hbps://github.com/k2 (Un) Fucking Forensics Ac#ve/Passive memory hacking/debugging K2 /
|
|
|
- Trevor Casey
- 6 years ago
- Views:
Transcription
1 hbps://github.com/k2 (Un) Fucking Forensics Ac#ve/Passive memory hacking/debugging K2 /
2 About me? Hacker for a while invtero.net Memory analysis framework for Windows Super fast/gbps throughput Memory integrity checking of VM s/crashdumps/memory Type aware memory hacking tool EhTrace Binary trace tool Uses hook/patch-less technique for in-process debugging Lots of other stuff
3 Outline / areas How to forensic, how to Fuck forensics and how to un fuck it. Intx80 AF technique on header wipe/non-resident code/trim() How to deal with that RoP background, how it s used in abacks Gargoyle abacks & how to protect against them CloudLeech twist on UlfFrisk DMA abacks / PCILeech Demo of open source memory integrity pla_orm for Windows!
4 In general: Determine what happened. Make a!meline of known events. Can you even forensic? Ar!facts disk & memory (ocen incomplete/ fragmented) used to build #meline. How good can we do? How do we know if were done?
5 Time stamps from all sources to derive!meline (event logs/syslog/firewall/filesystem #me, etc ) Ar>fact sources How aaestable are they? Wevtu!l - Windows Events Command Line U#lity. Configure more than 1189 event log sources SysMon (from SysInternals/Mark Russinovich) / neat config: hbps://github.com/swiconsecurity/sysmon-config Linux (osquery hbps://github.com/facebook/osquery )
6 Handling memory Forensics meets Reverse Engineering Dump / disassemble determine what the extent of capability the a8acker possesses I want to at least clear this guy out & find out how much damage he did Vola#lity/Rekall python forensic engines Stephen Ridley s RE memory hacking tool: hbps://github.com/s7ephen/sandkit Paper: Escaping the sandbox GAME HACKING! J Let s look at what people do to cheat some#me?
7 How to F it? Hide really well Wipe/Destroy logging/leave no trace/stenography/encrypt Misdirect Flood/Annoy/Make analysis so costly$$$/obfuscate/spoof/ Direct ABack DefCon 15: Breaking Forensics Socware: Weaknesses in Cri#cal Evidence Collec#on Chris Palmer, Alex Stamos
8 An#-forensics: Furthering digital forensic science through a new extended, granular taxonomy:
9 Foreshadowing: normalize you re opera>ons A great way to operate undetected is to ensure you are not an anomaly. Use the resources of you re target to conduct you re opera#ons. Configura#on abacks Enable IPV6 tunneling & VPN access ABacker has trusted CA capability (added their privkey to trusted list) The more normal the method will be very hard to dig up
10 Int0x80 s AF counter ABack against a tool: Rekall Prevent dumping for working More ways to get it; Use VAD (kernel source) Use PageTable (ABI) Use invtero.net dump.py - VADDump (VAD) or Dump (PageTable)
11 RoP: More normal RoP is an ocen discussed topic used mostly for exploita#on RoP uses the CPU stack seman#cs to execute as if it were a really large set of return statements. This uses the code that s already on the system more normalized than if you had to inject an executable payload that did not originate from the target RoP is used by Gargoyle (Josh Lospinoso) as an example of a persistence technique that evades memory analysis systems There is hope, we can detect RoP abacks through call chain evalua#on
12 RoP is not perfect hbps://
13 Gargoyle persistence Leverages a #mer and blocking wait that moves it into the ac#ve state Once ac#ve, stages page protec#on +X Then uses this page to invoke it s primary payload It then mask s the +X bit back off and goes inac#ve
14 Tools too defend against RoP aaack? Analysis: ROPEMU: A Framework for the Analysis of Complex Code- Reuse ABacks Dump a complex RoP execu#on trace into an ELF!! Wow! Detec#on: invtero.net can perform a stack checking func#on against the memory dump. Similar tools for monitoring RoP at run #me (EhTrace, RoPGuard, etc ) From the invtero output, you really do NOT want to see the Gargoyle gadget, or anything that looks like a stack pivot
15 Injec>on techniques Many variega#ons to achieve the same goal; 10 Process Injec#on Techniques (Ashkan Hosseini/Endgame) LoadLibrary, Hallowing, Thread hijacking, Windows Hooks, Registry keys, APC, SetWindowLong, Shims & IAT shims Flame was a sort of hallowing aback hid inside of ntdll, remained undetected for years
16 Enter DMA with PCILeech Ulf Frisk Direct-Memory-ABack-the-Kernel: PCILeech abacks and u#lity for forensics (memory) collec#on Uses a variety of (very cool) techniques to execute payloads One of the simplest is the unlock func#onality It s an inline patch however Hard to detect w/o manual reversing
17 Integrity valida>on Full valida#on at any point in #me must be able to be conducted System state should/must be sta#c CPU execu#on will allow abackers to play games / evade read s RDMA LiveMigra#on / Snapshowng
18 Tie it together Un F d Memory Forensics Remove the guesswork Leverage wide range of informa#on sources Have a comprehensive global view of the data set Appropriate countermeasures for most abackers (RoP) Integrity checking of memory (in line patch protec#on) Symbols and context for analysis of pointers Pointer tracking becomes more significant as we can qualify their address/vector
19 Demo s & Thank you Check out the tools Github.com/K2
Care & Feeding of Programmers: Addressing App Sec Gaps using HTTP Headers. Sunny Wear OWASP Tampa Chapter December
Care & Feeding of Programmers: Addressing App Sec Gaps using HTTP Headers Sunny Wear OWASP Tampa Chapter December Mee@ng 1 About the Speaker Informa@on Security Architect Areas of exper@se: Applica@on,
Advances in Linux process forensics with ECFS
Advances in Linux process forensics with ECFS Quick history Wanted to design a process snapshot format native to VMA Vudu http://www.bitlackeys.org/#vmavudu ECFS proved useful for other projects as well
Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem
Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem Anthony Lineberry anthony.lineberry@gmail.com Black Hat Europe 2009 Overview What is a rootkit? Why is protec:on difficult? Current protec:on
RoP Hooks.
RoP Hooks Shane.Macaulay@IOACTIVE.com Introduction K2 / ktwo@ktwo.ca Shane.Macaulay @ioactive.com Intro/Outline Hooking/Tracing What is a binary doing? Can we modify/detour Frustrations/Hurdles Friendly
Eight ou two eleven. Dynamic inspec5on of Broadcom Wi- Fi cards on mobile devices. Ma5as Eissler HITBAMS2015
Eight ou two eleven Dynamic inspec5on of Broadcom Wi- Fi cards on mobile devices Ma5as Eissler HITBAMS2015 Agenda Overview of Broadcom Wi- Fi NiC mobile devices Architecture ALack surface & possibili5es
Managed. Code Rootkits. Hooking. into Runtime. Environments. Erez Metula ELSEVIER. Syngress is an imprint of Elsevier SYNGRESS
Managed Code Rootkits Hooking into Runtime Environments Erez Metula ELSEVIER AMSTERDAM BOSTON HEIDELBERG LONDON NEWYORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO Syngress is an imprint
SELF-AWARE APPLICATIONS AUTOMATIC PRODUCTION DIAGNOSIS DINA GOLDSHTEIN
SELF-AWARE APPLICATIONS AUTOMATIC PRODUCTION DIAGNOSIS DINA GOLDSHTEIN Agenda Motivation Hierarchy of self-monitoring CPU profiling GC monitoring Heap analysis Deadlock detection 2 Agenda Motivation Hierarchy
The X86 Assembly Language Instruction Nop Means
The X86 Assembly Language Instruction Nop Means As little as 1 CPU cycle is "wasted" to execute a NOP instruction (the exact and other "assembly tricks", as explained also in this thread on Programmers.
SCALE 15x (c) 2017 Ty Shipman
Please view my linked-in page (under See more) to get a copy of this presenta
AppSpear: Bytecode Decryp0ng and DEX Reassembling for Packed Android Malware
AppSpear: Bytecode Decryp0ng and DEX Reassembling for Packed Android Malware Yang Wenbo, Zhang Yuanyuan, Li Juanru, Shu Junliang, Li Bodong, Hu Wenjun, Gu Dawu Sudeep Nanjappa Jayakumar Agenda Introduc0on
HITB Amsterdam
Closer to metal: Reverse engineering the Broadcom NetExtreme s firmware Guillaume Delugré Sogeti / ESEC R&D guillaume(at)security-labs.org HITB 2011 - Amsterdam Purpose of this presentation G. Delugré
C O N t E N t s I N D E ta I l FORewORd by dr. Jared demott acknowledgments xvii introduction xix PaRT 1 TOOLS OF THe TRade
Foreword by Dr. Jared DeMott xv Acknowledgments xvii Introduction Prerequisites for the Reader...xx A Brief Game Hacking History....xx Why Hack Games?... xxi How This Book Is Organized...xxii About the
A Security Microcosm Attacking and Defending Shiva
A Security Microcosm Attacking and Defending Shiva Shiva written by Neel Mehta and Shaun Clowes Presented by Shaun Clowes shaun@securereality.com.au What is Shiva? Shiva is an executable encryptor Encrypted
Token Kidnapping. Cesar Cerrudo Argeniss
Token Kidnapping Cesar Cerrudo Argeniss Who am I? Argeniss Founder and CEO I have been working on security for 7 years I have found and helped to fix hundreds of vulnerabilities in software such as MS
SQL Injec*on. By Robin Gonzalez
SQL Injec*on By Robin Gonzalez Some things that can go wrong Excessive and Unused Privileges Privilege Abuse Input Injec>on Malware Week Audit Trail Other things that can go wrong Storage Media Exposure
SQLite with a Fine-Toothed Comb. John Regehr Trust-in-So1 / University of Utah
SQLite with a Fine-Toothed Comb John Regehr Trust-in-So1 / University of Utah Feasible states for a system we care about No execu
Shuffler: Fast and Deployable Continuous Code Re-Randomization
Shuffler: Fast and Deployable Continuous Code Re-Randomization David Williams-King, Graham Gobieski, Kent Williams-King, James P. Blake, Xinhao Yuan, Patrick Colp, Michelle Zheng, Vasileios P. Kemerlis,
Easy and quick vulnerability hun5ng in Windows. Cesar Cerrudo CTO at IOAc5ve Labs
Easy and quick vulnerability hun5ng in Windows Cesar Cerrudo CTO at IOAc5ve Labs 1 Who am I? CTO at IOAc5ve Labs Leading efforts to produce cufng edge research I have been working on security for +9 years
Memory Analysis. CSF: Forensics Cyber-Security. Part II. Basic Techniques and Tools for Digital Forensics. Fall 2018 Nuno Santos
Memory Analysis Part II. Basic Techniques and Tools for Digital Forensics CSF: Forensics Cyber-Security Fall 2018 Nuno Santos Previous classes Files, steganography, watermarking Source of digital evidence
Top 10 Web Application Vulnerabilities
Top 10 Web Application Vulnerabilities Why you should care about them plus a live hacking demo!! Why should you care?! Insecure so*ware is undermining our financial, healthcare, defense, energy, and other
Pattern Recognition and Applications Lab WEB Security. Giorgio Giacinto.
Pattern Recognition and Applications Lab WEB Security Giorgio Giacinto giacinto@diee.unica.it Sicurezza Informa1ca, 2015-2016 Department of Electrical and Electronic Engineering University of Cagliari,
How to sleep *ght and keep your applica*ons running on IPv6 transi*on. The importance of IPv6 Applica*on Tes*ng
How to sleep *ght and keep your applica*ons running on IPv6 transi*on The importance of IPv6 Applica*on Tes*ng About this presenta*on It presents a generic methodology to test the IPv6 func*onality of
Exploi'ng Unpatched ios Vulnerabili'es for Fun and Profit
Exploi'ng Unpatched ios Vulnerabili'es for Fun and Profit Yeongjin Jang, Tielei Wang, Byoungyoung Lee, and Billy Lau Georgia Tech Informa;on Security Center (GTISC) 1 Scope of this Presenta;on The process
Reverse Engineering Malware Dynamic Analysis of Binary Malware II
Reverse Engineering Malware Dynamic Analysis of Binary Malware II Jarkko Turkulainen F-Secure Corporation Protecting the irreplaceable f-secure.com Advanced dynamic analysis Debugger scripting Hooking
CSE Opera+ng System Principles
CSE 30341 Opera+ng System Principles Lecture 3 Systems Structure Project 1 Intro CSE 30341 Opera+ng System Principles 2 1 Recap Last Lecture I/O Structure (I/O Interface, DMA) Storage and Memory Hierarchy
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
P4-based VNF and Micro-VNF chaining for servers with SmartNICs
P4-based VNF and Micro-VNF chaining for servers with SmartNICs David George david.george@netronome.com 1 Session Agenda Introduction Design overview A look under the hood P4, SandboxC and rules Run-through
10 Steps to Virtualization
AN INTEL COMPANY 10 Steps to Virtualization WHEN IT MATTERS, IT RUNS ON WIND RIVER EXECUTIVE SUMMARY Virtualization the creation of multiple virtual machines (VMs) on a single piece of hardware, where
Software Security II: Memory Errors - Attacks & Defenses
1 Software Security II: Memory Errors - Attacks & Defenses Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab1 Writeup 3 Buffer overflow Out-of-bound memory writes (mostly sequential) Allow
Verifiable Cloud Outsourcing for Network Func9ons (+ Verifiable Resource Accoun9ng for Cloud Services)
1 Verifiable Cloud Outsourcing for Network Func9ons (+ Verifiable Resource Accoun9ng for Cloud Services) Vyas Sekar vnfo joint with Seyed Fayazbakhsh, Mike Reiter VRA joint with Chen Chen, Petros Mania9s,
Lecture 4: Build Systems, Tar, Character Strings
CIS 330:! / / / / (_) / / / / _/_/ / / / / / \/ / /_/ / `/ \/ / / / _/_// / / / / /_ / /_/ / / / / /> < / /_/ / / / / /_/ / / / /_/ / / / / / \ /_/ /_/_/_/ _ \,_/_/ /_/\,_/ \ /_/ \ //_/ /_/ Lecture 4:
Malware
reloaded Malware Research Team @ @xabiugarte Motivation Design principles / architecture Features Use cases Future work Dynamic Binary Instrumentation Techniques to trace the execution of a binary (or
Rethinking Path Valida/on. Russ White
Rethinking Path Valida/on Russ White Reality Check Right now there is no US Government mandate to do anything A mandate in the origin authen9ca9on area is probably immanent A mandate in the path valida9on
General Pr0ken File System
General Pr0ken File System Hacking IBM s GPFS Felix Wilhelm & Florian Grunow 11/2/2015 GPFS Felix Wilhelm && Florian Grunow #2 Agenda Technology Overview Digging in the Guts of GPFS Remote View Getting
T Hands-on 2. User-mode debuggers OllyDbg
T-110.6220 Hands-on 2 User-mode debuggers OllyDbg Disassemblers vs debuggers Static analysis / Disassemblers Theoretic approach Give us a static view of the binary Example: IDA Dynamic analysis / Debuggers
Prac%cal Control Flow Integrity & Randomiza%on for Binary Executables
Prac%cal Control Flow Integrity & Randomiza%on for Binary Executables Chao Zhang Tao Wei Zhaofeng Chen Lei Duan Peking University Peking University UC Berkeley Peking University Peking University László
Defending Computer Networks Lecture 4: Exploit Defenses. Stuart Staniford Adjunct Professor of Computer Science
Defending Computer Networks Lecture 4: Exploit Defenses Stuart Staniford Adjunct Professor of Computer Science Logis;cs Course is now official Expect an email from Stephanie Meik with your PIN Need to
Stealth Measurements for Cheat Detection in On-line Games. Ed Kaiser Wu-chang Feng Travis Schluessler
Stealth Measurements for Cheat Detection in On-line Games Ed Kaiser Wu-chang Feng Travis Schluessler Cheating Affects On-line Games Frustrates legitimate players not fun to play against cheaters can't
Reconstructing the Scene of the Crime
Reconstructing the Scene of the Crime Who are they? STEVE DAVIS PETER SILBERMAN Security Consultant / Researcher at MANDIANT Engineer / Researcher at MANDIANT Agenda ½ Demo Pop it like its hotttt Problem
Con$nuous Integra$on Development Environment. Kovács Gábor
Con$nuous Integra$on Development Environment Kovács Gábor kovacsg@tmit.bme.hu Before we start anything Select a language Set up conven$ons Select development tools Set up development environment Set up
Important new NVMe features for optimizing the data pipeline
Important new NVMe features for optimizing the data pipeline Dr. Stephen Bates, CTO Eideticom Santa Clara, CA 1 Outline Intro to NVMe Controller Memory Buffers (CMBs) Use cases for CMBs Submission Queue
ETHICAL HACKING & COMPUTER FORENSIC SECURITY
ETHICAL HACKING & COMPUTER FORENSIC SECURITY Course Description From forensic computing to network security, the course covers a wide range of subjects. You will learn about web hacking, password cracking,
Objec&ves. Review: Security. Google s AI is wri&ng poetry SQL INJECTION ATTACK. SQL Injec&on. SQL Injec&on. Security:
Objec&ves Security: Ø Injec&on a6acks Ø Cross-site scrip&ng Ø Insecure direct object reference Group photo Review: Security Why has the Web become such a huge target? How can you protect against security
Con$nuous Deployment with Docker Andrew Aslinger. Oct
Con$nuous Deployment with Docker Andrew Aslinger Oct 9. 2014 Who is Andrew #1 So#ware / Systems Architect for OpenWhere Passion for UX, Big Data, and Cloud/DevOps Previously Designed and Implemented automated
CFRS : Kernel Forensics and Analysis
CFRS 775-001: Kernel Forensics and Analysis Computer Forensics Program (http://cfrs.gmu.edu) Department of Electrical and Computer Engineering (https://ece.gmu.edu/) Volgenau School of Engineering (http://volgenau.gmu.edu/)
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by machine learning and intelligent automation. By rethinking
Cisco Advanced Malware Protec3on
Cisco Advanced Malware Protec3on Malware is an ever- growing problem The Reality: Organiza3ons Are Under AAack 95% of large companies targeted by malicious traffic 100% of organiza3ons interacted with
IoT The gift that keeps on giving
IoT The gift that keeps on giving Contributors labs@bitdefender.com Radu Alexandru Basaraba - rbasaraba@bitdefender.com Alexandru Lazar allazar@bitdefender.com Mihai Moldovan - mimoldovan@bitdefender.com
Defending Computer Networks Lecture 13: More NIDS. Stuart Staniford Adjunct Professor of Computer Science
Defending Computer Networks Lecture 13: More NIDS Stuart Staniford Adjunct Professor of Computer Science Logis;cs HW2 48 hour extension to tomorrow midnight. HW3 Aiming to have it out next ;me Project
Actual4Test. Actual4test - actual test exam dumps-pass for IT exams
Actual4Test http://www.actual4test.com Actual4test - actual test exam dumps-pass for IT exams Exam : GCFW Title : GIAC Certified Firewall Analyst Vendors : GIAC Version : DEMO Get Latest & Valid GCFW Exam's
An introduction to the Katsuni theorem and its application to sandboxing and software emulation. Jonathan Brossard (Toucan System)
An introduction to the Katsuni theorem and its application to sandboxing and software emulation Jonathan Brossard (Toucan System) 25/09/2013 Who am I? - Security researcher, publishing since 2005. - Past
The Kernel Abstrac/on
The Kernel Abstrac/on Debugging as Engineering Much of your /me in this course will be spent debugging In industry, 50% of sobware dev is debugging Even more for kernel development How do you reduce /me
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du. Firewalls. Chester Rebeiro IIT Madras
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du Firewalls Chester Rebeiro IIT Madras Firewall Block unauthorized traffic flowing from one network to another
Outline. What is TCP protocol? How the TCP Protocol Works SYN Flooding Attack TCP Reset Attack TCP Session Hijacking Attack
Attacks on TCP Outline What is TCP protocol? How the TCP Protocol Works SYN Flooding Attack TCP Reset Attack TCP Session Hijacking Attack TCP Protocol Transmission Control Protocol (TCP) is a core protocol
Computer Architecture. CSE 1019Y Week 16. Introduc>on to MARIE
Computer Architecture CSE 1019Y Week 16 Introduc>on to MARIE MARIE Simple model computer used in this class MARIE Machine Architecture that is Really Intui>ve and Easy Designed for educa>on only While
Runtime Integrity Checking for Exploit Mitigation on Embedded Devices
Runtime Integrity Checking for Exploit Mitigation on Embedded Devices Matthias Neugschwandtner IBM Research, Zurich eug@zurich.ibm.com Collin Mulliner Northeastern University, Boston collin@mulliner.org
Fasten your seatbelts: We are escaping ios 11 sandbox! Min(Spark) Zheng & Xiaolong Alibaba Security Lab
Fasten your seatbelts: We are escaping ios 11 sandbox! Min(Spark) Zheng & Xiaolong Bai @ Lab Whoami SparkZheng @ Twitter spark @ Weibo Expert CUHK PhD, Blue-lotus and Insight-labs ios 9.3.4 & ios 11.3.1
Code architecture and organisation
RenderDoc Code architecture and organisation This document covers RenderDoc at a high level, giving you an idea of how the UI is separated from the rest of the code and generally how the capture & replay
These views are mine alone and don t reflect those of my employer
These views are mine alone and don t reflect those of my employer You are compromised - Player (1) Insert coin - If? When? Why? login: root Password: ********** Welcome back, root. root@localhost:~# _
Strengthening Cybersecurity Workforce Development December 2017
Strengthening Cybersecurity Workforce Development December 2017 Agenda 1. Introduc3ons SANS GIAC Team 2. Goal: 2017 Execu3ve Order 3. SANS GIAC NICE Workforce Framework (NCWF) Mapping Overview 4. Workforce
Scanning for low hanging fruit using open source tools. H. Carvey Chief Forensics Scien;st, ASI
Scanning for low hanging fruit using open source tools H. Carvey Chief Forensics Scien;st, ASI Introduction Who am I? Chief Forensics Scien;st at ASI. Forensic Nerd. Published Author. Why are we here?
Encyclopedia of Crash Dump Analysis Patterns Second Edition
Encyclopedia of Crash Dump Analysis Patterns Second Edition Detecting Abnormal Software Structure and Behavior in Computer Memory Dmitry Vostokov Software Diagnostics Institute OpenTask 2 Published by
Operating System Security
Operating System Security Operating Systems Defined Hardware: I/o...Memory.CPU Operating Systems: Windows or Android, etc Applications run on operating system Operating Systems Makes it easier to use resources.
Alterna(ve Architectures
Alterna(ve Architectures COMS W4118 Prof. Kaustubh R. Joshi krj@cs.columbia.edu hep://www.cs.columbia.edu/~krj/os References: Opera(ng Systems Concepts (9e), Linux Kernel Development, previous W4118s Copyright
The Heptane Static Worst-Case Execution Time Estimation Tool
The Heptane Static Worst-Case Execution Time Estimation Tool Damien Hardy Benjamin Rouxel Isabelle Puaut damien.hardy@irisa.fr benjamin.rouxel@irisa.fr isabelle.puaut@irisa.fr Institut de Recherche en
PM Support in Linux and Windows. Dr. Stephen Bates, CTO, Eideticom Neal Christiansen, Principal Development Lead, Microsoft
PM Support in Linux and Windows Dr. Stephen Bates, CTO, Eideticom Neal Christiansen, Principal Development Lead, Microsoft Windows Support for Persistent Memory 2 Availability of Windows PM Support Client
Malware Behavior. Chapter 11
Malware Behavior Chapter 11 Common Malware Functionalities Downloaders Backdoors Credential stealers Persistence mechanisms Privilege escalation Covering tracks (rootkits) Downloaders and Launchers Retrieve
Using ebpf for network traffic analysis. Samuele Sabella Luca Deri
Using ebpf for network traffic analysis Samuele Sabella Luca Deri Network Monitoring In the past few years the need to better understand what s happening in our networks has lead from tools for volumetric
Encyclopedia of Crash Dump Analysis Patterns
Encyclopedia of Crash Dump Analysis Patterns Detecting Abnormal Software Structure and Behavior in Computer Memory Dmitry Vostokov Software Diagnostics Institute OpenTask 2 Published by OpenTask, Republic
UFCETW-20-2 Examination Answer all questions in Section A (60 marks) and 2 questions from Section B (40 marks)
Embedded Systems Programming Exam 20010-11 Answer all questions in Section A (60 marks) and 2 questions from Section B (40 marks) Section A answer all questions (60%) A1 Embedded Systems: ARM Appendix
July 14, EPITA Systems/Security Laboratory (LSE) Code sandboxing. Alpha Abdoulaye - Pierre Marsais. Introduction. Solutions.
EPITA Systems/Security Laboratory (LSE) July 14, 2017 1 / 34 2 / 34 What do we want? Limit usage of some resources such as system calls and shared object functions But not from the whole program (we trust
Opera&ng Systems: Principles and Prac&ce. Tom Anderson
Opera&ng Systems: Principles and Prac&ce Tom Anderson How This Course Fits in the UW CSE Curriculum CSE 333: Systems Programming Project experience in C/C++ How to use the opera&ng system interface CSE
Reverse Engineering. Class 5. Malware Analysis. Reverse Engineering Class 5 Martin Balao martin.uy/reverse v1.0 EN CC BY-SA
Reverse Engineering Class 5 1 Something odd? 2 Process injection Hide and evade audit logs Bypass endpoint firewalls with application filtering Steal information from the injected process Change session
Operating Systems Course Overview
Operating Systems Course Overview Instructor: Kartik Gopalan Class website: http://oscourse.github.io Interfaces in a Computer System (1) User-level processes (2) (3) Libraries Operating System (4) (5)
Scaling DreamFactory
Scaling DreamFactory This white paper is designed to provide information to enterprise customers about how to scale a DreamFactory Instance. The sections below talk about horizontal, vertical, and cloud
Ethical Hacking. Content Outline: Session 1
Ethical Hacking Content Outline: Session 1 Ethics & Hacking Hacking history : How it all begin - Why is security needed? - What is ethical hacking? - Ethical Hacker Vs Malicious hacker - Types of Hackers
Processes and Threads
COS 318: Operating Systems Processes and Threads Kai Li and Andy Bavier Computer Science Department Princeton University http://www.cs.princeton.edu/courses/archive/fall13/cos318 Today s Topics u Concurrency
Reduce the Breach Detection Gap to Minutes. What is Forensic State Analysis (FSA)?
Reduce the Breach Detection Gap to Minutes Whether cloud-hosted or situated on premise, Cyber Threat Hunting as a Service is an essential and complimentary addition to any organization serious about security.
U-Boot and Linux Kernel Debug using CCSv5
U-Boot and Linux Kernel Debug using CCSv5 In this session we will cover fundamentals necessary to use CCSv5 and a JTAG to debug a TI SDK-based U-Boot and Linux kernel on an EVM platform. LAB: http://processors.wiki.ti.com/index.php/sitara_linux_training:_uboot_linux_debu
Chapter 4: Memory. Taylor & Francis Adair Dingle All Rights Reserved
Chapter 4: Memory Program Memory Overview Analysis of the impact of design on memory use Memory Abstrac9on Heap Memory Memory Overhead Memory Management Programmer s Perspec9ve Standard Views of Memory
Practical and Efficient Exploit Mitigation for Embedded Devices
Practical and Efficient Exploit Mitigation for Embedded Devices Matthias Neugschwandtner IBM Research, Zurich Collin Mulliner Northeastern University, Boston Qualcomm Mobile Security Summit 2015 1 Embedded
Chapter 8 Virtual Memory
Operating Systems: Internals and Design Principles Chapter 8 Virtual Memory Seventh Edition William Stallings Modified by Rana Forsati for CSE 410 Outline Principle of locality Paging - Effect of page
Using Hashing to Improve Volatile Memory Forensic Analysis
Using Hashing to Improve Volatile Memory Forensic Analysis American Academy of Forensic Sciences Annual Meeting February 21, 2008 AAron Walters awalters@volatilesystems.com Blake Matheny, LLC Center for
DLL Injection A DA M F U R M A N EK KON TA MF URMANEK. PL HT T P :/ /BLOG. A DAMF URM ANEK.PL
DLL Injection ADAM FURMANEK KONTAKT@ADAMFURMANEK.PL HT TP://BLOG.ADAMFURMANEK.PL Agenda What and Why Preliminaries How + Demos Summary 5/9/2018 5:24:18 PM ADAM FURMANEK DLL INJECTION 2 What and Why 5/9/2018
NEW CEIBO DEBUGGER. Menus and Commands
NEW CEIBO DEBUGGER Menus and Commands Ceibo Debugger Menus and Commands D.1. Introduction CEIBO DEBUGGER is the latest software available from Ceibo and can be used with most of Ceibo emulators. You will
0x1A Great Papers in Computer Security
CS 380S 0x1A Great Papers in Computer Security Vitaly Shmatikov http://www.cs.utexas.edu/~shmat/courses/cs380s/ slide 1 X. Chen, T, Garfinkel, E. Lewis, P. Subrahmanyam, C. Waldspurger, D. Boneh, J. Dwoskin,
Post exploitation techniques on OSX and Iphone. Vincenzo Iozzo
Post exploitation techniques on OSX and Iphone Vincenzo Iozzo vincenzo.iozzo@zynamics.com Who I am Student at Politecnico di Milano Security Consultant at Secure Network srl Reverse Engineer at zynamics
Secure boot under attack: Simulation to enhance fault injection & defenses
Secure boot under attack: Simulation to enhance fault injection & defenses Martijn Bogaard Senior Security Analyst martijn@riscure.com / @jmartijnb Niek Timmers Principal Security Analyst niek@riscure.com
Objec0ves. Gain understanding of what IDA Pro is and what it can do. Expose students to the tool GUI
Intro to IDA Pro 31/15 Objec0ves Gain understanding of what IDA Pro is and what it can do Expose students to the tool GUI Discuss some of the important func
Context based Online Configura4on Error Detec4on
Context based Online Configura4on Error Detec4on Ding Yuan, Yinglian Xie, Rina Panigrahy, Junfeng Yang Γ, Chad Verbowski, Arunvijay Kumar MicrosoM Research, UIUC and UCSD, Γ Columbia University, 1 Mo4va4on
FaRM: Fast Remote Memory
FaRM: Fast Remote Memory Problem Context DRAM prices have decreased significantly Cost effective to build commodity servers w/hundreds of GBs E.g. - cluster with 100 machines can hold tens of TBs of main
It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to
1 2 It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to keep putting garbage characters into the command
<Insert Picture Here> Boost Linux Performance with Enhancements from Oracle
Boost Linux Performance with Enhancements from Oracle Chris Mason Director of Linux Kernel Engineering Linux Performance on Large Systems Exadata Hardware How large systems are different
Virtual Memory Paging
Virtual Memory Paging An important task of a virtual-memory system is to relocate pages from physical memory out to disk Early UNIX systems swapped out the entire process at once Modern UNIX systems relay
PhD in Computer And Control Engineering XXVII cycle. Torino February 27th, 2015.
PhD in Computer And Control Engineering XXVII cycle Torino February 27th, 2015. Parallel and reconfigurable systems are more and more used in a wide number of applica7ons and environments, ranging from
Performance Best Practices Paper for IBM Tivoli Directory Integrator v6.1 and v6.1.1
Performance Best Practices Paper for IBM Tivoli Directory Integrator v6.1 and v6.1.1 version 1.0 July, 2007 Table of Contents 1. Introduction...3 2. Best practices...3 2.1 Preparing the solution environment...3
Design Principles & Prac4ces
Design Principles & Prac4ces Robert France Robert B. France 1 Understanding complexity Accidental versus Essen4al complexity Essen%al complexity: Complexity that is inherent in the problem or the solu4on
VM Design and Tradeoffs
VM Design and Tradeoffs or: Why bother having VM statistics? CS 161 2013 A3 Section 1 cs161@eecs.harvard.edu Max Wang max.wang@college Synchronization Synchronization How do you synch access to a table
Defeating Forensic Analysis
Defeating Forensic Analysis CEIC 2006 Technical Lecture 1 Thursday, May 4 10:30 am to 11:30 am Presented by Vincent Liu and Patrick Stach Welcome Vincent Liu Managing Director, Stach & Liu Researcher,
Rekall. Rekall Agent - OSDFCon Forensics. We will remember it for you wholesale! Michael Cohen
Agent - OSDFCon 2017 We will remember it for you wholesale! Michael Cohen mic@rekall-innovations.com is an open source project released under the GPL. It is not an official Google product, and does not