General Notes

I attended both the Open Memory Forensics Workshop (OMFW) and the Open Source Digital Forensics Conference (OSDFC) for the first time last year and just like I said last year - they’re both set as recurring events on my calendar now. I was told that my tweets and recap post of last years activities was helpful to those who couldn’t attend so I figured I’d write up something again since I took notes anyway. I really like that both conferences have ~30-40 minute talks so you’re not stuck listening to anyone ramble about anything and you also get the benefit of getting more presentations. If you haven’t been able to make either of these yet or are still debating if you should attend - go for it. They’re both 1 day (well, if you just go to the presentations) each and I have yet to be let down with the overall quality of presentations and better yet, the networking that you’re able to do at them.

Best Quotes of the Cons

They can tunnel faster than you can image - @williballenthin

Brian Carrier just virtually twerked the audience - @bbaskin

What one man can invent, another man can discover - Sherlock Holmes (on someone’s t-shirt)

Disclaimer - I didn’t make it to every talk at OSDFC so if I don’t have notes on it, sorry. Also - these are notes that I jotted down so if something is wrong or there are slides uploaded for ones I didn’t link please contact me so I can update the post.

OMFW

The first thing I want to say about this conference was how glad I was that it was at the same venue as OSDFC this year - this makes it really convenient for those attending both so hopefully it stays that way next year {nudge @volatility}.

The State of Volatility

Highlights

- The Volatility Foundation has officially become a 501(c)(3)
- Version [2.3.1](https://code.google.com/p/volatility/wiki/Release23) of Volatility is officially released and includes full Mac support, Android/ARM support, new address spaces and new/updated plugins.
- AAron also touched on a new plugin he created, [dumpfiles](https://code.google.com/p/volatility/wiki/CommandReference23#dumpfiles), which is extremely useful as it reconstructs files from the Windows cache manager and share section objects. 

Stabalizing Volatility

Highlights

• Version 2.4 of Volatility is pretty much done already but the real focus is version 3 of Volatility.
• The big thing I took away here is that it will be written in Python v3… so I guess it’s time to start writing in it too

Mastering Truecrypt and Windows 8/Server 2012 Memory Forensics

Highlights

• The older versions aren’t currently supported but that doesn’t indicate that it can’t, just that most people are probably using the newer versions of it anyway so why waste time on it?
• Did I mention Volatility can analyze Windows 8 and Server 2012 dumps? The true beauty of open source showed here… just after new releases came to the market there were Volatility profiles to analyze them. This is pure awesomeness because it means you don’t have to wait for a vendor to implement it into a new release of the tool you’re using… you can go home and analyze it today!
• Two new plugins were mentioned, and are said to be committed in v2.4, Truecryptpassprase and Truecryptsummary

All Your Social Media are Belong to Volatility

Highlights

• The first thing about his presentation that caught my eyes was his slide deck. After digging a little into his source code I saw it was all being done with reveal.js - cool thing to bookmark and also gives you the ability to say “my slides are online right now” so people don’t have to bug you about where to find them.
• After watching Jeff demo his plugins some discussions started to spark. When you visit these social media pages you get a huge JSON file returned and why you may not realize it - there’re some real gems in there. You have the possibility of determining who a users friends are, what they ‘like’/’favorite’, what they’ve viewed etc. This can be significant if you need to say they’ve communicated with someone or viewed something they’re denying.

All the things you think only exist in movies and sci-fi books

…OK, I made up the title because I don’t remember what it was… but I think this one is fitting anyway

Highlights

• scary, fun, exciting
• George went into detail about engagements he’s been on where there was malware in the BIOS and optical drives…. and of course the recent buzz around ‘airgapped’ malware wasn’t left out. The only difference… this wasn’t fabricated in a Hollywood studio. This got me thinking, as I’m sure many other in attendance and reading this… how the hell do you even detect these types of things? I know for sure I’m not looking for this type of malware in my routine investigations but I guess if there’s some suspicion then this type of deeper analysis could be started.

Memory, Volatility and the Threat Intel life Cycle

Highlights

• While I’m sure some of those reading this post already do similar things within their analysis process, I figured it would still be worth mentioning a good tactic they covered - making YARA signatures for all archive utilities, Microsoft tools (e.g. - net, copy, xcopy, ftp, psexec, sticky keys etc.). Useful for many things but in this talk they mentioned leveraging these rules with yarascan to run across memory dumps.
• They also discussed some of the things they’ve encountered during engagements and some of the things they’ve needed to recommend to customers. I feel these are worth pointing out here because I may or may not also come across a lot of these too often and feel they need to be changed as well : 2 factor authentication, flat networks, ability to change all passwords and ability to perform DNS sink-holing.

Dalvik Memory Analysis and a Call to ARMs

Highlights

• The tool referenced above may or may not sound familiar to you… but in case it doesn’t or you forgot where you hear it from, check out the related blog post for it. The tool looks pretty slick and the auto creation of Volatility plugins will surely help others during their Android investigations. I didn’t hear an exact date on its release but it’s supposed to be soon so be on the look out!

Bringing Mac Memory Forensics to the Mainstream

Highlights

• There are some Mac profiles are in a .zip file on the wiki

  Don’t copy them all to the Volatility directory or upon execution it will load each of them and slow things down. Only copy the one that’s applicable.

• launchd shouldn’t be a child process
• lsmod may show ones with a size of 0 and aren’t found on disk - doesn’t mean it’s malware
• slide 4 on Mac userland rootkits shows how to detect them with plugins (these slides would help, nudge @attrc).
• 10.9.x of Mac compresses free pages so running strings over a dump won’t show anything

Memoirs of a Hidsight Hero: Detecting Rootkits in OS X

Highlights

• There was some really good information here on showing how to detect every new method some authors were saying couldn’t be detected but I think the slides would be of better explanation.

Every Step You Take: Profiling the System

Highlights

• Jamie touched on a plugin she created a little bit ago, CybOX, which checks for threat indicators in memory samples
• There was also mention of profiling memory dumps. I can’t specifically recall if there was a plugin called ‘profiler’ but never the less, it was sweet. Think about generating profiles of memory dumps so you can detect either good stuff or malicious stuff. In one way of thinking, you can create your golden profile - a baseline of a clean system so you can diff that against another memory dump and see what’s different. This can help detect new software, processes etc. Another thought is creating a memory dump while the system is infected and then using some of those artifacts to later determine if they exist in another memory dump. This is something that can scale and I’m really excited to start playing with it.

Honorable Mention

• ethscan - This plugin was a runner up in Volatility’s plugin contest but it’s definitely something I can start to leverage on engagements right away. I’m not sure how the author’s blog post managed to slip under the cracks but it’s linked above so give it a look. I like the fact that it will work for any OS’ memory dump and can utilize dpkt to save the network traffic to a PCAP file.

OSDFC

First… I’m glad the official conference page had a Twitter hashtag to use this year but I still ran into the same issue as last year - people using a variety of hashtags… stick to the default! One of the first observations this year was that it appeared the attendance was double that of last year. Additionally, I noticed there were a lot of younger attendees this year so it’s great to see them getting involved and starting to network. On the disappointing side - I did feel like I was seeing a noticeable amount of people doing the same things as others have already done. I know it’s useful from a learning perspective to do things yourself but why spend so much time re-doing something that’s already out there to use?

Forensics Visualizations with Open Source Tools

Highlights

• No seriously, doesn’t like pie graphs… and when he rotated them around it kind of made sense. When you rotate the pie chart the focus of what you’re trying to show changes. He referenced another presentation, Save the Pies for Desert, that’s worth a read.
• Simson brought up an interesting point that some graphing tools (graphviz etc.) will produce different graphs when run more than once. This happens when there’s randomized algorithms being used and the seed keeps changing when producing the graphs. Not good when need things to be repeatable by others.
• Have you every visualized network traffic? It can certainly be helpful… what about creating some stats/reports? Sometimes looking at graphs instead of lines within Wireshark can help show things you might have otherwise missed. A quick, high-level overview can be generated with ‘netviz’ (slide 46). It’s currently within tcpflow and creates some histogram for you.
• He made some valid points for PDFs having a high resolution that could be zoomed in on and also they have the ability to be text searchable

Autopsy 3: Extensible Desktop Forensics

Highlights

• Brian had a great transition in his slides to incorporate a Miley Cyrus picture (related quote later in this post)
• The keyword searches within Autopsy refresh every 5 mins by default
• The searches for specific locations (e.g. - user’s folders) are prioritized so their results show first. (can this be modified??)
• The video triage module does periodic screenshots of the video so you don’t have to sit there and watch the entire thing to see if it changes at any point
• The text gisting module helps translate text into English
• Future things - will use SQLite for hash DB, carve using Scalpel and will have Mac and *nix installers

“Challenge Results” - Autopsy Module Contest

Highlights

• Registry Module; an entire library in Java
• fuzzy Hash Module

A Tool for Answering the Question: What Changed on Disk?

Highlights

• Armour - shell program to compare TSK bodyfile’s
• slide 15 - cmd’s
• slide 19 - cuckoo report
• Not just used for VM diffing, slide 21 - can do psychical machine disk diffing w/ external drive and *nix live cd

Bulk_Extract Like a Boss

Highlights

• Unicode shout out to U+1F4A9 (you know you want to look this up now)
• With lightgrep incorporated into bulk_extractor, if you disable the normal ‘find’ disabled (-x find) you’ll have blazingly fast searches - slide 11
• Bulk_extractor contains recursive scanners to extract files then scan them (defaults to recurse 7 times to make sure don’t fall into zip bombs)
• There’s a couple of new scanners - xor and hiberfil
• “useful options” - slide 8
• paper in last years DFWRS on its unicode support
• Lightgrep is incorporated into the Windows installer and the source can be downloaded and installed yourself for other flavors

Making Molehills Out of Mountains: Data Reduction Using Sleuth Kit Tools

Highlights

• Built to work on DEFT v8
• Created a bash script that leverages TSK
• limitations: limited to FAT/NTFS partitions and relies on file extentions to determine file types

Doing More with Less: Triaging Compromised Systems with Constrained Resources

Highlights

• ‘pareto principle’ - get 20% of artifacts to answer 80% of the questions
• The key data to grab is generally the $MFT, Registry files and Event Logs (others, depending in your questions to ask could be memory, Internet history etc.)
• These key files compress extremely well and are generally result in being under 100MB

Willi also mentioned a GUI Event Log Viewer which has the ability to index records for easier searching and puts the event IDs in categories/sub-categories that are sortable. This is something I had talked to a few about over the years and I’m really glad to see someone finally doing it, thanks Willi! This currently isn’t publicly released yet but be on the lookout.

Computer Forensic Triage using Manta Ray

Highlights

• Going to be in SIFT v3.0 but for the time being it’s at mantarayforensics.com

Honorable Mention

• Noriben - Brian Baskin gave a quick demo of his latest version ; useful for quick analysis
• SIFTER - “the Google of digital forensics”… I unfortunately didn’t make it to this talk but I heard it was great so I’m putting it here as it’s something I want to look into and feel others might want to as well. MassScan - This was described as an internal VirusTotal tool. Unfortunately the display on the projectors wasn’t working properly so it wasn’t easy to follow along but I’m eager to see the code and what it can really do. (anyone have a link?)