The Experts below are selected from a list of 1452 Experts worldwide ranked by ideXlab platform

Juan Caballero - One of the best experts on this subject based on the ideXlab platform.

  • SIGPATH: A Memory Graph Based Approach for Program Data Introspection and Modification
    2015
    Co-Authors: David Urbina, Juan Caballero, Zhiqiang Lin, Ut Dallas
    Abstract:

    Abstract. Examining and modifying data of interest in the Memory of a tar-get program is an important capability for security applications such as Memory Forensics, rootkit detection, game hacking, and virtual machine introspection. In this paper we present a novel Memory graph based approach for program data introspection and modification, which does not require source code, debugging symbols, or any API in the target program. It takes as input a sequence of mem-ory snapshots taken while the program executes, and produces a path signature, which can be used in different executions of the program to efficiently locate and traverse the in-Memory data structures where the data of interest is stored. We have implemented our approach in a tool called SIGPATH. We have applied SIG-PATH to game hacking, building cheats for 10 popular real-time and turn-based games, and for Memory Forensics, recovering from snapshots the contacts a user has stored in four IM applications including Skype and Yahoo Messenger. Key words: program data introspection, Memory graph, game hacking

  • sigpath a Memory graph based approach for program data introspection and modification
    European Symposium on Research in Computer Security, 2014
    Co-Authors: David I Urbina, Yufei Gu, Juan Caballero
    Abstract:

    Examining and modifying data of interest in the Memory of a target program is an important capability for security applications such as Memory Forensics, rootkit detection, game hacking, and virtual machine introspection. In this paper we present a novel Memory graph based approach for program data introspection and modification, which does not require source code, debugging symbols, or any API in the target program. It takes as input a sequence of Memory snapshots taken while the program executes, and produces a path signature, which can be used in different executions of the program to efficiently locate and traverse the in-Memory data structures where the data of interest is stored. We have implemented our approach in a tool called SigPath. We have applied SigPath to game hacking, building cheats for 10 popular real-time and turn-based games, and for Memory Forensics, recovering from snapshots the contacts a user has stored in four IM applications including Skype and Yahoo Messenger.

Golden G Richard - One of the best experts on this subject based on the ideXlab platform.

  • app agnostic post execution semantic analysis of android in Memory Forensics artifacts
    Annual Computer Security Applications Conference, 2020
    Co-Authors: Aisha Aligombe, Alexandra Tambaoan, Angela Gurfolino, Golden G Richard
    Abstract:

    Over the last decade, userland Memory Forensics techniques and algorithms have gained popularity among practitioners, as they have proven to be useful in real Forensics and cybercrime investigations. These techniques analyze and recover objects and artifacts from process Memory space that are of critical importance in investigations. Nonetheless, the major drawback of existing techniques is that they cannot determine the origin and context within which the recovered object exists without prior knowledge of the application logic. Thus, in this research, we present a solution to close the gap between application-specific and application-generic techniques. We introduce OAGen, a post-execution and app-agnostic semantic analysis approach designed to help investigators establish concrete evidence by identifying the provenance and relationships between in-Memory objects in a process Memory image. OAGen  utilizes Points-to analysis to reconstruct a runtime’s object allocation network. The resulting graph is then fed as an input into our semantic analysis algorithms to determine objects’ origin, context, and scope in the network. The results of our experiments exhibit OAGen’s ability to effectively create an allocation network even for Memory-intensive applications with thousands of objects, like Facebook. The performance evaluation of our approach across fourteen different Android apps shows OAGen  can efficiently search and decode nodes, and identify their references with a modest throughput rate. Further practical application of OAGen  demonstrated in two case studies shows that our approach can aid investigators in the recovery of deleted messages and the detection of malware functionality in post-execution program analysis.

  • hooktracer automatic detection and analysis of keystroke loggers using Memory Forensics
    Computers & Security, 2020
    Co-Authors: Andrew Case, Ryan D Maggio, Mohammad M Jalalzai, Aisha Aligombe, Mingxuan Sun, Golden G Richard
    Abstract:

    Abstract Advances in malware development have led to the widespread use of attacker toolkits that do not leave any trace in the local filesystem. This negatively impacts traditional investigative procedures that rely on filesystem analysis to reconstruct attacker activities. As a solution, Memory Forensics has replaced filesystem analysis in these scenarios. Unfortunately, existing Memory Forensics tools leave many capabilities inaccessible to all but the most experienced investigators, who are well versed in operating systems internals and reverse engineering. The goal of the research described in this paper is to make investigation of one of the greatest threats that organizations face, userland keyloggers, less error-prone and less dependent on manual reverse engineering. To accomplish this, we have added significant new capabilities to HookTracer, which is an engine capable of emulating code discovered in a physical Memory captures and recording all actions taken by the emulated code. Based on this work, we present new Memory Forensics capabilities, embodied in a new Volatility plugin, hooktracer_messagehooks, that uses Hooktracer to automatically decide whether a hook in Memory is associated with a malicious keylogger or benign software. We also include a detailed case study that illustrates our technique’s ability to successfully analyze very sophisticated keyloggers, such as Turla.

  • Memory Forensics and the Windows Subsystem for Linux
    Digital Investigation, 2018
    Co-Authors: Nathan Lewis, Andrew Case, Aisha Ali-gombe, Golden G Richard
    Abstract:

    Abstract The Windows Subsystem for Linux (WSL) was first included in the Anniversary Update of Microsoft's Windows 10 operating system and supports execution of native Linux applications within the host operating system. This integrated support of Linux executables in a Windows environment presents challenges to existing Memory Forensics frameworks, such as Volatility, that are designed to only support one operating system type per analysis task (e.g., execution of a single framework plugin). WSL breaks this analysis model as Linux forensic artifacts, such as ELF executables, are active in a sample of physical Memory from a system running Windows. Furthermore, WSL integrates Linux-specific data structures into existing Windows data structures, such as those used to track per-process metadata as well as userland runtime data. This integration results in existing analysis plugins producing inconsistent results when analyzing native Windows processes compared to WSL processes. Further complicating this situation is the fact that much of the WSL subsystem internals are completely undocumented. To remedy the current deficiencies related to WSL analysis, a research effort was undertaken to understand which existing Volatility plugins are affected by the introduction of WSL as well as what updates are necessary to fully support Memory Forensics of WSL. This paper describes these efforts, including our study of the operating systems data structures relevant to WSL as well as the development of new Volatility analysis plugins.

  • gaslight a comprehensive fuzzing architecture for Memory Forensics frameworks
    Digital Investigation, 2017
    Co-Authors: Andrew Case, A Das, Seungjong Park, J Ramanujam, Golden G Richard
    Abstract:

    Abstract Memory Forensics is now a standard component of digital forensic investigations and incident response handling, since Memory forensic techniques are quite effective in uncovering artifacts that might be missed by traditional storage Forensics or live analysis techniques. Because of the crucial role that Memory Forensics plays in investigations and because of the increasing use of automation of Memory Forensics techniques, it is imperative that these tools be resilient to Memory smear and deliberate tampering. Without robust algorithms, malware may go undetected, frameworks may crash when attempting to process Memory samples, and automation of Memory Forensics techniques is difficult. In this paper we present Gaslight, a powerful and flexible fuzz-testing architecture for stress-testing both open and closed-source Memory Forensics frameworks. Gaslight automatically targets critical code paths that process Memory samples and mutates samples in an efficient way to reveal implementation errors. In experiments we conducted against several popular Memory Forensics frameworks, Gaslight revealed a number of critical previously undiscovered bugs.

  • Memory Forensics
    Digital Investigation, 2017
    Co-Authors: Andrew Case, Golden G Richard
    Abstract:

    Traditionally, digital Forensics focused on artifacts located on the storage devices of computer systems, mobile phones, digital cameras, and other electronic devices. In the past decade, however, researchers have created a number of powerful Memory Forensics tools that expand the scope of digital Forensics to include the examination of volatile Memory as well. While Memory forensic techniques have evolved from simple string searches to deep, structured analysis of application and kernel data structures for a number of platforms and operating systems, much research remains to be done. This paper surveys the state-of-the-art in Memory Forensics, provide critical analysis of current-generation techniques, describe important changes in operating systems design that impact Memory Forensics, and sketches important areas for further research.

Rifyandaru Wibisono - One of the best experts on this subject based on the ideXlab platform.

  • analisis malware pada sistem operasi android menggunakan Memory Forensics berdasarkan api
    eProceedings of Engineering, 2019
    Co-Authors: Rifyandaru Wibisono
    Abstract:

    Abstrak Malware adalah sebuah program yang berada pada sistem operasi dan dapat membahayakan sistem operasi yang terjangkit. Dalam perkembangan internet banyak sekali jenis malware yang dapat ditemukan dalam internet seperti android malware. Android malware adalah malware yang membuat pengaruh negatif pada sistem operasi android. Malware memiliki tujuan untuk merugikan pengguna pada sistem operasi yang terjangkit. Oleh sebab itu digunakanlah malware analysis untuk mengidentifikasi malware. Malware analysis adalah cara untuk mendapatkan informasi dari malware untuk mengatasi serangan terhadap korban yang terinfeksi. Dalam melakukan malware analysis bisa digunakan beberapa cara untuk mendeteksi malware seperti mendeteksi berdasarkan penggunaan Memory. Dalam mendeteksi malware berdasarkan Memory bisa digunakannya Memory forensic untuk melakukan pendeteksian. Setelah mendapatkan hasil dari deteksi malware akan digunakannya sebuah cara untuk melakukan memberikan dampak untuk malware berdasarkan API. Dalam menggunakan Memory Forensics digunakan tools volatility untuk mendapatkan hasil analisis malware dan menggunakan reverse engineering dengan tools APKtools untuk mengetahui malicious activity berdasarkan penggunaan API dari aplikasi tersebut. Dalam penelitian ini digunakan 10 malware untuk dilakukan analisis menggunakan volatility dan APKtools untuk memberikan dampak mengunakan hasil dari analisis dan juga berdasarkan malicious activity dari API. Maka dari tu hasil dari penelitian ini adalah dampak yang berkaitan dengan API dan hasil analisis. Kata kunci : malware, malware analysis, Memory, Memory usage. Abstract Malware is a program that is on an operating system and can endanger the affected operating system. In the development of the internet there are many types of malware that can be found on the internet such as Android malware. Android malware is malware that makes a negative influence on the Android operating system. Malware has the purpose of harming users of the affected operating system. Therefore malware analysis is used to identify malware. Malware analysis is a way to get information from malware to deal with attacks on infected victims. In doing analysis malware can be used several ways to detect malware such as detecting based on Memory usage. In detecting malware based on Memory you can use forensic Memory to detect it. After getting the results of malware detection a method will be used to make an impact on malware based on API. In using Memory Forensics tools used volatility to get the results of malware analysis and use reverse engineering with APKtools tools to find out malicious activity based on the use of the API from the application. In this study 10 malware were used to analyze the use of volatility and APK tools to have an impact on using the results of analysis and also based on malicious activity from the API. So from the results of this study are the impacts related to the API and the results of analysis. Keywords: malware, malware analysis, Memory, Memory Forensics.

  • ANALISIS MALWARE PADA SISTEM OPERASI ANDROID MENGGUNAKAN Memory Forensics BERDASARKAN API
    Universitas Telkom S1 Sistem Informasi, 2019
    Co-Authors: Rifyandaru Wibisono
    Abstract:

    Malware adalah sebuah program yang berada pada sistem operasi dan dapat membahayakan sistem operasi yang terjangkit. Dalam perkembangan internet banyak sekali jenis malware yang dapat ditemukan dalam internet seperti android malware. Android malware adalah malware yang membuat pengaruh negatif pada sistem operasi android. Malware memiliki tujuan untuk merugikan pengguna pada sistem operasi yang terjangkit. Oleh sebab itu digunakanlah malware analysis untuk mengidentifikasi malware. Malware analysis adalah cara untuk mendapatkan informasi dari malware untuk mengatasi serangan terhadap korban yang terinfeksi. Dalam melakukan malware analysis bisa digunakan beberapa cara untuk mendeteksi malware seperti mendeteksi berdasarkan penggunaan Memory. Dalam mendeteksi malware berdasarkan Memory bisa digunakannya Memory forensic untuk melakukan pendeteksian. Setelah mendapatkan hasil dari deteksi malware akan digunakannya sebuah cara untuk melakukan memberikan dampak untuk malware berdasarkan API. Dalam menggunakan Memory Forensics digunakan tools volatility untuk mendapatkan hasil analisis malware dan menggunakan reverse engineering dengan tools APKtools untuk mengetahui malicious activity berdasarkan penggunaan API dari aplikasi tersebut. Dalam penelitian ini digunakan 10 malware untuk dilakukan análisis menggunakan volatility dan APKtools untuk memberikan dampak mengunakan hasil dari análisis dan juga berdasarkan malicious activity dari API. Maka darii tu hasil dari penelitian ini adalah dampak yang berkaitan dengan API dan hasil análisis

David I Urbina - One of the best experts on this subject based on the ideXlab platform.

  • sigpath a Memory graph based approach for program data introspection and modification
    European Symposium on Research in Computer Security, 2014
    Co-Authors: David I Urbina, Yufei Gu, Juan Caballero
    Abstract:

    Examining and modifying data of interest in the Memory of a target program is an important capability for security applications such as Memory Forensics, rootkit detection, game hacking, and virtual machine introspection. In this paper we present a novel Memory graph based approach for program data introspection and modification, which does not require source code, debugging symbols, or any API in the target program. It takes as input a sequence of Memory snapshots taken while the program executes, and produces a path signature, which can be used in different executions of the program to efficiently locate and traverse the in-Memory data structures where the data of interest is stored. We have implemented our approach in a tool called SigPath. We have applied SigPath to game hacking, building cheats for 10 popular real-time and turn-based games, and for Memory Forensics, recovering from snapshots the contacts a user has stored in four IM applications including Skype and Yahoo Messenger.

Ibrahim Baggili - One of the best experts on this subject based on the ideXlab platform.

  • Memory foreshadow Memory Forensics of hardware cryptocurrency wallets a tool and visualization framework
    Digital Investigation, 2020
    Co-Authors: Tyler Thomas, Mathew Piscitelli, Ilya Shavrov, Ibrahim Baggili
    Abstract:

    Abstract We present Memory FORESHADOW: Memory Forensics of HArDware cryptOcurrency Wallets. To the best of our knowledge, this is the primary account of cryptocurrency hardware wallet client Memory Forensics. Our exploratory analysis revealed forensically relevant data in Memory including transaction history, extended public keys, passphrases, and unique device identifiers. Data extracted with FORESHADOW can be used to associate a hardware wallet with a computer and allow an observer to deanonymize all past and future transactions due to hierarchical deterministic wallet address derivation. Additionally, our novel visualization framework enabled us to measure both the persistence and integrity of artifacts produced by the Ledger and Trezor hardware wallet clients. The framework can be generalized for use in future Memory Forensics work.

  • Memory FORESHADOW: Memory Forensics of HArDware CryptOcurrency wallets – A Tool and Visualization Framework
    Forensic Science International: Digital Investigation, 2020
    Co-Authors: Tyler Thomas, Mathew Piscitelli, Ilya Shavrov, Ibrahim Baggili
    Abstract:

    Abstract We present Memory FORESHADOW: Memory Forensics of HArDware cryptOcurrency Wallets. To the best of our knowledge, this is the primary account of cryptocurrency hardware wallet client Memory Forensics. Our exploratory analysis revealed forensically relevant data in Memory including transaction history, extended public keys, passphrases, and unique device identifiers. Data extracted with FORESHADOW can be used to associate a hardware wallet with a computer and allow an observer to deanonymize all past and future transactions due to hierarchical deterministic wallet address derivation. Additionally, our novel visualization framework enabled us to measure both the persistence and integrity of artifacts produced by the Ledger and Trezor hardware wallet clients. The framework can be generalized for use in future Memory Forensics work.

  • inception virtual space in Memory space in real space Memory Forensics of immersive virtual reality with the htc vive
    Digital Investigation, 2019
    Co-Authors: Peter Casey, Ibrahim Baggili, Rebecca Lindsaydecusati, Frank Breitinger
    Abstract:

    Abstract Virtual Reality (VR) has become a reality. With the technology's increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional “dead” analysis. Following the trend of anti-Forensics, evidence of an attack may only be found in Memory, along with many other volatile data points. Our work provides the primary account for the Memory Forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from Memory that are relevant to the VE, and is also capable of reconstructing a visualization of the room setup a VR player was immersed into. In specific, we demonstrate that the VE, location, state and class of VR devices can be extracted from Memory. Our work resulted in the first open source VR Memory Forensics plugin for the Volatility Framework. We discuss our findings, and our replicable approach that may be used in future Memory Forensics research.