Dementia bluffs live memory analysis

Powered by SC Magazine
 

Forensics fooled.

View larger image View larger image View larger image

See all pictures here »

A security researcher has released a tool that hides a computer's memory to defeat live digital forensics efforts.

Dementia is a proof of concept tool for hiding various OS artifacts from the memory or crash dumps acquired by the memory acquisition software.

Creator Luka Milković told SC ahead of the Chaos Communication Congress last month the method used was an extension of existing research into disk anti-forensics. 

 

"It's intention is to raise awareness for (or to remind) the forensic professionals that memory forensics, any other live forensic process and forensic applications have potential pitfalls and problems." 
It could hide operating system objects like processes and threads from a host of forensic analysis applications including Volatility and Memoryze.

The Infigo security consultant said two fundamental problems with acquisition tools are that they are usually run on machines not controlled by the handler, meaning attackers can have a kernel-level visibility and control over the system. A further complication was that tools must dump their data either on a local or external disk, or on a networked machine.

"Although these issues are well known, many incident handlers and forensic experts are still using those methods because the alternatives are rare, difficult to use in practice or expensive," Milković said.

By combining these two issues and controlling the process of dump writing, attackers can defeat most live memory acquisition methods used by forensics experts and incident handlers.

Previous recent research into memory anti-forensic techniques and methods made it difficult to impossible to hide operating system objects like network connections and processes.

The research included methods that completely blocked the acquisition process and were therefore easy to detect, thwarted the acquisition and analysis processes by tricking the memory manager and modifying the kernel structures.

Copyright © SC Magazine, Australia


 
 
 
Top Stories
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
 
Doubts cast on Queensland's ICT Dashboard
Opposition, former Govt CIO say it can't be trusted.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  26%
 
Application integration concerns
  3%
 
Security and compliance concerns
  29%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 846

Vote