database, forensic analyst system, etc) shall be encrypted and signed. EF-2. The Enterprise
S23: You Have Been Hacked, But Where s the Evidence? A Quick Intro to Digital Forensics Bill Pankey, Tunitas Group
S23: You Have Been Hacked, But Where s the Evidence? A Quick Intro to Digital Forensics Bill Pankey, Tunitas Group You Have Been Hacked, But Where s the Evidence? A Quick Intro to Digital Forensics Bill
Digital Forensics Lecture 01- Disk Forensics
Digital Forensics Lecture 01- Disk Forensics An Introduction to Akbar S. Namin Texas Tech University Spring 2017 Digital Investigations and Evidence Investigation of some type of digital device that has
escan for Windows: escan System Requirements
: escan System Requirements : escan Anti-Virus for Windows v11 Operating System: (Client) Windows 8 Family, Windows 7 Family, Windows Vista Family, Rollup patch 1 Other Requirements: Disk Space: 750 MB
Guide to Computer Forensics and Investigations Fourth Edition. Chapter 2 Understanding Computer Investigations
Guide to Computer Forensics and Investigations Fourth Edition Chapter 2 Understanding Computer Investigations Objectives Explain how to prepare a computer investigation Apply a systematic approach to an
Windows Forensics Advanced
Windows Forensics Advanced Index: CF102 Description Windows Forensics - Advanced is the next step for forensics specialists, diving deeper into diverse processes on Windows OS serving computer investigators.
Digital Forensics Lecture 02- Disk Forensics
Digital Forensics Lecture 02- Disk Forensics Hard Disk Data Acquisition Akbar S. Namin Texas Tech University Spring 2017 Analysis of data found on a storage device It is more common to do dead analysis
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
Operating System Security
Operating System Security Operating Systems Defined Hardware: I/o...Memory.CPU Operating Systems: Windows or Android, etc Applications run on operating system Operating Systems Makes it easier to use resources.
Introduction to Computer Forensics
Introduction to Computer Forensics Subrahmani Babu Scientist- C, Computer Forensic Laboratory Indian Computer Emergency Response Team (CERT-In) Department of Information Technology, Govt of India. babu_sivakami@cert-in.org.in
Key Threats Melissa (1999), Love Letter (2000) Mainly leveraging social engineering. Key Threats Internet was just growing Mail was on the verge
Key Threats Internet was just growing Mail was on the verge Key Threats Melissa (1999), Love Letter (2000) Mainly leveraging social engineering Key Threats Code Red and Nimda (2001), Blaster (2003), Slammer
Cisco Networking Academy CCNA Cybersecurity Operations 1.1 Curriculum Overview Updated July 2018
Cisco Networking Academy CCNA Cybersecurity Operations 1.1 Curriculum Overview Updated July 2018 Cybersecurity Opportunities Cybercrime Costs Security Spending Cybersecurity Ventures: Cybersecurity Market
Kevin Butler Stephen McLaughlin Thomas Moyer Patric McDaniel. Presented by Xiao, Yuan November 10, 2010
Kevin Butler Stephen McLaughlin Thomas Moyer Patric McDaniel Presented by Xiao, Yuan November 10, 2010 SwitchBlade architecture provides isolation for multiple OSs running on a machine by confining them
Monitoring Hypervisor Integrity at Runtime. Student: Cuong Pham PIs: Prof. Zbigniew Kalbarczyk, Prof. Ravi K. Iyer ACC Meeting, Oct 2015
Monitoring Hypervisor Integrity at Runtime Student: Cuong Pham PIs: Prof. Zbigniew Kalbarczyk, Prof. Ravi K. Iyer ACC Meeting, Oct 2015 Motivation - Server Virtualization Trend x86 servers were virtualized
Procedures for a Harmonised Digital Forensic Process in Live Forensics
Procedures for a Harmonised Digital Forensic Process in Live Forensics George Sibiya 1, H. S. Venter 2 and Thomas Fogwill 1 Meraka Institute CSIR 1, P. O. Box 395, Pretoria, 0001 Tel: +27 12 841 3976 and
FIRST RESPONDER FORENSICS
FIRST RESPONDER FORENSICS or Can I Pull the Plug Now? Mick Walsh Special Agent United States Secret Service Miami Electronic Crimes Task Force THE U.S. SECRET SERVICE Created in 1865 at the end of the
COMPUTER FORENSICS (CFRS)
Computer Forensics (CFRS) 1 COMPUTER FORENSICS (CFRS) 500 Level Courses CFRS 500: Introduction to Forensic Technology and Analysis. 3 credits. Presents an overview of technologies of interest to forensics
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems Section 1: Command Line Tools Skill 1: Employ commands using command line interface 1.1 Use command line commands to gain situational
Information Security Policy
April 2016 Table of Contents PURPOSE AND SCOPE 5 I. CONFIDENTIAL INFORMATION 5 II. SCOPE 6 ORGANIZATION OF INFORMATION SECURITY 6 I. RESPONSIBILITY FOR INFORMATION SECURITY 6 II. COMMUNICATIONS REGARDING
Reconstructing the Scene of the Crime
Reconstructing the Scene of the Crime Who are they? STEVE DAVIS PETER SILBERMAN Security Consultant / Researcher at MANDIANT Engineer / Researcher at MANDIANT Agenda ½ Demo Pop it like its hotttt Problem
Advanced Systems Security: New Threats
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI)
Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI) Duration: 5 days You Will Learn How To Understand how perimeter defenses work Scan and attack you own networks, without actually harming
Towards High Assurance Networks of Virtual Machines
Towards High Assurance Networks of Virtual Machines Fabrizio Baiardi 1 Daniele Sgandurra 2 1 Polo G. Marconi - La Spezia, University of Pisa, Italy 2 Department of Computer Science, University of Pisa,
Web Gateway Security Appliances for the Enterprise: Comparison of Malware Blocking Rates
Web Gateway Security Appliances for the Enterprise: Comparison of Malware Blocking Rates A test commissioned by McAfee, Inc. and performed by AV-Test GmbH Date of the report: December 7 th, 2010 (last
CDSA Program Update SECURITY. Graham Bird. opengroup.org (650)
CDSA Program Update SECURITY Graham Bird g.bird@opengroup opengroup.org (650) 323 7992 Agenda Product Standards The Open Brand program Diffusion Schedules Q&A Product Standards Product Standards Real World
Firewall Antivirus For Windows Xp Avast 2012 With Key
Firewall Antivirus For Windows Xp Avast 2012 With Key Provides also antispam and firewall protection from latest internet threats. You need at least Windows XP (with SP2) installed. Windows Vista, 7, 8,
Reduce the Breach Detection Gap to Minutes. What is Forensic State Analysis (FSA)?
Reduce the Breach Detection Gap to Minutes Whether cloud-hosted or situated on premise, Cyber Threat Hunting as a Service is an essential and complimentary addition to any organization serious about security.
Hypervisor Support for Identifying Covertly Executing Binaries
Hypervisor Support for Identifying Covertly Executing Binaries Lionel Litty H. Andrés Lagar-Cavilla Dept. of Computer Science University of Toronto {llitty,andreslc}@cs.toronto.edu David Lie Dept. of Elec.
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by behavior-based threat detection and intelligent automation.
Space Traveling across VM
Space Traveling across VM Automatically Bridging the Semantic-Gap in Virtual Machine Introspection via Online Kernel Data Redirection Yangchun Fu, and Zhiqiang Lin Department of Computer Sciences The University
Windows Memory Analysis. Jesse Kornblum
C Y B E R S E C T O R Windows Memory Analysis Jesse Kornblum Why Memory Analysis Windows without Windows Gathering Information Parsing the Processes The Rootkit Paradox Address Translation Recovering Executables
Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/
by Chirath De Alwis Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/ Forensic Toolkit or FTK is a computer forensics software product made by AccessData.
ARM Security Solutions and Numonyx Authenticated Flash
ARM Security Solutions and Numonyx Authenticated Flash How to integrate Numonyx Authenticated Flash with ARM TrustZone* for maximum system protection Introduction Through a combination of integrated hardware
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by machine learning and intelligent automation. By rethinking
NIST Standards. October 14, 2016 Steve Konecny
NIST Standards October 14, 2016 Steve Konecny Overview Function Category Subcategory RS.AN 1: Notifications from detection systems are investigated RESPOND (RS) Analysis (RS.AN) Analysis is conducted to
APPLICATION WHITELISTING: APPROACHES AND CHALLENGES
APPLICATION WHITELISTING: APPROACHES AND CHALLENGES Himanshu Pareek, Sandeep Romana and P R L Eswari Centre for Development of Advanced Computing, Hyderabad, India {himanshup, sandeepr, prleswari}@cdac.in
Tupelo Whole Disk Acquisition, Storage and Search
Tupelo Whole Disk Acquisition, Storage and Search Stuart Maclean Center for Environmental and Information Systems Applied Physics Laboratory University of Washington stuart@apl.washington.edu Open Source
NCIRC Security Tools NIAPC Submission Summary Encase Enterprise Edition
NCIRC Security Tools NIAPC Submission Summary Encase Enterprise Edition Document Reference: Security Tools Internal NIAPC Submission NIAPC Category: Forensics Date Approved for Submission: 24-04-2007 Evaluation/Submission
Malware Behavior. Chapter 11
Malware Behavior Chapter 11 Common Malware Functionalities Downloaders Backdoors Credential stealers Persistence mechanisms Privilege escalation Covering tracks (rootkits) Downloaders and Launchers Retrieve
SaaS Flyer for Trend Micro
SaaS Flyer for Trend Micro Prices Effective July 1, 2008 1 Internet Security 2008 Trend Micro Internet Security 2008 makes it easy to protect your home or small business network, personal identity, and
RightNow May 08 Workstation Specifications
RightNow May 08 Workstation Specifications To maximize the performance of RightNow May 08 staff members and customers, we recommend the following workstation hardware configurations, operating systems,
Forensics Challenges. Windows Encrypted Content John Howie CISA CISM CISSP Director, Security Community, Microsoft Corporation
Forensics Challenges Windows Encrypted Content John Howie CISA CISM CISSP Director, Security Community, Microsoft Corporation Introduction Encrypted content is a challenge for investigators Makes it difficult
User Guide. This user guide explains how to use and update Max Secure Anti Virus Enterprise Client.
User Guide This user guide explains how to use and update Max Secure Anti Virus Enterprise Client. Copyright 2002-2016 Max Secure Software. All rights reserved. Contents 2 Contents Introduction... 3 System
OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE
OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE I. Description of Course: 1. Department/Course: CNET - 174 2. Title: Computer Forensics 3. Cross Reference: 4. Units: 3 Lec Hrs:
White Paper Digital Evidence Preservation and Distribution: Updating the Analog System for the Digital World July 2011
White Paper Digital Evidence Preservation and Distribution: Updating the Analog System for the Digital World July 2011 I. Introduction A majority of crimes committed today have a digital component, and
Tanium Endpoint Detection and Response. (ISC)² East Bay Chapter Training Day July 13, 2018
Tanium Endpoint Detection and Response (ISC)² East Bay Chapter Training Day July 13, 2018 $> WhoamI 11 Years of Security Experience Multiple Verticals (Technology, Industrial, Healthcare, Biotech) 9 Years
One Ring to Rule them All
One Ring to Rule them All A primer on virtualization enhanced security @SimonCrosby Co-founder & CTO Introduction We use micro-virtualization to secure endpoints We serve enterprises and government agencies
Ceedo Client Family Products Security
ABOUT THIS DOCUMENT Ceedo Client Family Products Security NOTE: This document DOES NOT apply to Ceedo Desktop family of products. ABOUT THIS DOCUMENT The purpose of this document is to define how a company
RightNow August 08 Workstation Specifications
RightNow August 08 Workstation Specifications To maximize the performance of RightNow August 08 staff members and customers, we recommend the following workstation hardware configurations, operating systems,
COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9
COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9 Course Code: 3401 Prepare for the CHFI certification while learning advanced forensics investigation techniques. EC-Council released the most advanced computer
Creating a Virtual Machine
CurrentH1 411 APPENDIX C Creating a Virtual Machine This appendix shows how I created a virtual machine (VM) in which I then installed Windows Server 2003 R2 (and later WSS 3.0). Initially, Hour 2, Installing
Training for the cyber professionals of tomorrow
Hands-On Labs Training for the cyber professionals of tomorrow CYBRScore is a demonstrated leader in professional cyber security training. Our unique training approach utilizes immersive hands-on lab environments
An Introduction to Incident Detection and Response Memory Forensic Analysis
An Introduction to Incident Detection and Response Memory Forensic Analysis Alexandre Dulaunoy - TLP:WHITE a@foo.be February 11, 2016 An overview to incident response Detection Analysis Containment Investigation
A Road Map for Digital Forensic Research
1 Outline of Today s Lecture! A Road Map for Digital Forensic Research o Report from the 1 st Digital Forensic Research Workshop (DFRWS) 2001! Defining Digital Forensic Examination and Analysis Tools o
Live Attack Visualization and Analysis. What does a Malware attack look like?
Live Attack Visualization and Analysis What does a Malware attack look like? Introduction Bromium is a virtualization pioneer whose micro-virtualization technology delivers dependable, secure and manageable
BlackVault Hardware Security Platform SECURE TRUSTED INTUITIVE. Cryptographic Appliances with Integrated Level 3+ Hardware Security Module
BlackVault Hardware Security Platform SECURE TRUSTED INTUITIVE Cryptographic Appliances with Integrated Level 3+ Hardware Security Module The BlackVault hardware security platform keeps cryptographic material
Android Bootloader and Verified Boot
Android Bootloader and Verified Boot Lecture 7 Security of Mobile Devices 2018 SMD Android Bootloader and Verified Boot, Lecture 7 1/38 Bootloader Recovery Verified Boot Bibliography SMD Android Bootloader
TPM v.s. Embedded Board. James Y
TPM v.s. Embedded Board James Y What Is A Trusted Platform Module? (TPM 1.2) TPM 1.2 on the Enano-8523 that: How Safe is your INFORMATION? Protects secrets from attackers Performs cryptographic functions
TZWorks Trace Event Log Analysis (tela) Users Guide
TZWorks Trace Event Log Analysis (tela) Users Guide Abstract tela is a command-line tool that parses Windows Trace Log files into CSV type records. Other capabilities: include generating statistics on
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG Table of contents Introduction Binary Disassembly Return Address Defense Prototype Implementation Experimental Results Conclusion Buffer Over2low Attacks
Next Generation Endpoint Security Confused?
SESSION ID: CEM-W06 Next Generation Endpoint Security Confused? Greg Day VP & Chief Security Officer, EMEA Palo Alto Networks @GreDaySecurity Brief Intro Questions we will answer Do I need a new (NG) endpoint
Forensics for Cybersecurity. Pete Dedes, CCE, GCFA, GCIH
Forensics for Cybersecurity Pete Dedes, CCE, GCFA, GCIH WHO AM I? Pete Dedes, Forensics Analyst, Sword & Shield Enterprise Security Education Bachelor s of Science Computer Science, University of Tennessee
RSA Enterprise Compromise Assessment Tool (ECAT) Date: January 2014 Authors: Jon Oltsik, Senior Principal Analyst and Tony Palmer, Senior Lab Analyst
ESG Lab Review RSA Enterprise Compromise Assessment Tool (ECAT) Date: January 2014 Authors: Jon Oltsik, Senior Principal Analyst and Tony Palmer, Senior Lab Analyst Abstract: This ESG Lab review documents
INFLUENTIAL OPERATING SYSTEM RESEARCH: SECURITY MECHANISMS AND HOW TO USE THEM CARSTEN WEINHOLD
Faculty of Computer Science Institute of Systems Architecture, Operating Systems Group INFLUENTIAL OPERATING SYSTEM RESEARCH: SECURITY MECHANISMS AND HOW TO USE THEM CARSTEN WEINHOLD OVERVIEW Fundamental
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 1 Operating System Quandary Q: What is the primary goal of
Azure Total Cost of Ownership (TCO) summary. Sample Report for Rehost Migration Scenario using Open Source Technologies (Linux & MySQL)
Azure Total Cost of Ownership (TCO) summary Sample Report for Rehost Migration Scenario using Open Source Technologies (Linux & MySQL) Assumptions and inputs Compute Physical servers Networking Outbound
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
Scientific Working Groups on Digital Evidence and Imaging Technology
SWGDE/SWGIT Guidelines & Recommendations for Training in Digital & Multimedia Evidence Disclaimer: As a condition to the use of this document and the information contained therein, the SWGDE/SWGIT request
CaseWare Working Papers Getting Started Guide. For Working Papers
CaseWare Working Papers Getting Started Guide For Working Papers 2014.00 Copyright and Trademark Notice Copyright. 2013 CaseWare International Inc. ("CWI"). All Rights Reserved. Use, duplication, or disclosure
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
UNCLASSIFIED R-1 ITEM NOMENCLATURE FY 2013 OCO
Exhibit R-2, RDT&E Budget Item Justification: PB 2013 Office of Secretary Of Defense DATE: February 2012 0400: Research,, Test & Evaluation, Defense-Wide BA 3: Advanced Technology (ATD) COST ($ in Millions)
This version has been archived. Find the current version at on the Current Documents page. Archived Version. Capture of Live Systems
Scientific Working Group on Digital Evidence Capture of Live Systems Disclaimer: As a condition to the use of this document and the information contained therein, the SWGDE requests notification by e-mail
Introducing MVISION. Cohesive Cloud-based Management of Threat Countermeasures and Devices Leveraging Built-in Device Controls. Jon Parkes.
Introducing MVISION Cohesive Cloud-based Management of Threat Countermeasures and Devices Leveraging Built-in Device Controls Jon Parkes McAfee 1 All information provided here is subject to non-disclosure
Symantec & Blue Coat Technical Update Webinar 29. Juni 2017
Avantec Blue Coat/Symantec Webinar Jean Marc Edder Senior Systems Engineer The Global Leader in Cyber Network + + Cloud Global market leader in Endpoint, Email, Data Loss Prevention and Website, User Authentication
TZWorks Portable Executable Scanner (pescan) Users Guide
TZWorks Portable Executable Scanner (pescan) Users Guide Abstract pescan is a standalone, command-line tool that scans portable executable (PE) files and identifies how they were constructed and if they
Recommended Hardware & Software Requirements for Installing Invu Document Management
Recommended Hardware & Software Requirements for Installing Invu Document Management Hardware & Software Requirements for 6.9 Page 1 of 7 Contents Recommended Hardware Requirements - Single Server, Single
Azure Total Cost of Ownership (TCO) summary. Sample Report for Data Center Migration (Windows and Linux servers)
Azure Total Cost of Ownership (TCO) summary Sample Report for Data Center Migration (Windows and Linux servers) Assumptions and inputs Compute Physical servers Networking Outbound bandwidth (GB)/Month
TERRA. Boneh. A virtual machine-based platform for trusted computing. Presented by: David Rager November 10, 2004
TERRA Authored by: Garfinkel,, Pfaff, Chow, Rosenblum,, and Boneh A virtual machine-based platform for trusted computing Presented by: David Rager November 10, 2004 Why there exists a need Commodity OS
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner ACCREDITATIONS EXAM INFORMATION The Certified Digital Forensics Examiner exam is taken online through Mile2 s Assessment and Certification System ( MACS ), which is
Hunting Adversaries with "rastrea2r" and Machine Learning
Hunting Adversaries with "rastrea2r" and Machine Learning Gabriel Infante-Lopez, @gainlo Ismael Valenzuela, @aboutsecurity SANS SOC Summit 2017 Crystal City, VA 1 How do we investigate? Results of a survey
Memory Grabber Computer Forensic Volatile Memory Acquisition and Analysis System
Memory Grabber Computer Forensic Volatile Memory Acquisition and Analysis System White Paper 6 May 2010 Prepared By: Jim Costabile Systems Research and Applications Corporation 8830 Stanford Blvd., Suite
Guide Series. How to upgrade to Microsoft Windows 10? Guide Series
How to upgrade to Microsoft Windows 10? Acuutech All rights reserved 2016 1 Contents Introduction... 2 Why use Windows 10?... 3 What are the advantages of Windows 10?... 4 Windows 10 editions comparison...
Pimp My PE: Parsing Malicious and Malformed Executables. Virus Bulletin 2007
Pimp My PE: Parsing Malicious and Malformed Executables Virus Bulletin 2007 Authors Sunbelt Software, Tampa FL Anti-Malware SDK team: Casey Sheehan, lead developer Nick Hnatiw, developer / researcher Tom
MEMORY ANALYSIS: UNDERSTANDING MALWARES AND INCIDENTS THROUGH THE MEMORY
MEMORY ANALYSIS: UNDERSTANDING MALWARES AND INCIDENTS THROUGH THE MEMORY National Congress of Criminalistics 2017 By Alexandre Borges http://www.blackstormsecurity.com 1 PROFILE AND TOC TOC: Malware and
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
Yuki Ashino, Keisuke Fujita, Maiko Furusawa, Tetsutaro Uehara and Ryoichi Sasaki
Chapter 10 IMPLEMENTING BOOT CONTROL FOR WINDOWS VISTA Yuki Ashino, Keisuke Fujita, Maiko Furusawa, Tetsutaro Uehara and Ryoichi Sasaki Abstract A digital forensic logging system must prevent the booting
Best practices with Snare Enterprise Agents
Best practices with Snare Enterprise Agents Snare Solutions About this document The Payment Card Industry Data Security Standard (PCI/DSS) documentation provides guidance on a set of baseline security
Flash Drive Won T Mount Windows 7 Won't Recognize
Flash Drive Won T Mount Windows 7 Won't Recognize So after inserting the flash drive, if I go to Start _ Computer, I won't see anything there for Windows 7 Professional doesn't mount my usb flash drive
MIGRATING FROM WINDOWS XP
MIGRATING FROM WINDOWS XP WHAT S THE PROBLEM WITH XP? Microsoft is no longer providing security updates for XP after April 8, 2014 After this date, Microsoft Security Essentials (MSE) for XP will no longer
Securing the Frisbee Multicast Disk Loader
Securing the Frisbee Multicast Disk Loader Robert Ricci, Jonathon Duerig University of Utah 1 What is Frisbee? 2 Frisbee is Emulab s tool to install whole disk images from a server to many clients using
Credant CmgCryptoLib Version 1.7 Credant Cryptographic Kernel Version 1.5 FIPS Non-Proprietary Security Policy, Version 1.7 Level 1 Validation
Credant CmgCryptoLib Version 1.7 Credant Cryptographic Kernel Version 1.5 FIPS 140-2 Non-Proprietary Security Policy, Version 1.7 Level 1 Validation October 2007 1. INTRODUCTION 3 2. PRODUCT, BOUNDARY,
Operating System Specification Mac OS X Snow Leopard (10.6.0) or higher and Windows XP (SP3) or higher
BlackLight is a multi-platform forensic analysis tool that allows examiners to quickly and intuitively analyze digital forensic media. BlackLight is capable of analyzing data from Mac OS X computers, ios
Symantec Endpoint Protection
The next generation of antivirus technology from Overview Advanced threat protection combines AntiVirus with advanced threat prevention to deliver an unmatched defense against malware for laptops, desktops,
Hughes Network Systems, LLC Hughes Crypto Kernel Firmware Version: FIPS Non-Proprietary Security Policy
Hughes Network Systems, LLC Hughes Crypto Kernel Firmware Version: 3.1.0.4 FIPS 140-2 Non-Proprietary Security Policy FIPS Security Level: 1 Document Version: 0.5 Prepared for: Prepared by: Hughes Network
Matthieu Suiche Founder, MoonSols SARL
Matthieu Suiche Founder, MoonSols SARL msuiche@moonsols.com Founder of MoonSols SARL, based in France Various security services, Forensics Products, Trainings, Kernel code consulting Co-Organizer of Hackito
IBM Proventia Management SiteProtector Installation Guide
IBM Internet Security Systems IBM Proventia Management SiteProtector Installation Guide Version2.0,ServicePack8.1 Note Before using this information and the product it supports, read the information in